Privacy Policy

Data We Hold

• Volunteer and authorised-user identity details required for secure access and audit records.
• Donor contact and payment-reference details required for receipts and reconciliation.
• Private case, referrer, confirmation, purchase, delivery, and evidence records required to provide and account for support.
• Public case and financial summaries that have been deliberately de-identified.

Purpose and Consent

We collect only information reasonably needed to verify requests, provide support, reconcile donations, keep statutory records, secure the service, and respond to enquiries. We do not sell or rent personal data and do not use it for advertising or profiling.

Data Subject Rights

You may request access to or correction of your personal data, or withdraw consent where applicable. Requests are handled in line with the PDPA and any legal record-retention duties.

Disclosure of Personal Data

• Legal obligations, including valid law-enforcement or government requirements.
• Service providers acting under appropriate confidentiality and security obligations.
• A disclosure for which the affected person has provided explicit consent.

Authentication and Cookies

Essential authentication cookies may be used to maintain secure volunteer sessions. Cloudflare Access is the planned volunteer identity layer; it may use Google as an identity provider. We do not use authentication data for marketing.

Security and Retention

Private evidence is stored separately from public records with access controls. Sensitive operational records are retained only for their approved business, audit, or legal period and are then securely deleted or anonymised.

Breach Notification

Suspected or confirmed breaches are escalated immediately. Where required, Bread Breakers will assess the breach and notify the PDPC and affected individuals.

Contact

Questions, access requests, corrections, or withdrawal requests may be submitted through the Contact page.