Privacy Policy

Last updated: 7 October 2026

This Privacy Policy explains how Grae Matta Foundation (“we”, “us” or “our”) collects, uses and protects personal information when you visit istandupformentalhealth.org, contact us, sign up for updates or support the I Stand Up For Mental Health campaign.

For the purposes of UK data protection law, the data controller is:

Grae Matta Foundation
Company number: 10976526
27 Old Gloucester Street
London
WC1N 3AX
United Kingdom

Email: info@graemattafoundation.org

Grae Matta Foundation is registered at the address above.

1. Information we may collect

Depending on how you use the website, we may collect:

your name;
your email address;
information you provide when contacting us;
your preferences regarding email news and updates;
limited information connected with a donation where this is made available to us by PayPal or PayPal Giving Fund;
technical information such as IP address, browser type, device information and basic server logs;
information about how the website is used where you have consented to analytics;
information about your cookie and privacy preferences; and
any other information you choose to provide to us.

We do not intentionally ask visitors to provide medical records or detailed health information through this website.

Because this campaign concerns mental health, please avoid including sensitive health or medical information in general enquiries unless it is genuinely necessary.

This website and its contact form do not provide clinical or emergency mental health support.

2. How we collect information

We may collect information:

directly from you when you complete a contact form or contact us;
when you subscribe to campaign or Foundation news and updates;
from PayPal or PayPal Giving Fund in connection with a donation;
automatically through our website hosting, security and server systems;
through Google Analytics where you have consented to analytics; and
through CookiePal when you make or change your cookie and privacy choices.

3. How we use your information

We may use personal information to:

respond to enquiries and communications;
manage our communications with you;
send occasional campaign or Foundation news and updates where you have chosen to receive them;
administer donations and maintain appropriate financial records;
operate, maintain and secure the website;
prevent fraud, abuse and security incidents;
understand how visitors use the website and improve its content, usability and performance where analytics consent has been provided; and
comply with applicable legal, regulatory, accounting and tax obligations.

We do not sell your personal information.

4. Our lawful bases for using personal information

Under UK data protection law, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

Legitimate interests

We may process information where reasonably necessary to operate and protect the website, administer the campaign, respond to enquiries and maintain appropriate records, provided our interests do not override your rights and interests.

We rely on your consent where you choose to:

receive news, campaign updates or other email communications; or
allow optional analytics cookies and similar technologies.

You may withdraw your consent at any time.

Legal obligation

We may process or retain information where required to comply with legal, accounting, tax, regulatory or other statutory obligations.

Contract or steps taken at your request

Where appropriate, we may process information where necessary to provide something you have requested or to take steps at your request.

5. Email news and updates

You can choose to receive occasional news, updates and information from Grae Matta Foundation and the I Stand Up For Mental Health campaign.

The contact form currently includes a separate optional choice for these communications.

We will only send these communications where you have chosen to receive them.

You can unsubscribe at any time by using the unsubscribe option included in our emails or by contacting us at info@graemattafoundation.org.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Donations and PayPal

Donation links on this website may direct you to PayPal or PayPal Giving Fund.

Payment information entered on PayPal’s website is processed by PayPal and/or PayPal Giving Fund under their own privacy and security arrangements.

We do not receive or store your complete payment-card or bank-account details.

We may receive limited information relating to a donation where this is made available to us, such as donor details, donation amount or transaction information required for donation administration and financial records.

You should review PayPal and PayPal Giving Fund’s own privacy information before completing a donation.

7. Google Analytics

We use Google Analytics 4 to understand how visitors use the website and to help us improve its content, usability and performance.

Where you consent to analytics, Google Analytics may collect information including:

pages viewed;
interactions with website content;
approximate source of your visit;
browser and device information;
approximate geographic information; and
website and session information.

Google Analytics uses a first-party identifier stored in the _ga cookie to distinguish users and sessions when analytics storage is permitted.

We do not intentionally send names, email addresses, contact-form messages or other directly identifying form information to Google Analytics.

Google Analytics is implemented through Google Tag Manager and is treated as an optional analytics service controlled through our cookie-consent system. We use CookiePal together with Google Consent Mode so that analytics storage is denied by default and is only permitted after you provide the relevant consent.

You can change or withdraw your analytics consent through the website’s cookie settings.

Our Google Analytics property is configured so that user-level and event-level data is retained for 14 months.

We have also disabled the setting that resets the user-data retention period when a visitor returns to the website.

Google notes that these retention controls relate primarily to user-level and event-level data and do not affect most aggregated standard reports.

We use CookiePal as our consent-management platform.

CookiePal enables visitors to accept, reject or manage optional cookies and similar technologies and helps us record and respect those choices.

CookiePal stores the visitor’s consent choice in a cookie called cookiepal-consent.

You can reopen the website’s cookie settings at any time to change or withdraw your choices.

9. Server logs and website security

Like most websites, our hosting provider and website systems may automatically record technical information when the website is accessed.

This may include:

IP address;
date and time of access;
requested pages;
browser and device information;
referring page; and
information relating to errors or suspected malicious activity.

We use this information where reasonably necessary to operate the website, diagnose technical problems, maintain security and prevent misuse.

Where necessary, personal information may be processed by organisations that help us operate the website and campaign, including:

website hosting and technical service providers;
email and communications providers;
CookiePal, for cookie and consent management;
Google, where Google Analytics has been enabled with your consent;
PayPal and PayPal Giving Fund in connection with donations;
professional advisers where necessary; and
regulators, law-enforcement agencies or public authorities where required by law.

We require service providers processing personal information on our behalf to protect it appropriately.

We do not sell personal information to third parties.

11. International transfers

Some technology, analytics, communications and payment providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps to ensure that transfers comply with UK data protection law and that appropriate safeguards are used where required.

12. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, regulatory, accounting and tax requirements.

For example:

general enquiries are retained only for as long as reasonably necessary to deal with the enquiry and any relevant follow-up;
email subscription information is retained while you remain subscribed, together with any limited information required to maintain an unsubscribe record;
donation and financial records may be retained where required for accounting or legal purposes;
Google Analytics user-level and event-level data is configured to be retained for 14 months;
technical and security logs are retained only for an appropriate operational or security period; and
records of cookie and privacy choices may be retained where necessary to demonstrate compliance.

When information is no longer required, we will delete or anonymise it where reasonably practicable.

13. Cookies and similar technologies

We use cookies and similar technologies for website operation, security, remembering privacy choices and optional website analytics.

CookiePal is used to manage cookie preferences.

Optional analytics technologies, including Google Analytics, are controlled through the choices provided by our cookie-consent system.

You can change your preferences at any time.

Please see our Cookies Policy for further information.

14. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights relating to your personal information, including the right to:

ask what personal information we hold about you and request a copy;
ask us to correct inaccurate or incomplete information;
ask us to delete information in certain circumstances;
ask us to restrict the way we use information in certain circumstances;
object to certain uses of information;
withdraw consent where processing is based on consent; and
request portability of certain information where the right applies.

Not all rights apply in every situation, and some information may need to be retained where we have a legal obligation to keep it.

To exercise your rights, contact:

info@graemattafoundation.org

We may need to ask for sufficient information to confirm your identity before responding.

15. Complaints

If you have concerns about how we handle your personal information, please contact us first so that we can investigate.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.

16. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

However, no method of transmitting or storing information online can be guaranteed to be completely secure.

17. Links to other websites

Our website may contain links to websites operated by third parties.

We are not responsible for the privacy practices of third-party websites. You should review their privacy information when visiting them.

18. Changes to this Privacy Policy

We may update this Privacy Policy when our website, services, legal obligations or data-processing practices change.

The date at the top of this page shows when the policy was last updated.

19. Contact us

For questions about this Privacy Policy, your personal information or your data-protection rights, contact: