Privacy Policy


Our Privacy Policy describes our policies and procedures on the collection, use and disclosure of your information when using the Survive Child Abuse website.

How we collect, use and protect your personal information when you visit survivechildabuse.com or interact with us.

If you need support right now, please visit our Safety Information page.

On this page
All legal pages Terms & Conditions Cookies Policy Editorial Policy Disclaimer

1. About this policy

This Privacy Policy explains how Survive Child Abuse collects, uses, shares and protects your personal information when you visit survivechildabuse.com, contact us through the site, or otherwise interact with us.

We are based in the United Kingdom. The website is hosted in the United Kingdom by Krystal. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

If anything in this policy is unclear, please contact us using the details in section 14.

2. Who we are and how to contact us

Survive Child Abuse is an independent, peer-led group of adult survivors of childhood abuse based in the United Kingdom. We operate survivechildabuse.com to share information, reflections, and practical support.

Survive Child Abuse is the data controller for the personal information collected through this website. Our day-to-day data protection contact is our Website Administrator, who can be reached at .

3. The personal information we collect

We collect different categories of personal information depending on how you interact with us.

3.1 Visitors to the website

  • Anonymous usage statistics: We use Koko Analytics to track how our site is used. Koko Analytics does not use cookies, collects no personal data, and stores all data securely on our own UK-based Krystal server. Statistics recorded include pages visited, visitor counts, referral source, approximate country of origin, and device/browser type — none of which is linked to you as an individual. No analytics data leaves our server.
  • Technical information: Our hosting provider, Krystal, may log standard server data such as IP address, browser type, and timestamps for security and infrastructure purposes. These logs are not accessed by us in the ordinary course of operating the site.
  • Cookie data: see our Cookies Policy for full detail.

3.2 People who contact us

  • The information you choose to provide in our contact form: your name (or pseudonym), email address, the type of enquiry, and the content of your message.
  • We do not log your IP address when you submit a contact form.
  • If your message includes information about your experience of childhood abuse, that information is special category personal data (see section 4).
  • Enquiry form submissions are stored within our contact form system for up to 180 days, after which they are automatically and permanently deleted (see section 8).

3.3 Contributors and authors

  • If you request a submission pack, we collect your name and email address to send the pack to you. The submission pack request form does not store this information in our website CMS — your details are used only to deliver the pack by email and are not retained in our website database.
  • If you go on to submit a Spark, Hints & Tips piece, or “What I’ve Learnt” piece, the editorial process is managed entirely by email. Information we hold includes: your real name and email address (for correspondence), the pen name or “Anonymous” credit you choose for publication, the content you submit, and the signed Publication Consent Form authorising publication.
  • We do not log your IP address when you submit the submission request form.
  • Your 12-month editorial and retention cycle begins from the date of your first submission (see section 8).

3.4 Donors and supporters

  • If you make a donation, your payment is processed by Stripe, Inc. via Paymattic. Stripe handles all payment data under its own privacy policy. We receive only the transaction amount, date, and (where you provide it) your name and email address. We do not store your payment card details and we do not log your IP address at point of donation.

3.5 Information we do not collect

  • We do not knowingly collect personal information from anyone under the age of 18. survivechildabuse.com is intended for adult survivors and adults supporting them.
  • We do not collect bank account or payment-card details directly. Donations are processed by Stripe, Inc. under their own privacy policy.
  • We do not log IP addresses submitted via our contact or submissions forms.

4. Special category and sensitive information

Information about a person’s health, sex life, sexual orientation or experience of abuse is “special category” personal data under Article 9 UK GDPR. Information about criminal allegations or convictions is treated as similarly sensitive under Article 10 and Schedule 1 of the Data Protection Act 2018.

We recognise that messages, contributions, and disclosures made to us frequently include this kind of information. We treat it with particular care: access is restricted to the relevant members of our editorial team, retention is limited (see section 8), security is enhanced, and we rely on clear lawful bases (see section 5).

5. How we use your information and our lawful basis

We use your personal information for the following purposes. For each we identify the lawful basis under Article 6 UK GDPR and, where relevant, the additional condition under Article 9 for special category data. Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Contact form enquiries

Purpose: To respond to your message and manage communications with you.
Data used: Name, email address, enquiry type, message content.
Lawful basis (Art. 6): Legitimate Interests — it is in our and your mutual interest to communicate effectively.
Special category (Art. 9): Where your message discloses information about your experience of childhood abuse, we treat that disclosure as Explicit Consent (Art. 9(2)(a)) to use it solely to respond to your enquiry.
Form storage: Enquiry submissions are retained in our contact form system for up to 180 days, then automatically and permanently deleted.
IP addresses: Not logged.

Submission requests and the editorial process

Purpose: To send your submission pack, manage the editorial review of your piece, and maintain records of consent and any future withdrawal request.
Data used: Name, email address, pseudonym, submitted content, signed Publication Consent Form, date of submission.
Lawful basis (Art. 6): Explicit Consent (Art. 6(1)(a)).
Special category (Art. 9): Explicit Consent (Art. 9(2)(a)) — given by your act of ticking the consent checkbox on the submission request form.
Form storage: The submission pack request form does not store submissions in our website CMS. Details provided are used only to send the pack by email; no CMS record is created.
IP addresses: Not logged.

Anonymous website analytics

Purpose: To understand how the site is used and to improve it for our readers.
Data used: No personal data. Koko Analytics records only anonymous, aggregate statistics (pages visited, visitor counts, referral source, approximate country of origin, device/browser type) on our own UK-based server. No data leaves our server and no cookies are used.
Lawful basis (Art. 6): Legitimate Interests — understanding how the site is used is in our legitimate interest and does not affect your rights, since no personal data is processed.
Special category (Art. 9): Not applicable.

Donation processing

Purpose: To facilitate secure online donations.
Data used: Transaction amount, date, and (where provided) name and email address. Payment and fraud-prevention data is processed directly by Stripe, Inc. under Stripe’s privacy policy — we do not receive or store card details.
Lawful basis (Art. 6): Legitimate Interests / Performance of contract.
Special category (Art. 9): Not applicable.
IP addresses: Not logged by us at point of donation.

Safeguarding

Purpose: To protect children and vulnerable adults where a safeguarding concern arises.
Data used: Any information relevant to the concern.
Lawful basis (Art. 6): Legal obligation (Art. 6(1)(c)) and/or Vital interests (Art. 6(1)(d)).
Special category (Art. 9): Art. 9(2)(b) (obligations in the field of social protection); Art. 9(2)(c) (vital interests); Art. 9(2)(f) (legal claims).

6. Who we share your information with

We do not sell your personal information. We share it only as described below.

  • Service providers (“processors”) acting on our written instructions, including: Krystal for website hosting; Krystal for email; WordPress and GenerateBlocks Pro for the website platform and contact forms; Koko Analytics for anonymous website statistics (no personal data shared); Stripe, Inc. (via Paymattic) for donation processing. Each processor is bound by a written data processing agreement.
  • Police, local authorities, social services or the NSPCC where there is a safeguarding concern about a child or a vulnerable adult, or where we are otherwise required or permitted by law to share information.
  • Our professional advisers (lawyers, accountants, insurers) where necessary and on a confidential basis.
  • Any successor organisation if survivechildabuse.com or Survive Child Abuse is restructured (for example by incorporation into a CIC or charity).
  • Third parties where we are required to do so by law, by court order, or by a regulator.

7. International transfers and visitors from outside the UK

Our website and primary infrastructure are based in the United Kingdom (hosted by Krystal). Stripe, Inc. is a US-based company. Where Stripe transfers data outside the UK, it does so using transfer mechanisms approved under Article 46 UK GDPR. A full list of Stripe’s data transfer mechanisms is available on stripe.com/privacy. A list of any other processors and their locations is available on request.

survivechildabuse.com is operated from the United Kingdom and your use of this website is governed by this Privacy Policy and UK law. However, if you are visiting from another country, you may have additional rights under the laws of your own jurisdiction. We use Complianz to manage cookie consent in a way that reflects the legal requirements of your location — for example, visitors from California are presented with choices reflecting their rights under the CCPA/CPRA, and visitors from Canada are offered opt-in consent in line with PIPEDA. Because our analytics tool (Koko Analytics) collects no personal data and we use no marketing or tracking cookies, the practical impact on visitors from most jurisdictions is minimal. If you wish to exercise any rights under your local law that are not addressed in this policy, please contact us and we will do our best to assist.

8. How long we keep your information

We keep personal information only for as long as necessary for the purposes set out in this policy, after which we delete or anonymise it.

Contact form enquiries

Enquiry form submissions are retained within our contact form system for up to 180 days from the date of submission, after which they are automatically and permanently deleted. We do not manually extend this period. Where a message contains special category data, we aim to resolve the matter well within that window.

Submission pack request form

The submission pack request form does not store submissions in our website CMS. Name and email address are processed solely to send the submissions pack by email and are not retained in our website database. Any subsequent editorial correspondence — including your submitted piece and signed Publication Consent Form — is held by email in accordance with the contributor retention policy below.

Contributor submissions — 12-month retention and consent renewal

Contributor details and associated content are retained for 12 months from the date of initial publication. Approaching the 11th month, we proactively contact the contributing survivor to:

  1. Invite any updates they wish to make to their published piece; and
  2. Request renewed explicit consent for the piece to remain online for a further 12 months.

Any amendment to a published piece restarts the 12-month retention and review cycle, evidenced by an updated “Last Updated” date on the piece. If we are unable to contact a contributor to renew their consent, the piece will be removed from public view within 30 days of the 12-month anniversary of its publication. Contributor records are retained for as long as the piece remains published, plus 12 months after final removal, to manage any late withdrawal requests or data rights enquiries.

Donation records

Retained for seven years from the date of the donation, in line with HMRC financial record requirements.

Website analytics

Koko Analytics stores only anonymous, aggregate data. No personal data is retained.

Krystal server logs

Standard server security logs are retained by Krystal in line with their own data retention policy. We do not access these logs in the ordinary course of operating the site.

Email delivery logs

We use Fluent SMTP to handle outgoing email from our website forms. Email delivery logging is disabled — we do not retain logs of email content, sender or recipient metadata, or any information (including special category declarations) transmitted through our contact or submission forms. In the event of a delivery issue we rely on our email provider’s own error notifications rather than retained message logs.

9. Your rights

Under UK GDPR you have the following rights in relation to your personal information. To exercise any of them, contact us. We will respond within one month of receipt; in complex cases we may extend this by up to two further months.

Right to be informedThrough this policy and other notices we publish.
Right of accessA copy of the personal information we hold about you (free of charge in most cases).
Right to rectificationTo have inaccurate or incomplete information corrected.
Right to erasureThe “right to be forgotten” — to have your information deleted in certain circumstances.
Right to restrict processingTo ask us to pause our use of your information in certain circumstances.
Right to data portabilityFor information you have provided to us under consent or contract.
Right to objectTo processing based on legitimate interests, and to direct marketing at any time.
Automated decision-makingWe do not use your data for automated decisions that have a legal or similarly significant effect.
Right to withdraw consentAt any time, where we rely on your consent.

We may need to verify your identity before responding to a rights request, particularly where the request involves special category data.

10. Security

We use appropriate technical and organisational measures to protect personal information, including encrypted connections (HTTPS), access controls, multi-factor authentication for all administrator and editor accounts, regular backups on Krystal’s UK-based infrastructure, and a VPN requirement for editorial team members when handling submissions. No system is completely secure; if a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the risk is high, notify affected individuals.

11. Children

survivechildabuse.com is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently received such information, please contact us and we will delete it.

12. Cookies, safety features and social links

We measure anonymous website usage using Koko Analytics, a privacy-first analytics tool that does not use cookies, collects no personal data, and stores all data securely on our own UK-based server. Our full use of cookies and similar technologies is described in our Cookies Policy.

Every page of survivechildabuse.com also carries a “Your Safe Exit” button which redirects your browser quickly if you need to leave the site. The button uses a small browser-side technical flag and does not transmit any personal data to us. Fuller guidance on online safety is on our Safety Information page.

The website also contains a “Follow us on Bluesky” link in the footer, and a “share this” button on selected pages (Sparks, Hints & Tips and “What I’ve Learnt” pieces, plus general informational pages). These are link-only features. We do not embed tracking scripts from any social platform on our pages, and no personal data is sent to those platforms unless you actively choose to follow the link or use a share button. Each social platform you follow or share to has its own privacy policy, which we encourage you to read.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, our services or our practices. The current version is shown by the “Last reviewed” date below. We will notify users of material changes by a prominent notice on survivechildabuse.com for a reasonable period after the change takes effect.

14. Complaints and contact

If you have a question, concern or complaint about how we handle your personal information, please contact us first. We will do our best to resolve the matter quickly.

You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection:

  • Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
  • Helpline: 0303 123 1113. Online: ico.org.uk.

Last Updated: 2nd October, 2026

© Survive Child Abuse
Written by survivors for survivors.