How we handle your information.

Version 2026-08-v12. Effective 7 August 2026.

Who is responsible for this project?

EntoFacet is a UK-led, unincorporated volunteer project. The project handles personal data so it can route requests, manage volunteers and specialist contacts, send introductions, respect opt-outs, and keep privacy records. We are a small pilot for adults aged 18 and over.

For data-protection purposes, the controller is Armando Rosario. You can contact the project about privacy, access, correction, deletion, or opt-out requests at admin at entofacet dot org.

EntoFacet is UK-led and is not currently established in the European Union. We follow UK GDPR standards. We may support international requests where suitable volunteers or experts are available. We do not claim to operate as an EU legal entity, EU branch, or EU representative.

If you request an introduction

You do not need an account. When you submit a request you receive a private link by email. That link is the only way to view your request, add a follow up, export your data, or ask us to delete it. Keep it private; anyone with the link can see that one request. You can ask us to re-send your link if you lose it.

What we collect, only what we need to handle your request:

• your name and email address;
• the area you are based in, and your stage or situation;
• the invertebrate groups and the kind of help you are interested in;
• the languages you would rather correspond in, if you tell us;
• anything you add in the free-text box;
• a record of your consent and the version of this notice you agreed to;
• the status history of your request as volunteers work on it;
• when your request page was last opened through your private link, so a volunteer can tell whether a reply has reached you. Just the time of the last visit: no location, no device details, and no tracking in the emails we send you.

Why, and our lawful basis. We use your details to understand your request, match you to a suitable contact, and follow up. Our lawful basis is your consent, given by ticking the boxes on the form. You can withdraw consent at any time using your private link or by emailing admin at entofacet dot org; withdrawing does not affect anything already done.

Making the introduction. When a volunteer connects you with a suitable expert, we send one email that introduces you both, from the Ommatidium Project, so you can reply to each other directly. That means the expert sees your name, your email and what you asked for. That is the whole point of the introduction you asked for, and we only ever share what is needed to make the connection.

How long we keep it. We keep your details while your request is open and for 12 months after it closes, after which they are deleted or anonymised automatically, unless you ask us to remove them sooner. A minimised record may be kept for accountability (for example that a deletion happened), without your personal details.

International introductions

EntoFacet is UK-led, but a suitable volunteer or expert may sometimes be based outside the UK. If we think an international contact is the right person for your request, we will share only what is needed to make the introduction.

Where the contact is outside the UK or EEA, we will either ask for your specific agreement before sharing your contact details, or give you a way to contact the expert yourself. You can give that agreement in advance with the optional box on the request form, or answer later through a link we email you; either way you can change your answer at any time, and we record when and how you answered.

If you volunteer with us

What we collect when you join the network:

• your name and email address;
• your role or affiliation and the region you are based in;
• the country you are based in (the safeguard for introductions outside the UK and EEA runs on it) and the languages you can help in;
• the groups you can advise on and the kinds of help you can offer;
• a short line about you, and whether you’re happy to be listed in the directory;
• a record of your agreement to the volunteer code of conduct.

Why, and our lawful basis. We use this to run the network: to route requests to the right person and to show you in the internal volunteer directory so other volunteers know who covers what. Our lawful basis is your consent, given when you sign up. You can withdraw it at any time by emailing admin at entofacet dot org.

Who sees it. Your directory entry is visible to other volunteers and admins in the network. It is not shown to the public or to requesters; an introduction only ever shares the details needed to make that connection, with consent.

How long we keep it. We keep your details while you are an active volunteer. If you step down, or ask us to remove you, we delete your entry and revoke your access promptly.

If you apply to join. When you fill in the sign-up form we hold your application (your name and email, the role you want, the groups and kinds of help you offer, your region, and anything you add) so an admin can review it and get in touch. We first email you a link to confirm your address. We do not act on an application until it is confirmed, and an unconfirmed application is deleted after 30 days, so nobody can sign you up with your address but without your knowledge. If you apply as an expert to be referred to, we also hold the contact methods you are happy with, an optional institution, and a monthly number you are comfortable with. Your institution and where you are based are shown in our internal referral directory only if you give the point of contact consent on the form. If we do not take an application forward, or it goes stale, we delete or anonymise it. We do not keep declined or pending applications indefinitely.

If you apply for an organisation. An application can be made on behalf of an organisation, such as a club, society, museum, or recording scheme. We then hold the organisation’s name, kind, website, and shared inbox address, with you as its named contact. The organisation facts are about the organisation, not you; your own name and role as the contact are personal data, are visible to project admins only, and are removed if the organisation asks to leave or you ask to be replaced as the contact. Applying on behalf of an organisation includes your certification that you are authorised to do so, and we may contact the organisation to confirm the application was authorised.

Availability and contact preferences. Once you are set up you can block off times you are away, using a private link we email you, and choose who you are happy to be contacted by. We store those periods and preferences so we do not route requests to you when you are unavailable or outside what you have agreed to. If you choose to connect a personal calendar (by pasting its secret iCal link), we fetch it periodically and store only the busy time periods it contains, never the event titles or details, and you can disconnect it at any time.

Your staff account, and our action log. To sign in you have an account with our authentication provider: your email, a password you set, and, if you turn it on, an optional second sign-in step for extra security (two-factor authentication). We also hold operational notes you or an admin add, such as your capacity and a short bio, and your answers to internal meeting invitations (whether you would come, the times you could make, and any note you add). To keep the service secure and accountable we log staff actions against your account (for example claiming or replying to a request, or an admin changing a role or capacity), and we record security details about staff sign-ins and portal use: the IP address, the approximate location (country and city, derived from the address), and the browser type. These security records exist so that a compromised account can be traced; only admins can read them, the portal records are deleted after 12 months, and the address and location details on action records are removed on the same schedule. Our lawful basis for this security and accountability logging is our legitimate interest, not consent. When you step down we revoke your access and remove your directory entry promptly, but a minimised record of administrative actions is kept for accountability, without the detail of what was discussed.

If you are an expert or volunteer contact

We may hold your name, email address, affiliation or role, broad location, areas of invertebrate expertise, contact preferences, availability limits, and short internal notes needed to route suitable requests. Some experts give us this information directly. Others may be suggested by an existing volunteer or identified from a professional, public source.

We use this information only to ask whether you are willing to receive relevant introductions, to avoid sending unsuitable requests, and to respect any limits you set. Our lawful basis is your consent where you have joined or confirmed your preferences, or our legitimate interest in making careful, relevant professional introductions where a volunteer has suggested you as an appropriate contact.

You can say no at any time. Email admin at entofacet dot org and we will remove you from the referral list or mark you as do not contact. We do not publish the expert list, sell it, or use it for advertising.

If you ask to be told when we launch

If you give us your email to hear when EntoFacet opens, we hold only your email address, the date you asked, and a record of your consent and the version of this notice. We confirm the address first, by sending you a link to click, so we only keep addresses whose owner has confirmed them.

Why, and our lawful basis. We use it to send you a single email, on the day we launch, and nothing else. Our lawful basis is your consent, given by ticking the box. Every launch email carries a one-click unsubscribe, and you can ask us to remove you at any time by emailing admin at entofacet dot org.

How long we keep it. We delete the launch list once the launch email has been sent, because its only purpose is then complete. We never sell or share these addresses.

If you sign up for an open meeting

Now and then the project announces an open video call on our meetings page. If you sign up we hold your email address, your name if you give it, the time zone you chose on the page (so our emails can repeat the meeting time in your own time zone), the date you signed up, and a record of your consent and the version of this notice.

Why, and our lawful basis. We use it only to email you about that one meeting: a confirmation when you sign up, the joining link before the call, and a short note if the meeting is cancelled. Nothing else. Our lawful basis is your consent, given by ticking the box on the signup form.

How long we keep it. The signup list for a meeting is deleted automatically within a month after the meeting takes place, because its only purpose is then complete. You can also ask us to remove you sooner at admin at entofacet dot org. We never sell or share these addresses, and signing up never subscribes you to anything else.

If you email us

If you write to our contact address, for example to ask about taking part as a volunteer or an expert, we use your message and your email address only to reply and to take that conversation forward. Our lawful basis is your consent in choosing to contact us. We keep the message only as long as we need it for that purpose, and you can ask us to delete it at any time. Your message is received by an ordinary email host acting on our instructions.

Who else can see it

• The volunteers and admins in our network who sort and handle requests.
• A suitable contact or mentor, only with the requester’s consent, and only the details needed to make the introduction.

We never sell your data and we never use it for advertising.

Records we keep to run the service

To keep the service accountable and secure we keep a minimal internal log of actions, for example that a request was created, assigned, replied to or anonymised, and a log of the automatic emails we send (confirmations, links and status updates). These hold identifiers and operational details, not the contents of your messages, and they are removed on the same retention schedule.

Volunteers and admins also exchange internal notes and coordination messages about a request, and some of these can be answered by email. We store them so the team has a shared record. They are internal, never shown to the public, and removed when the request is removed.

Impact reporting

We use operational records to produce private, aggregate impact summaries for contributors and project-wide reporting. These summaries help volunteers and experts describe their service, mentoring, outreach, and professional impact. Reports do not include requester names, email addresses, private messages, free-text request descriptions, individual request records, exact request dates, or raw location strings. Small categories may be withheld or grouped so that requesters cannot be identified from rare combinations of place, topic, date, or expertise. Downloadable summaries contain aggregate, privacy-protecting statistics only.

The services that process data for us

We use a small number of trusted providers, who act only on our instructions:

• Supabase, our database, staff login and any file storage, hosted in the London region so your data stays in the UK.
• Resend sends our emails: service emails (confirmations, links and status updates) and, if you asked to be told when we launch, a single launch announcement. We do not run newsletters or marketing campaigns.
• Cloudflare serves this website and securely processes the forms you submit.
• An email host receives any message you send to our contact address, like any ordinary mailbox provider.

Some of these companies are US-incorporated. Where data leaves the UK it is protected by the relevant data-processing agreements and standard contractual clauses (with the UK addendum). This is a low-sensitivity dataset with no special-category data.

Cookies

The public pages use no analytics, no marketing tools and no optional cookies. Staff who log in use strictly-necessary browser storage to keep them signed in. We do not use analytics, advertising, heatmaps or maps.

Your rights

Under UK data-protection law you can:

• see the data we hold about you, and export it (requesters: your link does this);
• ask us to correct it;
• ask us to delete it (requesters: your link does this);
• restrict or object to how we use it; and
• withdraw consent at any time.

Requesters can do most of this through the private request link. Volunteers, and anyone else, just email admin at entofacet dot org.

Concerns and complaints

If something has gone wrong, tell us at admin at entofacet dot org; we acknowledge concerns within 30 days and explain what we are doing about it. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).