Privacy Policy

Last Updated: June 2026

Welcome to Community Works Collective ("CWC," "we," "us," or "our"). We care about your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the rights you have over your data. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and Qatar's Personal Data Privacy Protection Law (PDPPL).

1. Who We Are

Community Works Collective is a community design and digital credentialing consultancy based in Chapel Hill, North Carolina, USA. We are the data controller for personal data we collect for our own purposes. When we operate programs or issue credentials on behalf of a client organization, that client is the data controller and we act as their data processor.

Questions or requests: privacy@communityworkscollective.com
Mail: Community Works Collective, Privacy Officer, PO Box 17299, Chapel Hill, NC 27516, United States

2. What Data We Collect

We collect only what we need to deliver our services:

  • Credentialing (Recworks): Your name and email address, and a record of the credential you earned. We do not collect passwords, government identifiers, payment details, or behavioral tracking data through the credentialing flow.

  • Community platforms: Profile and participation information you provide within a community we help operate (typically held within the community platform itself, such as Circle).

  • Consulting engagements: Business contact information and materials shared with us in the course of an engagement.

  • Website: If you contact us through our website, the information you choose to send us. Our website uses only strictly necessary cookies for basic functionality. We do not use Google Analytics or other tracking tools on this website.

  • Events and newsletters: Name and email address when you register or subscribe. You may unsubscribe at any time.

3. Why We Collect It (Lawful Basis)

  • Contractual necessity: To deliver a service you or your organization has requested — for example, issuing and delivering a digital badge you earned.

  • Legitimate interest: To operate, secure, and improve our services, and to maintain verifiable records of credentials issued.

  • Consent: Where required — for example, newsletters and marketing communications — collected and withdrawable at any time.

  • Legal obligation: Where we must retain or disclose data to comply with applicable law.

4. Who We Share It With

We do not sell your personal data. We share it only with the service providers (sub-processors) needed to operate our services, each bound by data protection terms:

  • Vercel Inc. — application hosting, content delivery, and file storage (USA). Security: vercel.com/security. DPA: vercel.com/legal/dpa.

  • Supabase Inc. — database hosting (us-west-2, Oregon, USA). Privacy: supabase.com/privacy.

  • Twilio Inc. / SendGrid — transactional email delivery of credentials (USA). Privacy: twilio.com/en-us/legal/privacy.

  • Circle Internet Inc. — community platform hosting; receives participant email address for programme completion tag verification where a Circle integration is active. SOC 2 Type 2 certified. DPA: circle.so/dpa.

  • Auth0 / Okta — identity and authentication management for administrative access. Privacy: auth0.com/privacy.

We may also share information with client organizations when managing a programme on their behalf, with other participants as appropriate within communities you join, and when required by law.

5. International Transfers

Community Works Collective is based in the United States. All personal data processed by Recworks is stored and processed within the United States (Vercel iad1, US East; Supabase us-west-2, Oregon). Our sub-processors maintain GDPR-compliant data processing agreements and, where applicable, Standard Contractual Clauses for international transfers.

6. Your Rights

Depending on your location, you may have the right to:

  • Access — request a copy of the personal data we hold about you

  • Correction — request that inaccurate data be corrected

  • Deletion — request that your data be deleted

  • Portability — receive your data in a machine-readable format

  • Object — object to processing based on legitimate interest

  • Withdraw consent — where consent is the lawful basis, withdraw it at any time

To exercise any of these rights, contact privacy@communityworkscollective.com. We will respond within 30 days.

7. Data Retention

We retain personal data for as long as necessary to deliver our services. Credential records are retained indefinitely as permanent records of achievement. You may request deletion at any time and we will action it within 30 days. Marketing and newsletter data is retained until you unsubscribe or request deletion.

8. Complaints

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your national data protection authority, or the equivalent authority in your jurisdiction (including, where applicable, the relevant authority under Qatar's PDPPL).

9. Children's Privacy

Our services are not intended for children under 16. We do not knowingly collect personal data from children. If we become aware that such data has been collected, we will delete it promptly.

10. Updates to This Policy

We may update this policy from time to time. Material changes will be communicated by email to individuals whose data we hold and by posting the updated policy on this page. The date at the top of this page reflects the most recent update.

11. Contact Us

privacy@communityworkscollective.com
Community Works Collective, Privacy Officer, PO Box 17299, Chapel Hill, NC 27516, United States