Data minimization is not just a stated principle here — it is enforced structurally in the systems that hold this data:
- New data fields require a documented purpose before they are added to the operations platform, and any field capable of identifying vulnerable individuals (e.g., date of birth, health status) additionally requires a consent plan before collection begins.
- Internal case notes are kept internal by design — finance staff, who need beneficiary names and cohort assignments to attribute spend correctly, do not have access to contact details or case notes, because their job does not require it.
- In-kind gift values are tracked separately from cash totals so that an estimate never quietly inflates — or gets confused with — real, reconcilable donation figures; this is a data-integrity safeguard as much as a financial one.
- The public and donor-facing views the Academy builds are, by design, a narrow, aggregate, consent-filtered projection of the underlying data — never a raw export of what staff can see internally.