NUDGE EDUCATION PRIVACY POLICY

Nudge Education Limited (we, us, our) of Office G39, Amber Court, William Armstrong Drive, Newcastle NE4 7YA, with registered company number 10192753, supports students in the United Kingdom to transition into permanent education, further training or employment. For the purposes of providing this support and our education services, we process the personal data of these students; their parents or guardians; and other individuals working or otherwise associated with Nudge Education. We are the data controller (i.e. the company who is responsible for, and controls the processing of, your personal data) of the personal data we process for the purposes of delivering our services.

The Data Protection Co-ordinator for Nudge Education Limited is; Brian Mair, Director of Operations 07958440937. This is the nominated person responsible for data security and data protection governance.

We are committed to protecting and respecting the privacy of all students, potential students, and all other data subjects. Our staff, associates and agents stringently follow the principles of the DPA and GDPR

This policy (together with any other documents referred to in it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

Please also use the Glossary to understand the meaning of some of the terms used in this privacy policy.

1. Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and if appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

2. Information we may collect from you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you.

This Website

We collect minimal personal data via this website. We will only ask for an email address and phone number to be able to contact you to respond to any query you make. We may also collect technical or usage data such as your internet protocol (IP) address, your login data, time zone setting and location, and information about how you use our website.

We may also collect, use and share Aggregated Data such as statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity.

Technical and aggregated data is usually collected via automated technologies, and cookies.

Cookies

A cookie is a small text file which is placed onto your computer (or other electronic device) when you access our website, that track, save and store information about your interactions and usage of the website. This allows the website to provide users with a tailored experience. We use cookies to provide you with a great experience and to help our website run effectively. This website uses a cookie control system allowing the user on their first visit to the Site to allow or disallow the use of cookies on their computer and/or device.

We use Google Analytics, which uses cookies to track visitor usage. The software will not store, save or collect personal information. You can read Google’s privacy policy here for further information. We also use analytics functionality from our website provider, Square Space. This collects your IP address only.

Third-party cookies

We work with third-party suppliers who may also set cookies on our website, for example Twitter, Facebook and LinkedIn. These third-party suppliers are responsible for the cookies they set on our website. If you want further information please go to the website for the relevant third party.

How to turn off cookies

If you do not want to accept cookies, you can change your browser settings so that cookies are not accepted. If you do this, please be aware that you may lose some of the functionality of this website. For further information about cookies and how to disable them please go to: www.aboutcookies.org or www.allaboutcookies.org

Nudge Education Limited

The personal data we may collect from students, parents, guardians or associated individuals includes:

• Your personal details i.e. first name, last name, initials, marital status, title, date of birth and gender.
• Your contact details, such as home address, email address, place of work and telephone numbers.
• We will also keep records of our business transactions and relationship with you, which may include details about payments and details of products and services you have engaged from us.
• We on occasion carry out a limited marketing campaigns, and so keep a record of our communications with data subjects; and any preferences in receiving marketing from us and our third parties you may have indicated.
• We collect some Special Categories of Personal Data about students and on occasion their family members or other individuals where appropriate to be able to provide the correct level of support. For this reason, and our safeguarding obligations, we may also need to collect any information about criminal convictions and offences. Please see the Special Category Data below.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able fulfil our services. We will notify you if this is the case at the time.

3. How is your personal data collected?

Referrals and introductions are made to us about our students from local authorities, schools, education providers, youth services and other stakeholders. As such we may be provided with some of your personal data prior to our engagement with you or your participation in our programme.

You may give us your personal data by filling in forms or by corresponding with us by post, phone, and email or otherwise.

We may also receive personal data about you from third parties as referrals, or from publicly available sources such as LinkedIn if you are contractor or other service provider we are interested in working with.

Information about other people: If you give us information on behalf of a student or potential student, you confirm you are authorised to act on his/her behalf, for example as a parent, guardian or education, social care or health care professional engaging us in your professional capacity; or the individual has agreed that you can act on his/her behalf in regards to the disclosure and processing of their personal data.

Monitoring: We may monitor and record communications with you (such as telephone conversations and emails) for the purpose of quality assurance, training, fraud prevention and compliance.

4. Purposes for which we will use your personal data

We have set out below a description of all the ways we may use your personal data, and our legal basis for doing so. We have also identified what our legitimate interests are where appropriate.

We have also set out below our applicable retention periods of the personal data we process. By law we have to keep basic information about our financial transactions for six years, which may include some personal data. In other cases we keep personal data for as long as is necessary for the purposes we collected it, as set out below.

Purpose/Activity	Lawful basis for processing including basis of legitimate interest	Retention
Referrals from stakeholders regarding prospective students		Deleted after 28 days if the student is not subsequently engaged onto a programme, or retained as below if they do progress onto a programme with us.
To keep a record of students we are working with	Performance of a contract with you, to provide our services.	throughout the duration of the programme
To keep a record of students we have worked with in the past	We do this for our own legitimate interests, of keeping records of the services provided should follow up queries or claims from any of the relevant stakeholders be made following the close of a programme; and for training and development of our own education strategy and delivery purposes	for 6 years following the completion of a programme (unless we are obliged for a legal obligation to retain the data for longer)
To gather and record pertinent information on students and prospective students in order to provide our services	We need to gather this information to perform our contract with the student’s parent or guardian to deliver our services; or it is on the grounds of the commissioning party’s (e.g. the Local Authority, education provider) legitimate interest to engage our services in the best interests of the student. For some information we will also ask for the student and/ or their parent or guardian’s consent to hold and process that data.	for 6 years following the completion of a programme (unless we are obliged for a legal obligation to retain the data for longer)
To assess student needs; to develop the student’s programme including matching students with the most suitable education experts; and delivering the programme (our services)	we process personal data on the performance of our contract with the student’s	for 6 years following the completion of a programme (unless we are obliged for a legal obligation to retain the data for longer)
To communicate with students and stakeholders following the completion of a programme.	We process data for this reason on our legitimate interest to maintain our relationships and network with students and stakeholders, which is an integral part of the ongoing support we offer.	for 6 years following the completion of a programme (unless we are obliged for a legal obligation to retain the data for longer)





Business contacts and associated persons personal data

Purpose/Activity	Lawful basis for processing including basis of legitimate interest	Retention
To keep a record of contractors and associated persons we are working with;	Performance of a contract with you.	seven years from start of contract
To keep a record of and have worked with in the past.	We have a legitimate interest to retain contact details of former business partners should we wish to engage them in the future.	seven years from start of contract
To process and deliver our services, including managing our relationship and transactions with you/ your company.	Performance of a contract with you	seven years from start of contract
To make suggestions and recommendations, or to send you other case studies and success stories to you as a stakeholder or prospective service user about our services that may be of interest to you	This may be necessary for our legitimate interests (to develop our products/services and grow our business); or on the basis of your consent.	seven years from start of contract





Website visitors’ personal data

Purpose/Activity	Lawful basis for processing including basis of legitimate interest	Retention
To respond to any queries you make or submit	We will reply to your enquiry using the details you provide, as we have a legitimate interest to manage our relationship and engagement with customers and other website visitors.	Seven years, or until we receive request to remove from customer database.
Notifying you about changes to our terms or privacy policy	Necessary to comply with our legal obligations under data protection laws	Seven years, or until we receive request to remove from customer database.
Asking you to leave a review or take a survey	Necessary for our legitimate interests (to keep our records updated and to study how we engage with our target demographic and within our industry)	Seven years, or until we receive request to remove from customer database.
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	Necessary for our legitimate interests of running our business, provision of administration and IT services, network security, to prevent fraud	Seven years, or until we receive request to remove from customer database.
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you	Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)	Seven years, or until we receive request to remove from customer database.
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)	Seven years, or until we receive request to remove from customer database.

Information we receive from other sources: We may combine this information with information you give to us and information we collect about you. We may us this information and the combined information for the purposes set out above (depending on the types of information we receive).

5. Special Category Data

We process special category data of the majority of our students. To provide our education services, we will create a thorough pen portrait of every student following commission of the services. In that pen portrait we will ask for, and subsequently use and refer to, data pertaining to student’s (and or their family member(s)’ where relevant) health, education history, social care, criminal offences or associated records, such as anti-social behaviour history. We usually also collect data regarding religion and ethnicity, where this will need to be taken into account when ensuring the tailored programme we propose is suitable for that student.

We process special category and criminal data on the lawful basis set out in the Data Protection Act 2018, schedule 1(1)(3), of social protection interventions.

6. Disclosure of your personal data

We may share your information with selected third parties including:

• relevant stakeholders, by which is meant for example the person or organisation who has commissioned our services, the employee(s) or education expert(s) who are involved in a particular student’s programme; health, education, social, or youth services workers, local authorities, the police and rehabilitation officers, as applicable;
• business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you; and
• analytics and search engine providers that assist us in the improvement and optimisation of our website.

We may disclose your personal information to third parties:

• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
• if all, or substantially all, of our assets are acquired by a third party, in which case personal data held by us about our customers will be one of the transferred assets; and
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation; or to protect the rights, property, or safety of our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

7. International Transfers

We do not transfer your personal data outside the European Economic Area (EEA).

8. Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. However, the transmission of information via the internet is not completely secure. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9. Third Party Links

Our Site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

10. Your rights

You have the right to:

Request access to your personal data (commonly known as a "data subject access request").

Request correction of any inaccurate personal data that we hold about you. Please keep us informed if your personal data changes during your relationship with us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.

Request restriction of processing of your personal data if you want us to establish the data's accuracy; where our use of the data is unlawful but you do not want us to erase it; where you need us to hold the data to establish, exercise or defend legal claims; or you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Complain you have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

11. Glossary

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

12. Contact

Questions, comments and requests regarding this privacy policy are welcomed, please either contact us by:

• email: enquiries@nudgeeducation.co.uk
• or post: 2 Sirius House, Amethyst Road,Newcastle-Upon-Tyne, NE4 7YL