Privacy Policy

1. Who we are

NSTN Ltd (“NSTN”, “we”, “us”) delivers Prevent-related training, interventions and the Prevent Quality Mark (PQM) to schools, local authorities and other organisations.

We are the data controller for the personal information described in this policy. That means we decide why and how it is used.

• Registered company name: NSTN Ltd
• Company number: 15903464
• Email: [email protected]
• Registered with the Information Commissioner's Office, registration number: ZB743458
• We are not registered for VAT

If you have any questions about this policy, or about how we handle your information, email us at [email protected].

2. What this policy covers

This policy explains what personal information we collect through nstn.co.uk, why we collect it, what we do with it, how long we keep it and what rights you have.

It does not cover the personal information we handle when delivering training, interventions or the Prevent Quality Mark under a contract with a school, local authority or other organisation. In that work the commissioning organisation is usually the controller and we act on their instructions. Separate arrangements apply and are set out in the contract with that organisation.

It also does not cover other websites we link to. We are not responsible for how those sites handle your information.

3. The information we collect

We only collect personal information from this website when you choose to send it to us through one of our forms. Everything in this section is information you give us yourself.

Enquiry forms

The enquiry form appears on the home page, the Interventions page and the Case Studies page (headed “Let's Talk”), the Training and Consultancy page (headed “Enquire About Training”) and the International Work page (headed “Discuss International Collaboration”). It collects:

• Your name
• Your email address
• The message you write

The “Talk to Us” form appears on the contact page. It collects:

• Your name
• Your email address
• Your organisation
• Your role
• The message you write

Associate trainer application form

The “Become an NSTN Associate Trainer” form appears on the Join NSTN page. It collects:

• Your name
• Your email address
• Your area of expertise
• The message you write
• Your CV, uploaded as a file of up to 10MB

Your CV is likely to contain more information about you than the form fields alone, for example your employment history, your qualifications and any other details you choose to include. Please send only what is relevant to an application to join our associate trainer network, and please do not include information about other people.

What happens to a form when you send it

The form is handled by our own website. There is no third-party form service involved, and your details are not passed through anybody else's system on the way to us.

When you send a form, two things happen. The details are saved in a submissions record held on our website, so that nothing is lost if an email goes astray, and they are emailed to us at [email protected]. A CV you attach reaches us the same way. Both copies contain only what you sent, plus the date and time you sent it.

What we do not collect

We do not record or store your IP address. There is no analytics on this website, no tracking, no tag manager, no advertising, no embedded video, no map and no chat widget. We do not build a profile of you, and we do not follow you across other websites.

Information we do not ask for

We do not ask for special category information, which includes information about health, religion, ethnicity, political opinions, trade union membership, sex life or sexual orientation, or biometric or genetic data. Please do not include information of that kind in a message or in a CV.

We do not ask for information about children or young people through this website. If you need to raise a safeguarding concern, please contact your own organisation's designated safeguarding lead and, where appropriate, your local authority. Do not use our website forms for that purpose.

4. Why we use your information, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is outweighed by the effect on you. If you disagree with that assessment you can object, and section 10 explains how.

We do not run a mailing list, and we will not use your details to market unrelated services. If that ever changes we will ask you separately and get your agreement first.

We do not make any decision about you by automated means alone, and we do not use your information for profiling.

5. Google reCAPTCHA

Our forms are protected by Google reCAPTCHA version 3, which helps us tell the difference between a person and an automated script. It is the invisible version, so there is no checkbox to tick and no puzzle to solve. It works by scoring how the page is being used.

reCAPTCHA only loads once you have accepted it through our cookie banner. Before that it does not run at all. Once you have accepted, it loads whenever a page carrying a form loads, not only when you send one, and it collects technical information about your device and your interaction with the page. Because your browser connects to Google directly, Google will also see your IP address as part of that connection.

Our own website does not store your IP address and does not send it to Google. When we check a form submission with Google, we send only the reCAPTCHA token and nothing else.

Google's use of the information it collects is governed by the Google Privacy Policy and the Google Terms of Service. Google acts as a controller in its own right for that information.

If you do not want reCAPTCHA to run, decline it in the cookie banner. Our forms will not work if you do, so please email us at [email protected] instead. That reaches the same inbox, and you can attach a CV to it in the same way.

6. Cookies

This website sets two cookies. One belongs to Google reCAPTCHA and is described in section 5. The other is ours, and all it does is record whether you accepted or declined, so that the banner does not have to ask again on every page. Nothing is stored on your device until you have chosen, and we use no analytics, advertising or tracking cookies.

Our Cookie Policy, which you will find on this website, sets out the detail, including how long each one lasts and how to change your mind.

7. Who else sees your information

We do not sell your information, and we do not share it for anyone else's marketing.

Your information is seen by our own staff, and by the associates we engage directly, where they need it to do their job. Enquiries and applications go only to NSTN email addresses. They are not forwarded to anybody's personal account.

Beyond that, your information reaches the following, and only so far as is necessary:

• Amazon Web Services. AWS hosts our website and the submissions record described in section 3.
• Google. We use Google Workspace for our email, so every enquiry and every CV the site sends us is held there. Google also provides reCAPTCHA, as described in section 5.
• Our professional advisers, for example our accountants or legal advisers, where they need the information to advise us.
• Anyone we are legally required to share information with, including a regulator, a court, or a public authority where the law requires it.

AWS and Google Workspace act under contracts that require them to keep your information secure and to use it only as we instruct. Google is a controller in its own right for reCAPTCHA, which is why that sits in a section of its own.

8. Where your information is stored

Our website, including the submissions record, is hosted on Amazon Web Services in its London region. Our email, including every enquiry and every CV the site sends us, is held in Google Workspace.

Both AWS and Google are global providers and process information in data centres outside the UK and the European Economic Area, including in the United States. Google reCAPTCHA, described in section 5, also sends information to Google.

Where information is transferred outside the UK, we rely on either an adequacy decision made by the UK government, or on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with any further safeguards the transfer needs. Both providers publish the terms they apply to these transfers as part of their data processing terms.

9. How long we keep your information

These periods apply to both copies, the email and the submissions record on the website. When something is deleted, it is deleted from both.

You can ask us to delete your CV sooner at any time, and we will do so unless we are required to keep it.

10. Your rights

Under UK data protection law you have the right to:

• Be told how your information is used, which is what this policy does
• Ask for a copy of the information we hold about you
• Ask us to correct information that is wrong or incomplete
• Ask us to delete information, where there is no good reason for us to keep it
• Ask us to restrict how we use it while a question about it is resolved
• Object to us using it where we rely on legitimate interests
• Ask us to transfer information you gave us to another organisation, where that right applies
• Withdraw consent at any time, where we rely on consent

Exercising any of these rights is free, and you do not have to give a reason. To make a request, email [email protected].

We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if that happens and why. We may ask you to confirm your identity before we act, so that we do not disclose your information to somebody else.

11. How to complain

If you are unhappy with how we have handled your information, please tell us first at [email protected] so that we can put it right.

You also have the right to complain to the Information Commissioner's Office at any time.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

12. Keeping your information secure

We take appropriate technical and organisational measures to protect your information against loss, misuse and unauthorised access.

All traffic between your browser and our website is encrypted using HTTPS. Multi-factor authentication is enforced on the Google Workspace accounts that hold our email. Access to the mailbox your enquiry or application arrives in, and to the submissions record on the website, is limited to vetted members of the NSTN team who need it to do their job.

Part of our approach is also what we choose not to collect. We do not store IP addresses, we run no analytics or tracking, and we use no error monitoring or session recording tools, so there is no pool of visitor data sitting on this website waiting to be lost.

No transmission over the internet is completely secure. If you need to send us something sensitive, contact us first and we will agree a safer route.

13. This website is not for children

This website is written for professionals and for organisations that commission our services. It is not intended for children, and we do not knowingly collect information about anyone under 18 through it. If you believe a child has sent us information through this site, email [email protected] and we will delete it.

14. Changes to this policy

We review this policy annually and whenever we change how we handle personal information. The date at the top shows when it was last updated. Where a change is significant we will say so on this page.