Privacy Notice (Privacy Policy)

At Nessie in Education CIC, we believe that protecting your personal information is part of creating a safe, trusted and supportive community.

We are committed to being open about how we collect, use, store and protect your information, and to treating your personal data with the same care and respect that underpins everything we do.

This Privacy Notice explains:

• what information we collect
• why we collect it
• how we use it
• who we may share it with
• how we keep it safe
• your rights under UK data protection law.

When you use the Nessie Community Programme, we may collect and use your personal information as described in this Privacy Notice and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation.

This Privacy Notice should be read alongside our:

• Community Terms & Conditions
• Community Code of Conduct
• Cookie Policy
• Safeguarding Policy
• Complaints Policy
• Data Retention Policy

The Nessie Community Programme is operated by Nessie in Education CIC.

Nessie in Education CIC is the Data Controller responsible for the personal information collected through the Community Programme.

Company Registration Number

11719406 (England & Wales)

Registered Office

King James Academy Royston (Senior Site), Garden Walk, Royston, Hertfordshire, SG8 7JH

Email

hello@nessieined.com

Nessie in Education CIC is registered with the Information Commissioner's Office (ICO) and is committed to handling personal information fairly, lawfully and transparently.

If you have any questions about this Privacy Notice or how we handle your personal information, please contact us using the details above.

The information we collect depends on how you interact with the Nessie Community Programme. This may include:

Personal Information — we may collect:

• your name
• email address
• telephone number (where provided)
• postal address (where required)
• membership details
• training and event bookings
• payment information (payments are processed securely by our third-party payment providers).

Learning and Membership Information — to provide your membership and learning experience, we may collect information such as:

• courses completed
• certificates issued
• CPD records
• webinars or workshops attended
• downloads and resources accessed
• community participation
• trainer pathway progress
• event attendance
• feedback questionnaires
• survey responses.

This information helps us deliver the Community Programme, improve our services and recognise your learning achievements.

Website Information — when you visit our website or member portal, we may automatically collect technical information including:

• IP address
• browser type
• device type
• operating system
• pages visited
• dates and times of visits
• cookies
• analytics information.

This information helps us understand how people use our website and improve the experience for everyone.

The Nessie Community Programme is designed primarily for parents, carers, professionals and other adult members.

As part of discussions, training or support, members may sometimes choose to share information about the children or young people they support. This may include information relating to:

• emotional wellbeing
• mental health
• neurodivergence
• education
• family circumstances
• additional needs
• school attendance
• safeguarding concerns.

Some of this information may be considered special category personal data under UK data protection legislation.

We only collect, use or retain this information where it is necessary, appropriate and lawful to do so, and we apply additional safeguards to help protect it.

Where possible, we encourage members to avoid sharing information that unnecessarily identifies a child or young person.

One of the strengths of the Nessie Community Programme is the opportunity for members to connect, learn from one another and share experiences.

Participation in community discussions is always voluntary.

Members are responsible for deciding what information they choose to share.

To help protect everyone's privacy, we ask members to:

• avoid posting unnecessary identifying information about children, young people or other individuals
• respect the privacy of other members
• keep community discussions confidential where appropriate
• follow our Community Code of Conduct.

Community discussions may be moderated by authorised members of the Nessie team to help maintain a safe, respectful and supportive environment.

We use your information to:

• provide access to your Community membership
• deliver online learning, webinars and events
• manage your training bookings
• issue certificates and CPD records
• communicate important programme information
• respond to enquiries
• provide customer support
• improve our resources and services
• understand how members use the Community
• monitor participation and programme impact
• manage memberships and subscriptions
• process payments
• meet our legal, regulatory and safeguarding responsibilities.

We only collect the information we need and only use it for appropriate and lawful purposes.

UK data protection law requires organisations to have a lawful basis for processing personal information. Depending on how you use the Nessie Community Programme, we may rely on one or more of the following lawful bases:

Contract

Providing your membership, delivering training, processing bookings and issuing certificates.

Legitimate Interests

Improving the Community, evaluating our services, responding to enquiries and administering the programme.

Consent

Sending newsletters, marketing emails or optional communications where you have chosen to receive them.

Legal Obligation

Meeting our legal responsibilities, including financial record keeping and responding to lawful requests.

Vital Interests

Sharing information where necessary to help protect someone's safety or wellbeing.

Where we rely on your consent, you can withdraw it at any time.

We'd love to keep you updated about new resources, training opportunities, events and developments within the Nessie Community.

If you choose to receive marketing communications, we may contact you with:

• newsletters
• community updates
• new courses and learning opportunities
• webinars and events
• downloadable resources
• surveys and opportunities to provide feedback
• information about new services or membership benefits.

Where we rely on your consent to send marketing communications, you can withdraw your consent at any time by:

• clicking the unsubscribe link in one of our emails
• updating your communication preferences (where available)
• contacting us directly at hello@nessieined.com

Choosing not to receive marketing emails will not affect important service communications relating to your membership, bookings or account.

We respect your privacy and never sell your personal information.

We only share personal information where it is necessary to deliver the Nessie Community Programme, meet our legal responsibilities or protect the safety and wellbeing of others.

Where appropriate, we may share information with trusted organisations that help us deliver our services, including:

• payment providers
• online learning platform providers
• webinar and video conferencing providers
• email communication providers
• website hosting providers
• website analytics providers
• certificate or CPD systems
• customer support systems
• professional advisers where required.

These organisations only process your information on our behalf or for their own legitimate purposes where appropriate. They are required to protect your information and only use it for the services they provide.

Some of the trusted organisations we work with may store or process information outside the United Kingdom.

Where this happens, we take appropriate steps to ensure your personal information continues to receive a high level of protection. This may include:

• UK International Data Transfer Agreements (IDTAs)
• International Data Transfer Addendums
• recognised adequacy regulations
• Standard Contractual Clauses or other safeguards permitted under UK data protection legislation.

We only work with organisations that have appropriate security and privacy measures in place.

Creating a safe and supportive community is at the heart of everything we do.

We respect the confidentiality of our members and will treat personal information with care and sensitivity.

However, there may be occasions where we need to share information if we believe that:

• a child or young person may be at risk of harm
• a vulnerable adult may be at risk
• there is a serious risk to someone's safety or wellbeing
• we are required to do so by law.

Where information sharing is necessary, we will only share information that is:

• relevant
• proportionate
• lawful
• necessary.

Where appropriate, we will explain why information needs to be shared unless doing so could increase the risk of harm.

Further information can be found in our Safeguarding Policy.

We take protecting your personal information seriously.

We use a combination of technical and organisational security measures designed to help keep your information secure. These measures include, where appropriate:

• password-protected systems
• secure cloud-based platforms
• encrypted connections
• restricted access to information
• regular software updates
• staff training
• appropriate internal policies and procedures.

Although no online system can ever be guaranteed to be completely secure, we continually review our systems and processes to reduce risks and maintain appropriate levels of security.

Access to personal information is limited to people who genuinely need it to carry out their role.

Depending on the service you are using, your information may be accessed by:

• authorised Nessie employees
• approved trainers and facilitators
• authorised administrators
• volunteers (where appropriate and supervised)
• safeguarding leads
• trusted service providers supporting the Community.

Everyone with access to personal information is expected to:

• respect confidentiality
• follow our data protection procedures
• complete appropriate training
• only access information they need for their role.

We regularly review who has access to personal information to help ensure it remains appropriate.

We only keep your personal information for as long as it is needed to provide the Nessie Community Programme, meet our legal responsibilities or support our members.

Different types of information are kept for different lengths of time, depending on why they were collected. Examples include:

Membership records

For the duration of your membership and for a reasonable period afterwards to manage your account, respond to queries and meet legal obligations.

Training records and CPD certificates

To enable us to verify attendance, reissue certificates where appropriate and maintain accurate learning records, in accordance with our Data Retention Policy.

Financial records

In line with UK legal and accounting requirements.

Marketing preferences

Until you withdraw your consent or ask us to stop contacting you.

Feedback and surveys

For as long as they remain useful for evaluating and improving our services. Where possible, information will be anonymised.

Safeguarding records

In accordance with our Safeguarding Policy and Data Retention Policy, and only for as long as necessary.

When information is no longer required, it will be securely deleted or anonymised.

Further information is available in our Data Retention Policy.

Under UK data protection legislation, you have a number of rights regarding your personal information. These include the right to:

• request a copy of the personal information we hold about you
• ask us to correct inaccurate or incomplete information
• request that we delete your personal information where appropriate
• ask us to restrict how we use your information in certain circumstances
• object to certain types of processing
• receive a copy of your information in a portable format where applicable
• withdraw your consent where processing is based on consent.

Not every right applies in every situation, but we will always consider your request carefully and respond in accordance with UK data protection legislation.

If you would like to exercise any of these rights, please contact us at hello@nessieined.com.

Our website and member portal use cookies and similar technologies to help provide a better experience for our members. Cookies may be used to:

• remember your preferences
• keep you signed into secure areas of the website
• understand how people use our website
• improve website performance
• help us develop and improve the Community.

You can manage or disable cookies through your browser settings at any time.

Further information can be found in our Cookie Policy.

The Nessie Community Programme has been designed primarily for adults, including parents, carers, professionals and organisations supporting children and young people.

Children do not normally create Community memberships or provide information directly to us.

However, members may choose to discuss the children or young people they support during:

• training sessions
• webinars
• online community discussions
• coaching or support activities
• feedback
• safeguarding processes.

Where information about children or young people is shared, we only collect, use and retain it where it is necessary, appropriate and lawful.

Wherever possible, we encourage members to avoid sharing information that unnecessarily identifies a child or young person.

Like many organisations, we use trusted digital systems to help us deliver our services safely and efficiently. These may include systems for:

• online learning
• webinars
• communication
• payments
• membership management
• surveys
• website hosting
• analytics
• customer support.

Where these systems process personal information, we ensure that appropriate contractual, organisational and technical safeguards are in place to protect your information.

We regularly review the systems we use to help ensure they remain suitable, secure and appropriate.

We do not use automated decision-making or profiling to make significant decisions about members.

Any important decisions relating to your membership, training or support will always involve appropriate human oversight.

As the Nessie Community Programme develops, we may occasionally update this Privacy Notice to reflect changes in our services, legal requirements or the way we process personal information.

When we make significant changes, we will let members know through appropriate channels, such as email or announcements within the Community.

The latest version of this Privacy Notice will always be available through the Nessie Community Programme.

The Effective Date shown at the beginning of this document indicates when this version came into effect.

If you have any questions about this Privacy Notice, how we use your personal information, or if you would like to exercise any of your data protection rights, please contact us.

Email

hello@nessieined.com

Registered Office

Nessie in Education CIC, King James Academy Royston (Senior Site), Garden Walk, Royston, Hertfordshire, SG8 7JH

Company Registration Number

11719406 (England & Wales)

Nessie in Education CIC is registered with the Information Commissioner's Office (ICO).

We will always aim to resolve any questions or concerns promptly and fairly.

If you are unhappy with how we have handled your personal information, we encourage you to contact us first so that we have the opportunity to understand your concerns and, wherever possible, resolve them.

If you remain dissatisfied, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent authority for data protection.

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone

0303 123 1113

Website

https://ico.org.uk

This Privacy Notice should be read alongside the following Nessie Community Programme policies and guidance:

• Community Terms & Conditions
• Community Code of Conduct
• Cookie Policy
• Safeguarding Policy
• Data Retention Policy
• Complaints Policy

Together, these documents explain how we provide a safe, supportive and trusted Community for parents, carers, professionals and organisations supporting children and young people.

At Nessie, we believe that trust is built through openness, respect and doing the right thing.

Thank you for being part of the Nessie Community. We are committed to protecting your personal information so that together we can continue creating a safe, welcoming and supportive place to learn, connect and grow.