Privacy Policy

The National Public Education Project CIC ( NPEP ) is the data controller responsible for the personal information you provide through this website and our registration system.

Registered company name: The National Public Education Project CIC

Company registration number: 16607921

Legal structure: Community Interest Company (CIC), private company limited by guarantee without share capital. Incorporated 25 July 2025.

Address: 4th Floor, 14 Museum Place, Cardiff, CF10 3BH, Wales.

NPEP is a Community Interest Company operating for community benefit. It is not a registered charity, government body, university or regulated financial institution.

NPEP has not appointed a Data Protection Officer, as it is not required to do so. Privacy enquiries can be directed to the contact details above. NPEP's ICO registration number will be added here once registration has been confirmed.

We only collect personal information that is necessary for the purposes described in this policy. Through the workshop interest-registration system and our website we may collect:

• Your name.
• Your email address.
• Your mobile telephone number.
• Your workshop subject interests and preferences.
• Your email and SMS communication preferences and consent records, including timestamps.
• Enquiry and communication history where you contact us.
• Website analytics and technical data, such as approximate location, device type, browser and pages visited.
• Relevant advertising and tracking data where permitted technologies are implemented.

We collect personal information through the following routes:

• The NPEP website.
• The separately integrated registration form provided by our CRM platform.
• Direct enquiries you send to us by email or telephone.
• Email and telephone communications with you.
• Interactions with our Facebook and Instagram advertising, where applicable.
• Cookies and similar tracking technologies, where implemented.

We distinguish between information you supply directly (for example, when you register an interest) and information obtained automatically through technical services (for example, analytics or advertising measurement).

We process personal information only where we have a valid lawful basis under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The main purposes and corresponding bases include:

Legitimate interests and contract

• Responding to your enquiries — legitimate interests.
• Recording your workshop subject preferences — legitimate interests.
• Processing your requests for information — legitimate interests or contract.
• Administering any confirmed workshop participation — contract.
• Protecting website security and preventing misuse — legitimate interests and legal obligations.
• Fulfilling our legal obligations — legal obligation.

Consent-based processing

• Sending permitted email workshop notifications — consent.
• Sending permitted SMS workshop notifications — consent.
• Measuring website performance using non-essential analytics — consent, where required.
• Advertising measurement and tracking technologies — consent, where required.

We do not assume that all of our processing is based on consent. Where processing relies on a lawful basis other than consent (such as legitimate interests or legal obligation), you do not need to consent for that activity to take place, though you may have other rights described below.

You may register to be notified about forthcoming NPEP live online workshops. Notifications may include workshop announcements, subjects, dates, availability and participation information when confirmed.

The separately configured registration form should offer distinct, optional, unticked choices for email and SMS marketing. Consent for one channel does not imply consent for the other.

Suggested email consent wording

Suggested SMS consent wording

• Each preference is recorded separately, with a timestamp and the version of this privacy notice presented at the time.
• Consent to both channels is never required as a condition of submitting an enquiry.
• You can withdraw consent at any time using the unsubscribe link in emails or the SMS opt-out instruction, or by contacting us.
• After withdrawal, your details are suppressed from the relevant marketing channel.

NPEP uses a third-party CRM platform to manage registration information and workshop communications. This platform acts as a data processor on NPEP's behalf.

Where relevant and verified, we address the following:

• Processor relationships and written data-processing agreements.
• Appropriate technical and organisational security measures.
• International transfers, where personal data is processed outside the UK, and the safeguards relied upon.
• Access controls limiting processing to authorised personnel.
• Sub-processors used by the provider, where applicable.
• Appropriate retention and deletion arrangements.

Where implemented, NPEP may use Meta advertising and measurement tools, which may include the Meta Pixel, Meta Conversions API, advertising measurement, campaign analytics and associated cookies or similar technologies.

Where such technologies are used, the legal basis will generally be consent, given the potential for advertising cookies to access a user's device. Any transfer of personal data to Meta must comply with applicable UK law and Meta's Business Tools Terms. We do not disclose sensitive financial information or prohibited personal information through tracking events.

We recognise the following categories of cookies and similar technologies:

• Strictly necessary technologies — required for the website to function; no consent required.
• Analytics technologies — help us understand how the website is used; consent required where not strictly necessary.
• Advertising technologies — support measurement and personalisation of advertising; consent required.
• Third-party technologies — set by external services such as advertising or analytics providers.

We retain personal information only for as long as necessary for the purposes described in this policy, or to comply with legal obligations. Specific retention periods will be added here once confirmed; we do not invent retention periods.

We protect personal information using appropriate technical and organisational measures, including access controls and secure processing by our providers. We do not claim security certifications that have not been verified.

Under UK GDPR you have the following rights, subject to certain conditions:

• The right of access to your personal data.
• The right to rectification of inaccurate data.
• The right to erasure (also known as the right to be forgotten).
• The right to restrict processing.
• The right to object to processing.
• The right to data portability.
• The right to withdraw consent at any time, where processing is based on consent.
• Protections relating to solely automated decision-making, including profiling.

To exercise any of these rights, please contact us using the details below. You also have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about how we handle your information.

The ICO can be contacted at https://ico.org.uk/.

This Privacy Policy was last updated on 2 November 2026. We may update it to reflect changes in legislation, our services or our data-processing practices. We will indicate the date of the most recent revision at the top of this page.