Privacy notice

1. About this notice

This Privacy Notice explains how My HeadStart Limited, trading as HeadStart ("HeadStart", "we", "us" or "our") collects, uses, stores and protects personal information when you visit our website, join HeadStart, use our digital services, communicate with us or otherwise interact with us.

My HeadStart Limited is the data controller for personal information processed for the purposes described in this notice. This means that we decide why and how that personal information is used.

HeadStart uses third-party technology and service providers to operate its services. In particular, Ningi Limited provides and operates core platform technology for HeadStart and, where it processes personal information on our instructions, acts as a data processor. Ningi may use approved sub-processors in providing those services.

2. Information we may collect

We may collect identification and contact information such as your name, email address and other contact details; account and profile information; university, education, career or life-stage information you choose to provide; subscription and transaction information; communications with HeadStart; course and content activity; preferences; technical, device and usage information; and information you voluntarily enter into interactive or AI-enabled features.

We may also process information connected with scholarship or community initiatives where you choose to participate. Where a separate scholarship organisation is established, any sharing of information with that organisation will be explained at the relevant time.

We do not need to receive your full payment-card details where payments are processed by an external payment provider. The payment provider may process those details under its own privacy arrangements.

3. How we collect information

We collect information directly from you when you register, subscribe, complete forms, use HeadStart features, communicate with us, participate in surveys or provide information to interactive tools. We may also collect information automatically through the website or platform, including through cookies and similar technologies, and receive information from service providers acting on our behalf.

4. How we use personal information

We use personal information to create and administer accounts; provide Student, Graduate and other HeadStart services; deliver educational content and interactive functionality; manage subscriptions and payments; communicate service information; provide customer support; operate community features; improve our content and services; understand engagement; maintain security; prevent misuse; administer scholarship-related initiatives; comply with legal obligations; and establish, exercise or defend legal rights.

Where HeadStart provides AI-enabled functionality, information submitted to those features may be processed to generate responses, personalise the experience, maintain safety and improve the operation of the HeadStart service. HeadStart's AI features are intended for education and information and are not a substitute for regulated financial advice or other professional advice.

5. Our lawful bases

Depending on the activity, we may process personal information because it is necessary to perform a contract with you or take steps at your request before entering a contract; because we have a legitimate interest in operating, securing and improving HeadStart; because we need to comply with a legal obligation; or because you have given consent.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

6. Marketing communications

We may send you service communications that are necessary to operate your account or membership. Where required, we will obtain consent before sending electronic marketing. You can change your marketing preferences or unsubscribe using the method provided in the communication.

7. Who we share information with

We may share personal information with suppliers that help us operate HeadStart, including platform hosting and development providers, payment providers, communications providers, analytics providers, customer-support providers and AI technology providers. They may act as processors on our instructions or, where appropriate, as separate controllers for their own activities.

Ningi Limited is a key technology provider. Its contractual data-processing arrangements require it to process protected data on HeadStart's documented instructions, implement appropriate security measures, assist with data-subject rights and data-protection matters, notify relevant personal-data breaches, control its sub-processors and return or delete protected data following termination.

We may also disclose information where required by law, regulation, court order or a competent authority, or where reasonably necessary to protect legal rights, prevent fraud or safeguard users.

8. International transfers

Some technology providers or their sub-processors may process information outside the United Kingdom. Where personal information is transferred internationally, we will require an appropriate lawful transfer mechanism and level of protection in accordance with applicable UK data-protection law.

9. Security

We use appropriate organisational and technical measures designed to protect personal information. Our technology providers are contractually required to implement appropriate safeguards. No internet or information-storage system can be guaranteed to be completely secure, and users should also take reasonable steps to protect their account credentials.

10. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the service, maintaining appropriate business and financial records, resolving disputes, meeting legal or regulatory requirements and protecting legal rights. Retention periods vary according to the type of information and the reason it is held.

11. Your rights

Subject to applicable law, you may have rights to request access to your personal information; correction of inaccurate information; deletion; restriction of processing; objection to certain processing; portability of information you provided to us; and withdrawal of consent where processing is based on consent.

To exercise a data-protection right, contact HeadStart by emailing hello@myheadstart.co.uk. We may need to verify your identity before acting on a request.

12. Complaints

If you have concerns about how we use personal information, please contact us first so that we can investigate. You also have the right to complain to the UK Information Commissioner's Office (ICO).

13. Children and younger users

HeadStart is designed primarily for university students, graduates and other young adults. If any service is made available to users under 18, we will apply appropriate age-related privacy and safeguarding measures to that service.

14. Changes to this notice

We may update this Privacy Notice as HeadStart develops or where legal, regulatory or technological changes require it. The current version will be published on the HeadStart website.

15. Contact

Data controller: My HeadStart Limited. Registered office: Elmfield House, New Yatt Road, Witney, West Oxfordshire, England, OX28 1PB. Company number: 17411314. ICO reference: C2013306. Email: hello@myheadstart.co.uk.

How this works on the site today

The notice above describes what HeadStart may do as the service develops. This section, maintained by HeadStart's platform provider and updated whenever the build changes, records what the live site actually does today.

The suppliers that currently process member data are:

• Supabase (UK, London region): the database and sign-in system holding your member record.
• Vercel: hosting for the website and the back office.
• Resend: sending the emails you receive from HeadStart.
• Ningi Limited: platform provider, acting as HeadStart's processor for building, running and supporting the service.

Retention today: your member record is kept while your membership is active and for up to 24 months after your last activity. Problem reports submitted through the report-a-problem button are kept for 24 months. Campaign arrival counts are aggregate tallies that hold no identifiers, so they are not personal data and are kept indefinitely.