1. Introduction

This website belongs to Nesta - you can find our full details below. This privacy notice explains how Nesta uses personal information we collect via this site. We are committed to protecting your privacy and we take all reasonable precautions to safeguard personal information. This website contains links to other websites. We encourage you to read the privacy statements on the other websites you visit.

2. Contact details

Nesta is the data controller and is responsible for your personal data collected in connection with this project. This means that we will be responsible for keeping your information safe and only using it for the purposes set out in this notice.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights in relation to your personal data, please contact the DPO and provide enough information to identify yourself (e.g. your name and address):

Email: dpo@nesta.org.uk

Post: 58 Victoria Embankment London UK EC4Y 0DS

If you are unhappy about how we use your personal data or have a complaint, you have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please do contact us in the first instance.

3. What personal data we collect and why

We collect the following personal data directly from you for these specific purposes:

• Online activity: We collect information about your device and how you use our website (including location, browser type and pages visited). We use cookieless analytics to monitor website performance without identifying you personally.

• Cookies and tracking: We use cookies for the following specific purposes. You can always update your preferences and control your own data using our cookie preferences tool.

  • Functional: To enable embedded video content from Vimeo and YouTube to play directly on our site.

  • Strictly necessary: We generate a temporary Session ID to maintain user state during a website visit. 

4. What is our legal basis for collecting it

Data protection law requires us to have a specific legal basis for processing your personal data. For this project, our lawful basis will be:

• Consent: We rely on your clear, affirmative consent for the following

  • Functional cookies (Vimeo and YouTube): Enabling third-party cookies required to play embedded video content.

• Legitimate interests: We process your data when it is necessary for our legitimate business interests, provided these do not override your own rights and interests. This includes:

  • Email address: If you contact us to discuss opportunities to work together, we have a legitimate interest in processing your email address in order to respond to your request and retain records of our contact with you.

  • Website performance: Using cookieless analytics to understand how our site is used so we can improve the experience for users.

  • Website functionality: Using a Session ID ensures that the site delivers the functionality required to support a good user experience.

5. How long we keep your information for

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When it is no longer necessary to retain your personal data, it will be securely deleted.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

• Analytical data (cookieless): Since this data is non-identifiable, we may keep aggregate trends indefinitely, but raw server logs are typically deleted after 90 days.

• Functional cookies (Vimeo and YouTube): These are managed by Vimeo and YouTube; you can clear them at any time through your browser settings.

6. Who has access to your information

We limit access to your data to those who truly need it for the purposes of processing your personal data set out in this notice.

• Internal access: Your information is accessed by a limited number of Nesta staff specifically assigned to deliver the website. 

• Trusted third party data processors: We use specialised providers to help us run our website. We remain the ‘data controller’ responsible for your data, and we have contractual terms and policies and procedures in place with these processors to ensure that your personal data is protected. This does not always mean that they will have access to information that will directly identify you as we will share anonymised or pseudonymised data only wherever possible.

  • Infrastructure: we use Heroku (owned by Salesforce) to host our database and cookieless analytics.

  • Consent management: we use Civic Cookie Control to securely record and remember your privacy choices.

• Other third parties: We may disclose your information to other third parties including 

  • other companies in our group

  • regulators, law enforcement bodies and the courts, in order to comply with applicable laws and regulations, assist with regulatory enquiries, and cooperate with court mandated processes, including the conduct of litigation;

  • any third party to whom we are proposing to sell or transfer some or all of our business assets

We may also disclose your personal information if required by law, or to protect or defend ourselves or others against illegal or harmful activities, or as part of a reorganisation or restructuring of our organisations.

7. Security

We take reasonable steps to protect your personal information and follow procedures designed to minimise unauthorised access, alteration, loss or disclosure of your information.

In the event that whilst using our site(s) you become aware of any potential vulnerabilities, please let us know. Please see our vulnerability disclosure policy for guidance on how to report a vulnerability.

8. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including rights to:

• Request access to your personal data: this enables you to receive a copy of the personal data we hold about you and to check we are lawfully processing it.

• Request correction of your personal data: this enables you to have any incomplete or inaccurate data we hold about you corrected.

• Request erasure of your personal data: this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.

• Object to processing of your personal data: for example, you can object where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.

• Request restriction of processing your personal data: This enables you to ask us to suspend the processing of your personal data.

• Data portability: Where the processing takes place on the basis of your consent or contract, and is carried out by automated means, you have the right to request that we provide your personal data to you in a machine-readable format, or transmit it to a third party data controller, where technically feasible.

• Right to withdraw consent to the processing of your personal data: This applies where we have relied on consent to process personal data. Please note that withdrawal of consent will not affect the lawfulness of any processing carried out before withdrawing your consent.

If you wish to exercise any of the rights set out above, please send your specific request to the Data Protection Officer using the contact details provided at section 2

It is important to understand that the extent to which these rights apply to research will vary and that in some circumstances your rights may be restricted. Please also note that we can only comply with a request to exercise your rights during the period for which we hold personal information that identifies you. If personal data has been irreversibly anonymised and has become part of the research data set, it will not be possible for us to comply.

9. Changes to this notice

We may change this Privacy Notice from time to time. If we make any significant changes in the way we treat your personal information we will contact you directly.