Privacy Policy

This policy explains how XXXXX Programmes Ltd ("XXXXX", "we", "us") collects, uses, stores, and protects personal data submitted through this website. It applies to anyone who contacts us via our online enquiry form.

Last updated: May 2026.

1. What data we collect

When you submit an enquiry we collect:

• Your name
• Your email address (if provided)
• Your WhatsApp number (if provided)
• Your IP address at the time of submission
• Your consent choices and the timestamp at which consent was given

We do not collect any sensitive personal data (as defined under UK GDPR / GDPR Article 9).

2. Why we collect it — lawful basis

We process your data for the following purposes:

• Responding to your enquiry — lawful basis: consent (Article 6(1)(a)). You provide explicit consent when you tick the required consent checkbox before submitting the form.
• Sending occasional updates and insights — lawful basis: consent. This is optional and only applies if you tick the separate marketing checkbox.
• Maintaining a consent audit trail — lawful basis: legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)), to demonstrate compliance with data protection law.

3. How long we keep it

We retain your contact details and consent record for two years from the date of your last interaction with us. If you ask us to delete your data sooner, we will do so within 30 days (see Your Rights below), except where we are required to retain records for legal compliance.

4. Who we share it with

Your data is never sold or rented to third parties. We share it only as follows:

• Within XXXXX Programmes Ltd — for the purpose of responding to your enquiry.
• Supabase Inc. — our database infrastructure provider, acting as a data processor under a Data Processing Agreement. Supabase stores data in accordance with GDPR.
• Our email provider (SMTP) — solely to deliver the internal notification email triggered by your submission. No personal data is stored by the email provider beyond standard message delivery logs.

We do not share your data with any marketing platforms, analytics services, or other third parties.

5. Where your data is stored

Enquiry data is stored in a Supabase database. Supabase offers data residency options; our database is configured to store data within the EU (West Europe) region. By submitting an enquiry you acknowledge this transfer. Appropriate safeguards are in place in accordance with UK GDPR Chapter V.

6. Your rights

Under UK GDPR (and GDPR where applicable) you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten"), subject to any legal retention obligations.
• Restriction — ask us to limit how we use your data while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — withdraw any consent you have given at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully.

7. Cookies and tracking

This website does not use tracking cookies or third-party analytics. No cookies are set by this site beyond those strictly necessary for page functionality.

8. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. We encourage you to review it periodically.

9. Contact

For any privacy-related queries, requests, or complaints: