Ednova LTD Privacy Policy

Welcome to Ednova. We are committed to protecting the privacy and personal data of parents, guardians, students, schools, and visitors who interact with our website and programmes. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

​

1. Who We Are

​Ednova Ltd is a company registered in England and Wales under company number 16174424. Our registered address is 13 Orchardmede, London, N21 2DL.

​

Ednova Ltd is registered with the Information Commissioner's Office as a data controller under registration number ZC143766.

Ednova provides STEM and biology-focused educational workshops, career awareness programmes, and enrichment activities for secondary school students.

​

If you have any questions about this Privacy Policy or how your information is handled, please contact us at info@ednova.co.uk or by writing to us at the address above.​

​

​

2. Information We Collect

​We may collect personal information from parents or legal guardians, students, schools, website visitors, and programme participants.

​

Parent and Guardian Information

• Full name

• Email address

• Telephone number

• Billing and payment information (processed via a third-party payment provider — see Clause 8)

• Emergency contact information

​

Student Information

• Student name

• School year group

• School name

• Programme participation and attendance records

• Feedback and survey responses

• Accessibility or additional support requirements (provided voluntarily)

​

Sensitive Information

Where necessary and voluntarily provided, we may collect limited sensitive information relating to medical conditions, allergies, accessibility needs, or safeguarding concerns. We only collect such information where reasonably necessary for programme participation, safeguarding, accessibility, or student welfare purposes.​

​

​

3. How We Use Personal Information

​We may collect information through website registration and programme booking forms, online surveys and feedback forms, email communication, event and programme participation, online video conferencing platforms, and website cookies and analytics tools (see Clause 12).​

​

​

4.  How We Use Personal Information​

Programme Administration

Managing bookings, processing payments, confirming participation, communicating programme information, and organising sessions and activities.

​

Student Welfare and Safeguarding

Supporting student safety and wellbeing, responding to safeguarding concerns, and making reasonable adjustments where needed.

​

Educational and Impact Assessment

Evaluating programme effectiveness, understanding student engagement and career awareness outcomes, and improving educational content and delivery. Pre- and post-programme questionnaires are used to measure the impact of each programme on students' knowledge and career awareness. To protect student privacy while enabling matched pre/post analysis, questionnaire responses are linked to students via a unique student ID number rather than by name. A separate secure record mapping each ID to the relevant student is maintained by Ednova and is not shared with third parties. Questionnaire responses are collected in aggregated or pseudonymised form and are not used to identify individual students in any published materials. Students are reminded not to include other people's names or identifying information in any open-text responses.

​

Communication

Responding to enquiries, sending programme updates, and providing customer support.

​

Marketing

Where explicit permission has been given, we may send information about future programmes, workshops, or opportunities. You may opt out of marketing communications at any time by contacting info@ednova.co.uk or using the unsubscribe link in any marketing email.​

​

​

5. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases for processing personal data:

​

• Contractual necessity — to deliver booked programmes and fulfil our obligations to parents and students.

• Legitimate interests — for programme administration, quality improvement, and educational impact assessment. We have assessed that these interests are not overridden by the rights and interests of participants, given the educational context and the limited nature of the data processed.

• Legal obligations — to comply with safeguarding duties, financial record-keeping requirements, and other applicable legal obligations.

• Consent — for marketing communications and for any promotional use of identifiable student media (photographs, quotes, or recordings).

• Vital interests — where safeguarding or immediate welfare concerns arise relating to a child's safety.​

​​

​

6.  Children's Data

Ednova provides services for school-aged students, but all bookings must be made by a parent or legal guardian aged 18 or over. By making a booking, the parent or guardian provides consent on behalf of their child for the data processing activities described in this Privacy Policy.

​

Where students are under 13, we rely entirely on parental consent for all data processing relating to that student. Since bookings are made exclusively by parents or guardians, parental consent is obtained at the point of booking for all students regardless of age.

​

We take additional care when handling children's information and collect only the minimum information necessary for educational delivery, safeguarding, and operational purposes.

​​​​

​

7. Sharing Personal Information

We do not sell personal information. We do not share personal information with third parties for their own marketing purposes.

We may share information with the following trusted third parties where necessary for operational purposes:

​

• Our payment processing provider, who processes payment card information securely on our behalf. Details of the payment provider in use will be made available at the point of payment.

• Our video conferencing platform — used to deliver online sessions. Details of the platform in use will be communicated to participants ahead of each session.

• Email communication providers — used to send booking confirmations, programme information, and other communications.

• Website hosting and analytics providers — used to operate and improve our website.

• Safeguarding authorities or law enforcement — where required by law or where necessary to protect the safety or welfare of a child.

 

All third-party providers are required to process data securely and in accordance with applicable data protection laws.​

​

​

8.  Payment Information

Payments are processed through a secure third-party payment provider. Ednova does not store full payment card details on its own systems. All payment card data is handled directly by our payment provider in accordance with Payment Card Industry Data Security Standards (PCI DSS).​

​

​

9.  International Data Transfers

Some of our third-party service providers, including our payment provider and video conferencing platform, may process data outside the United Kingdom. Where this occurs, Ednova ensures that appropriate safeguards are in place in accordance with UK GDPR requirements, including reliance on adequacy decisions or Standard Contractual Clauses where applicable.​

​

​

10.  Data Storage and Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, misuse, loss, disclosure, or alteration. Access to personal information is limited to individuals who require it for operational, safeguarding, or administrative purposes.

​

In the event of a data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and affected individuals as required by law.​

​

11.  Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected. The table below sets out our standard retention periods:

​​​​​