Privacy Policy

Last reviewed: July 2026

1. Who We Are

Hyett Education Ltd (Company Number: 11079223) is a UK-based STEM education company that delivers hands-on workshops to schools, corporate partners, and defence organisations. Our registered office is 5 Brook Close, Coven, Wolverhampton, WV9 5DS. Our trading and correspondence address is Unit 11, Four Ashes Enterprise Centre, Wolverhampton, WV10 7BY. We are registered with the Information Commissioner’s Office (ICO) under reference ZC099850. Contact details are available on our contact page.

For any questions about this privacy policy or how we handle your data, please contact our Data Controller at hyetteducation.com/contact.

2. What Data We Collect

We may collect and process the following personal data:

• Contact form & enquiry submissions: name, email address, phone number, school or organisation name, postcode, and message content when you enquire about our workshops.
• Booking information: school name, contact person details, year groups, student numbers, venue details, and any special requirements when you book a workshop.
• Invoice and payment data: school or organisation billing details and payment status required to process payments for workshop bookings.
• Newsletter subscription data: where you subscribe to our newsletter, we collect your email address and (optionally) your first name and role. This is stored with our email marketing platform.
• Postcode and derived location: when you submit a postcode through one of our forms, we send the postcode (only) to a public postcode lookup service to determine the postcode area and region so we can route your enquiry. No other personal data is shared with this service.
• Portal account data: where you create or use a customer portal account, we store login credentials and a record of the bookings linked to your school.
• Website usage and error data: analytics and interaction data collected after consent, including pseudonymous identifiers, approximate location, browser and device information, pages visited, and interactions with page content. Error events captured by our error monitoring service may incidentally include an IP address, browser metadata, and the URL where an error occurred. We do not deliberately log personal data to error monitoring.

3. How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries submitted through our contact form or by email.
• Fulfilling workshop bookings and delivering our services to your school.
• Sending invoices and processing payments for completed workshops.
• Communicating with you about upcoming workshops, availability, and new services where you have given consent or where we have a legitimate interest.
• Operating, delivering and securing our website.
• Improving our website and services through analytics and interaction data collected after consent.

Our legal bases for processing are: contract performance (fulfilling bookings), legitimate interest (responding to enquiries and operating, delivering and securing the website), and consent (marketing communications, non-essential cookies and consented analytics).

4. Children’s Data

Hyett Education takes the protection of children’s data extremely seriously. Pupils may submit feedback directly through our two student-feedback forms. We do not ask for their names or contact details.

• Photography: Where photographs are taken during workshops for marketing or impact reporting purposes, we obtain written photo consent from the school in advance. Schools are responsible for obtaining parental consent for photography in line with their own policies.
• School data agreements: Where workshops involve pupil feedback or impact surveys, the applicable agreement and privacy responsibilities must be confirmed with the school. Reporting outputs should be aggregated; raw responses can still be identifiable through school, workshop date, year group or free text and are treated as restricted child-adjacent data.
• Student feedback forms: The forms collect school, workshop date, year group, ratings and optional comments through JotForm. We tell pupils not to enter their name, email address or anything that identifies them or another pupil. JotForm may also receive technical request data such as IP address, browser information and form-view activity. Optional comments can be left blank.
• Safeguarding: Every Hyett Education instructor holds an enhanced DBS certificate and is registered on the DBS Update Service. We can provide DBS certificate details to schools on request before a booking. Our safeguarding policy is available on request.

5. Data Sharing

We do not sell or rent your personal data. We share limited data only for the purposes, with the recipients, and subject to the choices described below.

We may share limited data with the following parties where necessary:

• RAF and Defence Nuclear Enterprise (DNE): For workshops funded through RAF STEM or MoD DNE programmes, we share school name, date, and student numbers with the relevant funding body for verification and reporting purposes. No individual student data is shared.
• Email marketing platform (HubSpot): We use a third-party email marketing platform to store enquiry data (name, email, school, postcode, enquiry details) and newsletter subscriber data (email, first name, optional role). This provider acts as our data processor under a data processing agreement and does not use your data for its own purposes. The specific provider can be confirmed on request.
• Transactional email provider (Resend): A third-party transactional email service sends booking confirmations, magic-link sign-in emails, and other operational messages on our behalf. They process recipient email address and message content only.
• Cloud database and authentication (Supabase): Our customer portal database (booking records, school contact details, authentication) is hosted with a cloud database provider in the UK/EU region.
• Website hosting (processor): Vercel hosts this website and necessarily receives the requested URL (which may contain campaign parameters or advertising click identifiers), IP address, browser user-agent, referrer and other request metadata. Before you choose Advertising measurement, this information is used only to deliver and protect the page and to strip unsafe or unrecognised query fields; it is not stored by us as acquisition attribution or sent to advertising providers. Standard runtime logs may retain request metadata and URL search parameters for 1 day. Legal basis: our legitimate interests in delivering and securing the website.
• Content management platform (Sanity): Public-site content (workshop catalogue, blog posts, reviews, testimonials) is stored with a content management platform. Reviews and testimonials you submit to us are stored there.
• Accounting and invoicing software (Sage): Invoicing and accounting records, including school billing details and payment status, are processed in our accounting software.
• Error monitoring service (Sentry): A third-party error monitoring service captures error events from our website and portal to help us diagnose issues. It may incidentally capture IP address, browser metadata, and the URL where an error occurred. We do not deliberately log personal data to error monitoring.
• Independent review platform (Trustpilot): After a workshop is delivered, we may share the booker email address with an independent review platform to invite a review. That platform acts as a separate data controller for reviews you choose to submit there; its privacy policy applies to that activity.
• Form-hosting provider (JotForm): Certain pre-workshop logistics and partner-programme forms are hosted with a third-party form provider and forwarded to us. They act as a data processor on our behalf.
• Postcode lookup service (postcodes.io): When you submit a postcode through one of our forms, we send the postcode (only) to a public postcode lookup service to determine the area and region. No other personal data is shared.
• Customer relationship management (HubSpot): We use HubSpot CRM to hold contact and enquiry details so we can respond to you and manage the enquiry. We do not send UTM campaign parameters or advertising click identifiers to HubSpot.
• International processing: Vercel, HubSpot, Google and Meta may process the limited data described above outside the UK. Vercel’s Data Processing Addendum incorporates the UK International Data Transfer Addendum and Standard Contractual Clauses. HubSpot’s Data Processing Agreement incorporates the UK Addendum to the EU Standard Contractual Clauses. Meta’s Business Tools and Data Processing Terms incorporate Meta’s UK Data Transfer Addendum. Google Ads Controller terms use the UK Extension to the EU–US Data Privacy Framework where applicable and controller Standard Contractual Clauses otherwise. Contact us using the details in §10 if you would like more information about these mechanisms.
• Website analytics and session replay: Our analytics providers process usage and interaction data, which may include pseudonymous identifiers, approximate location derived from an IP address, browser and device information, pages visited, clicks, scrolling, mouse movements, and rendered page content subject to masking rules. If you select Website analytics, the Trustpilot review widget may also receive technical request data such as IP address, browser/device information and the page requesting the widget; a plain Trustpilot link remains available when the widget is not loaded. See §8 for the technologies used and how to manage them. Legal basis: consent.
• Advertising platforms (when enabled): The direct Google Ads browser tag and its events, and the separate scheduled verified-outcome source feeds, are disabled unless their own exact operational switches are enabled. The feeds also fail closed if their dedicated credentials or locally pinned conversion-action name strings are invalid. This validates local configuration only; it cannot prove that provider-side actions exist or that Data Manager mappings are correct. When enabled after you select Advertising measurement, Google Ads may receive only one relevant advertising click identifier, the verified Qualified enquiry or Booked workshop outcome and its time, an opaque 64-character Order ID, and consent flags as described in §8; we do not send contact details or hashed email addresses, phone numbers or IP addresses in these feeds. Where Meta is separately enabled and you select Social media tracking, Meta may receive website actions, a SHA-256 hashed email address, IP address, browser user-agent, and Meta browser-cookie identifiers for advertising attribution. Legal basis: consent.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy. Contact form submissions are retained for up to 2 years. Booking and invoicing records are retained for 6 years in line with HMRC requirements. You may ask us to erase data, but the right to erasure is not absolute. We may retain information where the law requires this or where it is necessary to establish, exercise, or defend legal claims.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data where there is no compelling reason for its continued processing.
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a structured, commonly used format.
• Right to object: You can object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where we rely on your consent to process data (such as non-essential cookies or marketing), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, use our Data Rights Request form or contact us at hyetteducation.com/contact. We will respond to your request within one calendar month.

8. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR. All non-essential categories are off unless you select them through our cookie banner. You can change or withdraw your choices at any time using the Cookie Settings link in the footer.

We use the following cookies and tracking technologies:

• Website analytics: We use Google Analytics to understand how visitors use our site. Cookies set include _ga (expires after 2 years) and _ga_* (expires after 2 years) to distinguish unique users and sessions. Data collected includes pages visited, session duration, traffic sources, and general location (country/city level). IP addresses are anonymised. This category also controls A/B testing and the Trustpilot review widget. When loaded, the widget makes a third-party request to Trustpilot that may include IP address, browser/device information and the requesting page; without consent we show a plain link instead. Legal basis: consent.
• Session replay & heatmaps: After you consent, we use Microsoft Clarity to create heatmaps and session recordings. Clarity may collect pseudonymous identifiers, approximate location derived from an IP address, browser and device information, page views, clicks, scrolling, mouse movements, and rendered page content subject to masking rules. Pseudonymisation and masking do not make all remaining data anonymous. Clarity cookies may include the first-party cookies _clck and _clsk and the third-party cookies CLID, ANONCHK, MR, MUID, and SM. Microsoft states that recordings are normally available for up to 30 days, while favourite recordings and a sample may be retained for up to 9 months. Microsoft may process data through Azure and affiliated operations outside the UK using contractual transfer safeguards. Clarity is not loaded on our portal or other sensitive routes. Legal basis: consent.
• Google tag: We load Google’s gtag.js directly only after the relevant category is selected. It configures Google Analytics and, only when its separate operational switch is enabled, Google Ads browser conversion measurement. We do not use a Google Tag Manager container.
• Advertising conversion tracking (when enabled): Where the direct Google Ads browser tag is active, its browser requests and events may include a conversion event, IP address, browser and device information, referrer or current-page context, and Google, click or cookie identifiers where applicable after you select Advertising measurement. We do not provide contact details or hashed email addresses for this measurement. Automatic page-view reporting, enhanced conversions, ad personalisation signals and advertising-user-data signals are disabled or denied. Any server-side conversion measurement is limited as described below. Legal basis: consent.
• Acquisition attribution after consent: The requested URL sent to our host may contain campaign parameters (utm_source, utm_medium, utm_campaign, utm_term and utm_content) and advertising click-identifier parameters (gclid, gbraid or wbraid), and is necessarily received and handled as described in §5. Before your choice, it is used only to deliver, protect and sanitise the page and is not stored as acquisition attribution or sent to advertising providers. Only after you choose Advertising measurement does the browser inspect the current URL once, on the first eligible page view after that choice, and store valid campaign parameters and at most one click identifier. We store these with a cryptographically random, opaque 256-bit rights-handling token in your browser so we can connect a later enquiry to those captured campaign details; they may not represent your original landing visit. An enquiry also carries consent record version 2 and the browser-recorded consent-choice time. The server validates that asserted consent time, while the database creation time is recorded by the server. Browser attribution becomes unusable 90 days after capture. Submitted attribution becomes purge-eligible exactly 90 days after server storage and is removed by the next successful daily cleanup after any in-flight work releases its locks; we do not promise a fixed 24-hour maximum. HubSpot receives enquiry details but no UTM parameters or advertising click identifiers. Separate scheduled Google Ads sources remain off unless their exact switches and dedicated credentials are valid. The application validates only its local pinned action-name strings; it cannot verify that provider-side actions exist or that Data Manager mapping is correct. Once each source is enabled for validation, the provider preview must confirm that every connection preserves its source URL’s exact outcome_type query selector, uses the correct source and mapping, and returns only its pinned action. Provider diagnostics must then confirm import acceptance before either action is treated as operational or made primary. The conversion source is enabled only when the independently controlled correction source is also enabled. A conversion response row contains the exact local action name, a 64-character opaque Order ID, outcome time, exactly one current supported export click (GCLID or GBRAID), and consent values that grant advertising-user-data use for this measurement while denying ad personalisation. WBRAID-only and UTM-only attribution can remain in the consented attribution foundation, but it never creates a record in this separate verified-outcome ledger or appears in the feed. Rows contain no name, contact details, hashed email address, phone number or IP address. The verified Qualified enquiry outcome requires an explicit admin decision; the Booked workshop outcome is first recorded automatically when booking confirmation (Stage 1) is completed. Active rows may be prepared again for later daily feed response attempts so interrupted imports can retry. First and latest preparation times and an aggregate attempt count are retained, with only one first-prepared event rather than one event per daily retry. Inclusion in a feed response attempt does not prove that the HTTP response body reached Google or that Google accepted or applied the row. Only active outcomes that still have current supported click attribution and have not reached their own retention deadline can be prepared. Withdrawing Advertising measurement consent invalidates linked outcomes before deleting attribution; cancellation or provisional expiry invalidates the booked outcome; hard deletion invalidates both. An outcome invalidated before any conversion response attempt is marked internally as invalidated before feed and may be explicitly re-verified as a fresh generation. Once any conversion response attempt has been prepared, no later generation is allowed. An invalidation within Google’s 54-day adjustment window queues one stable RETRACT row, which may be prepared again in daily correction response attempts; the aggregate correction attempt metadata again does not prove transport or acceptance. If invalidation first occurs after that window, the outcome is marked internally as correction unavailable and no adjustment row is produced. A pending correction that ages beyond the window becomes retraction window closed, acceptance unconfirmed on a later successful feed or cleanup run; it is never described as accepted. Click attribution keeps the 90-day retention described above. Non-click outcome, state-event and correction audit records become purge-eligible exactly two years from outcome time, including after a booking link is detached, and are removed by a later successful daily cleanup once conflicting locks are released. Legal basis for attribution and Google Ads export: consent. Legal basis for the limited non-click outcome and correction audit: our legitimate interests in accurate and accountable campaign measurement, subject to a documented legitimate interests assessment. Where records document consent withdrawal or another data-rights action, the legal basis is our legal obligation to honour data rights. For an admin-assisted attribution withdrawal we retain a separate minimal pseudonymous audit that becomes purge-eligible exactly two years from the rights action and is removed by a later successful cleanup once unlocked: booking, data-rights case and acting-admin UUIDs, a fixed erasure or objection reason code, deletion count and timestamps. It contains no subject token/hash, click value, contact detail or free text, and it does not mark the wider case complete. The tool confirms only that an open erasure or objection case email matches the booking or linked-user email; identity verification must be documented separately in the case before an admin acts. Using Cookie Settings switches measurement off locally and removes browser attribution immediately. If a usable rights token exists, the page awaits the bounded server request and reports when server deletion cannot yet be confirmed; a limited retry record containing only the random token and request/expiry times is retained until confirmation or its deadline. Retries occur on page load and when the browser comes online or the page becomes visible. If retry metadata is damaged but a valid token remains, the browser rebuilds it with a new request time and deadline; each recovery can begin a further period of up to 91 days so the deletion request is not lost. If the token is missing or expired, Cookie Settings cannot claim server-side deletion and directs previous enquirers to the data-rights form. Once the server successfully processes the request, it deletes matching submitted attribution, stores a minimal suppression record containing the SHA-256 token hash, the fixed rights-handling purpose, the browser-asserted request time (or trusted server receipt time if unusable), and server receipt and row-creation times, but no enquiry identifier or campaign data; it also prevents future export. The suppression deadline is exactly 90 days after a usable asserted request time, or server receipt where that assertion is unusable, and the record is removed by a later successful daily cleanup. Later retries cannot extend an intact immutable deadline. Legal basis for the time-limited retry, suppression and assisted-withdrawal audit: our legal obligation to honour your data rights.
• Social media advertising pixel (when active): If you select Social media tracking, Meta’s browser pixel records website actions you take (such as page views and form submissions) and may link them to your Meta account for advertising attribution. It sets cookies including _fbp (expires after 3 months). For form conversion events, our server may also send Meta the event, a SHA-256 hashed email address, IP address, and browser user-agent. Legal basis: consent.
• Cookie consent preferences: We store a versioned preference record in your browser’s local storage (he-cookie-consent) for Website analytics, Advertising measurement, Session replay and heatmaps, and Social media tracking. Each category is off unless you select it. This is strictly necessary browser storage, not a cookie, and does not require consent.

You can also control cookies through your browser settings. Disabling cookies will not affect the core functionality of our website. For more information about cookies, visit allaboutcookies.org.

9. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

10. Contact

If you have any questions about this privacy policy or wish to exercise your data rights, please contact us:

• Website: hyetteducation.com/contact

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.