Privacy Policy

Last reviewed: May 2026

1. Who We Are

Hyett Education Ltd (Company Number: 11079223) is a UK-based STEM education company that delivers hands-on workshops to schools, corporate partners, and defence organisations. Our registered address is Unit 11, Four Ashes Enterprise Centre, Wolverhampton, South Staffs, WV10 7BY. We are registered with the Information Commissioner’s Office (ICO) under reference ZC099850. Contact details are available on our contact page.

For any questions about this privacy policy or how we handle your data, please contact our Data Controller at hyetteducation.com/contact.

2. What Data We Collect

We may collect and process the following personal data:

• Contact form & enquiry submissions: name, email address, phone number, school or organisation name, postcode, and message content when you enquire about our workshops.
• Booking information: school name, contact person details, year groups, student numbers, venue details, and any special requirements when you book a workshop.
• Invoice and payment data: school or organisation billing details and payment status required to process payments for workshop bookings.
• Newsletter subscription data: where you subscribe to our newsletter, we collect your email address and (optionally) your first name and role. This is stored with our email marketing platform.
• Postcode and derived location: when you submit a postcode through one of our forms, we send the postcode (only) to a public postcode lookup service to determine the postcode area and region so we can route your enquiry. No other personal data is shared with this service.
• Portal account data: where you create or use a customer portal account, we store login credentials and a record of the bookings linked to your school.
• Website usage and error data: anonymised analytics data collected through our website analytics tools, plus error events captured by our error monitoring service (which may incidentally include IP address, browser metadata, and the URL where an error occurred). We do not deliberately log personal data to error monitoring.

3. How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries submitted through our contact form or by email.
• Fulfilling workshop bookings and delivering our services to your school.
• Sending invoices and processing payments for completed workshops.
• Communicating with you about upcoming workshops, availability, and new services where you have given consent or where we have a legitimate interest.
• Improving our website and services through anonymised analytics data.

Our legal bases for processing are: contract performance (fulfilling bookings), legitimate interest (responding to enquiries, improving services), and consent (marketing communications and non-essential cookies).

4. Children’s Data

Hyett Education takes the protection of children’s data extremely seriously. We do not collect personal data directly from children.

• Photography: Where photographs are taken during workshops for marketing or impact reporting purposes, we obtain written photo consent from the school in advance. Schools are responsible for obtaining parental consent for photography in line with their own policies.
• School data agreements: Where workshops involve the use of student data (for example, pre- and post-session impact surveys), we enter into a data sharing agreement with the school. All student data is anonymised and aggregated for reporting purposes.
• Safeguarding: All Hyett Education staff hold enhanced DBS checks. Our safeguarding policy is available on request.

5. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We may share limited data with the following parties where necessary:

• RAF and Defence Nuclear Enterprise (DNE): For workshops funded through our RAF STEM or MoD DNE partnerships, we share school name, date, and student numbers with the relevant funding body for verification and reporting purposes. No individual student data is shared.
• Email marketing platform (processor): We use a third-party email marketing platform to store enquiry data (name, email, school, postcode, enquiry details) and newsletter subscriber data (email, first name, optional role). This provider acts as our data processor under a data processing agreement and does not use your data for its own purposes. The specific provider can be confirmed on request.
• Transactional email provider (processor): A third-party transactional email service sends booking confirmations, magic-link sign-in emails, and other operational messages on our behalf. They process recipient email address and message content only.
• Cloud database (processor): Our customer portal database (booking records, school contact details, authentication) is hosted with a cloud database provider in the UK/EU region.
• Content management platform (processor): Public-site content (workshop catalogue, blog posts, reviews, testimonials) is stored with a content management platform. Reviews and testimonials you submit to us are stored there.
• Accounting and invoicing software (processor): Invoicing and accounting records, including school billing details and payment status, are processed in our accounting software.
• Error monitoring service (processor): A third-party error monitoring service captures error events from our website and portal to help us diagnose issues. It may incidentally capture IP address, browser metadata, and the URL where an error occurred. We do not deliberately log personal data to error monitoring.
• Independent review platform (separate controller): After a workshop is delivered, we may share the booker email address with an independent review platform to invite a review. That platform acts as a separate data controller for reviews you choose to submit there; its privacy policy applies to that activity.
• Form-hosting provider (processor): Certain pre-workshop logistics and partner-programme forms are hosted with a third-party form provider and forwarded to us. They act as a data processor on our behalf.
• Postcode lookup service: When you submit a postcode through one of our forms, we send the postcode (only) to a public postcode lookup service to determine the area and region. No other personal data is shared.
• Website analytics: Anonymised website analytics: see §8 for the cookies set and how to manage them. Legal basis: consent.
• Advertising platforms (when enabled): Where advertising and conversion-tracking pixels are active on the site, hashed identifiers (such as a hashed email address from a form submission) may be sent to advertising platforms to attribute conversions to ad clicks, and website actions may be linked to your account on those platforms for advertising attribution. We only send this data when you have given consent through our cookie banner. Legal basis: consent. If these features are disabled, no such data is sent; the cookies set when enabled are listed in §8.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy. Contact form submissions are retained for up to 2 years. Booking and invoicing records are retained for 6 years in line with HMRC requirements. You may request earlier deletion at any time.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data where there is no compelling reason for its continued processing.
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a structured, commonly used format.
• Right to object: You can object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where we rely on your consent to process data (such as non-essential cookies or marketing), you can withdraw that consent at any time.

To exercise any of these rights, please contact us at hyetteducation.com/contact. We will respond to your request within one calendar month.

8. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR. Non-essential cookies are only set after you give consent through our cookie banner. You can change your preferences at any time by clearing your browser cookies and revisiting the site.

We use the following cookies and tracking technologies:

• Website analytics: We use third-party website analytics to understand how visitors use our site. Cookies set include _ga (expires after 2 years) and _ga_* (expires after 2 years) to distinguish unique users and sessions. Data collected includes pages visited, session duration, traffic sources, and general location (country/city level). IP addresses are anonymised. Legal basis: consent.
• Session replay & heatmaps: We use a third-party session-replay tool to record anonymised user sessions (mouse movements, clicks, scrolling) and generate heatmaps of page interaction. Cookies set include _clid (expires after 1 year), _clsk (expires after 1 day), and _clck (expires after 1 year). No personally identifiable information is captured. Session recordings help us identify usability issues. Legal basis: consent.
• Tag management: We use a tag management container to load the analytics and advertising scripts listed in this section. The container itself does not set cookies or collect personal data.
• Advertising conversion tracking (when enabled): Where advertising-platform conversion tracking is active on the site, we send hashed identifiers (such as a hashed email address from a form submission) to the advertising platform when you have given consent, so that conversions can be attributed to ad clicks. Legal basis: consent. You can withdraw consent at any time through the cookie banner. If this feature is disabled, no such data is sent.
• Social media advertising pixel (when active): Where a social-media advertising pixel is active on the site, it records website actions you take (such as page views and form submissions) and may link them to your account on that platform for advertising attribution. Sets cookies including _fbp (expires after 3 months). Only loads after you have given consent. Legal basis: consent.
• Cookie consent: We store your cookie preference locally in your browser (he-cookie-consent) to remember whether you have accepted or declined non-essential cookies. This is a strictly necessary cookie and does not require consent.

You can also control cookies through your browser settings. Disabling cookies will not affect the core functionality of our website. For more information about cookies, visit allaboutcookies.org.

9. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

10. Contact

If you have any questions about this privacy policy or wish to exercise your data rights, please contact us:

• Website: hyetteducation.com/contact

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.