Privacy Policy

1 Who we are

This website is operated by the VCSE Data and Insights National Observatory at Nottingham Business School, Nottingham Trent University (NTU).

The data controller for personal data processed through this website is:

NTU’s wider privacy notices are published at ntu.ac.uk/privacy. This page explains how the Observatory website itself uses personal data.

2 What this notice covers

This Privacy Policy explains how we collect, use, store, and share personal data when you:

• Visit vcseobservatory.org.uk or related Observatory pages (including the Individualised Insight Report portal and campaign pages)
• Contact us by email or through information published on this site
• Sign in to staff or partner tools (for example the CMS or IIR portal)
• Opt in to hear about future research waves or related Observatory activity
• Use cookies or similar technologies on this site

Separate participant information sheets or consent materials may apply to specific research studies (for example a Barometer survey hosted on a third-party platform). Where those materials differ, they take precedence for that study.

3 Personal data we collect

Depending on how you use the site, we may process:

3.1 Information you give us

• Contact details — name, email address, organisation name, phone number (if you include it)
• Enquiry content — messages you send to Observatory or NTU email addresses listed on this site
• Account identifiers — work email addresses used to request a one-time passcode for the CMS or IIR portal
• Wave opt-in details — email address, organisation name, income band, and region, if you ask to be contacted about a future survey wave
• Partner campaign details — organisation name, logo, and related materials uploaded when setting up a communications kit

3.2 Information collected automatically

• Technical and usage data — IP address, browser type, device type, pages visited, and approximate location derived from IP, via server logs and (if you consent) Google Analytics
• Session data — a session identifier needed to keep you signed in and to protect forms against cross-site request forgery
• Cookie preference — your Accept all / Essential only choice, stored in your browser’s localStorage

3.3 Information we do not collect via this website

We do not intentionally collect special category data (such as health, ethnicity, or political opinions) through the public website. Guest preview answers in the IIR tool are held only in the server-side session and are discarded when the session ends — they are not written to our database.

4 How we collect your data

• Directly from you, when you email us, sign in, opt in to a mailing list, or upload materials
• Automatically, through cookies, localStorage, and server logs when you browse the site
• From Google Analytics, only if you click Accept all on the cookie banner

We do not buy marketing lists or scrape personal data from third parties for this website.

5 Purposes and legal bases

Under UK GDPR we must have a lawful basis for each use of personal data. We rely on the following:

NTU is a public authority. Where we process data to deliver the Observatory’s research and knowledge-exchange role, we may also rely on public task (Art. 6(1)(e)). Analytics and optional mailing lists always require consent, which you can withdraw at any time.

6 Cookies and similar technologies

We use cookies in line with the UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR). A fuller standalone version of this section is on our Cookie Policy.

6.1 What cookies are

Cookies are small text files placed on your device when you visit a website. They are not programs and cannot read other files on your device.

6.2 Strictly necessary cookies

These are required for the site to work. They cannot be switched off. We rely on legitimate interests and the PECR technical-necessity exemption, so consent is not required.

6.3 Analytics cookies

These help us understand which pages are visited and how people move around the site. They are set only if you click Accept all.

Google’s privacy policy: policies.google.com/privacy.

6.4 Preference storage (not a cookie)

Your cookie choice is stored in the browser under vcse_cookie_consent in localStorage. It is not sent to our servers and lasts until you clear site data or reset the preference below.

6.5 Third-party content

6.6 Manage or withdraw cookie consent

You can change your mind at any time. Resetting the preference below clears localStorage and shows the banner again on your next visit. You can also block cookies in your browser (this will break login and session features if you block essential cookies).

Reset my cookie preference

Withdrawing analytics consent does not delete data already collected. To ask us to delete previously collected analytics data, email VCSEObservatory@ntu.ac.uk.

Browser guides: Chrome · Firefox · Safari · Edge

7 Who we share data with

We do not sell personal data. We share it only where needed to run the Observatory or where the law requires it:

• NTU staff and systems — colleagues who need the data to respond to you or operate the site
• IT and hosting providers — organisations that host this website and email under contract with NTU, acting as processors
• Google LLC — Analytics data if you have accepted analytics cookies
• Professional advisers or regulators — for example the ICO, or legal advisers, where we must disclose information
• Research partners — only aggregated or anonymised findings unless a specific study’s consent materials say otherwise

Processors are bound by written contracts requiring them to process data only on our instructions and to keep it secure.

8 International transfers

Most Observatory data is stored and processed in the United Kingdom. Some third-party services (notably Google Analytics and Google Fonts) may process data outside the UK or EEA.

Where a transfer outside the UK occurs, we rely on an adequacy regulation or appropriate safeguards such as the UK International Data Transfer Addendum / Standard Contractual Clauses. Google’s documentation describes its use of these safeguards. For more detail, contact NTU’s Data Protection Officer.

9 How long we keep data

• Enquiry emails — kept for as long as needed to handle your request and for a reasonable follow-up period, then deleted or archived in line with NTU records policy
• Wave opt-in records — until you ask us to remove them, or the relevant research wave has closed and follow-up is complete
• Login / OTP records — short-lived; one-time codes expire and unused codes are not retained indefinitely
• Session cookies — cleared when you close the browser (sessionid) or after their stated lifetime (csrftoken)
• Analytics cookies — up to 2 years, or sooner if you withdraw consent and clear cookies
• Server logs — retained only as long as needed for security and troubleshooting

When data is no longer needed we delete it or irreversibly anonymise it.

10 Your rights under UK GDPR

You have the following rights in relation to personal data we hold about you. Some rights are qualified (for example where we must keep data for a legal obligation).

To exercise any of these rights, email VCSEObservatory@ntu.ac.uk or NTU’s Data Protection Officer at DPO@ntu.ac.uk. We will respond within one month, or explain if we need more time.

11 How we protect your data

We take appropriate technical and organisational measures to protect personal data, including:

• HTTPS encryption in transit
• Access controls so only authorised NTU staff and processors can reach identifiable data
• CSRF protection and session management on authenticated pages
• Short-lived one-time passcodes rather than long-lived passwords for some staff tools

No website can be guaranteed 100% secure. If you think your data may have been compromised, contact us immediately.

12 Children’s data

This website is aimed at adults working in or with the VCSE sector, policymakers, and researchers. We do not knowingly collect personal data from children under 13. If you believe a child has provided data to us, please contact us and we will delete it.

13 Automated decision-making

We do not use your personal data for solely automated decision-making or profiling that produces legal or similarly significant effects.

14 Changes to this policy

We may update this Privacy Policy to reflect changes to the site, our research activity, third-party services, or the law. The “Last updated” date at the top will always show the latest revision.

If we make a significant change (for example a new category of cookie or a new use of personal data), we will highlight it on the site and, where consent is required, ask for fresh consent.

15 Contact us and the ICO

Questions about this policy, cookies, or how the Observatory uses personal data:

NTU’s Data Protection Officer:

You also have the right to complain to the UK regulator, the Information Commissioner’s Office:

We would appreciate the chance to address your concern first.