Last updated: 12 October 2026
This Privacy Policy outlines how Aspiring Heads CIC ("AH") collects, uses, shares, and protects your personal data. It is drafted in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and reflects our commitment to transparency, fairness, and the responsible handling of personal data.
This Policy supplements any other privacy statements we may provide at specific points of data collection, such as event registrations, newsletter sign-ups, surveys, or service engagements.
By using our website or engaging with AH services or events, your personal data will be handled in accordance with this Privacy Policy and any additional privacy information provided at the point of collection.
Aspiring Heads CIC is the data controller responsible for your personal data. This means we determine how your data is collected, processed, and used.
You may contact our Data Protection Officer, Ethan Bernard, at info@aspiringheads.com with any questions, requests, or complaints regarding your data.
We are registered with the Information Commissioner’s Office (ICO) under registration number ZB449539.
We may collect and process the following categories of personal data:
- Identity Data – including names, usernames, titles, date of birth, gender, and other identifiers.
- Contact Data – including email addresses, postal addresses, telephone numbers, job title, and organisation.
- Financial Data – including bank account and payment card details (for donation and payment processing purposes).
- Special Category Data – including information you choose to provide about race, ethnicity, health conditions, disability access needs, dietary requirements, gender identity, religion, or political opinions.
- Transaction Data – including records of payments and purchases related to our events, services, or fundraising activities.
- Technical Data – including IP address, browser type, operating system, location, and other data obtained through cookies or analytics tools.
- Usage Data – including how you interact with our website, emails, surveys, and event platforms.
- Profile Data – including interests, preferences, feedback, and communication history.
- Marketing & Communication Data – including your preferences about how and when you receive information from us.
We may also collect anonymised or aggregated data that does not identify you personally.
We collect personal data through:
- Direct interactions – when you contact us, complete forms, register for events, sign up to our newsletter, submit feedback, or participate in campaigns.
- Automated technologies – through website cookies, event platforms, or CRM systems that track how you engage with our services and content.
- Third-party sources – including partners, funders, social media channels, public directories, and data processors acting on our behalf (e.g., payment processors or event platforms like Zoho Backstage or Zoom).
We process your personal data for a number of lawful purposes. These include delivering our services and events, responding to enquiries, sending updates and newsletters, processing payments and donations, collecting feedback and survey responses, and improving the quality and accessibility of our website and services. We also use your data to monitor equalities and access, comply with legal and regulatory obligations, and to communicate with you regarding your preferences or previous engagements with AH.
Where applicable, the legal bases we rely on include: the necessity to perform a contract with you; our legitimate interests (e.g., improving services, responding to enquiries); your explicit consent (particularly in relation to marketing or special category data); and our legal obligations (such as financial record-keeping and safeguarding).
You may withdraw consent or object to processing at any time by contacting us.
We do not sell or rent personal data to third parties. However, we may share data with trusted processors or partners for specific purposes, such as:
- Event management – with platforms like Zoho Backstage or Zoom (acting as data processors);
- Email communication and analytics – with providers like Mailchimp or Google Analytics;
- Payment processing – with Stripe, PayPal, or similar platforms;
- Funders or auditors – when legally or contractually required;
- Legal authorities – where necessary for legal compliance, fraud prevention, or safeguarding.
All third-party providers are required to process data securely and in accordance with data protection laws.
Your data may be transferred outside the UK or EEA when:
- We use international service providers (e.g., email platforms or cloud storage);
- Event platforms or support staff operate overseas;
- You access our services while abroad.
We ensure such transfers comply with legal requirements using safeguards such as:
- Standard Contractual Clauses (SCCs);
- Transfers to countries with adequate protection levels;
- Provider commitments under frameworks like the UK Extension to the EU-U.S. Data Privacy Framework.
We use appropriate technical and organisational measures to protect your data. These include:
- Encryption and secure storage;
- Password protections and access restrictions;
- Staff training on data protection and safeguarding;
- Regular audits and risk assessments.
However, no internet-based system is completely secure. You transmit data to us at your own risk. If you receive access credentials (e.g. login passwords), you are responsible for keeping them confidential.
We keep personal data only as long as necessary:
- Financial and contractual records: 6+ years (legal requirement);
- Event and engagement records: up to 2 years after last interaction;
- Finalised event photography and recorded media: retained for as long as reasonably necessary for the educational, historical, communications or archival purposes for which it was lawfully collected or licensed, subject to periodic review and applicable individual rights;
- Marketing and preference data: until consent is withdrawn;
- Equalities monitoring data: anonymised after analysis.
We regularly review retention periods to ensure compliance.
Under the UK GDPR, you have the right to:
- Access – obtain a copy of your personal data;
- Rectification – correct inaccurate or incomplete data;
- Erasure – request deletion of your data (where lawful);
- Restriction – limit how we process your data;
- Objection – to processing based on legitimate interests or direct marketing;
- Portability – receive your data in a machine-readable format;
- Withdraw consent – at any time where processing is based on consent.
To exercise your rights, email info@aspiringheads.com. We aim to respond within one month.
Our website uses cookies and tracking pixels to:
- Understand user behaviour and analytics;
- Support secure access to services;
- Improve design and functionality.
Cookies do not usually identify you personally. You can block or delete cookies via your browser settings. Disabling cookies may affect website functionality.
Aspiring Heads may photograph, film or record online, hybrid and in-person events. Where recordings or images identify individuals, we will process that personal data in accordance with an appropriate lawful basis and provide relevant privacy information at or before the point of collection.
Depending on the context, event media may be used for event delivery, reporting, communications, education, promotion or archival purposes. Where Aspiring Heads relies on consent for a particular use, consent will be requested separately, will be optional, and may be withdrawn for future processing in accordance with applicable data-protection law.
Speakers, panellists and other contributors may receive additional media-permission or licensing information where their recorded contribution is intended for publication, educational use or inclusion within an Aspiring Heads digital archive.
Further information about photography or recording at a particular event may also be provided during registration, through event signage, contributor agreements or dedicated consent forms.
Our website and emails may contain links to external sites. We are not responsible for their privacy policies or content. Please review third-party policies before submitting data to them.
If you are concerned about how we use your data, please contact us first. We aim to resolve all concerns.
If unresolved, you may contact the Information Commissioner’s Office (ICO):
Website: https://www.ico.org.uk
Phone: 0303 123 1113
We may update this policy periodically to reflect changes in regulation, services, or data processing practices. The latest version will always be posted on our website.
We encourage you to review this policy regularly.
For questions or feedback, contact:
Email: info@aspiringheads.com
Post: Aspiring Heads CIC, 7 Bell Yard, London WC2A 2JR
