LEGAL

Privacy Notice

[Last updated 2 September 2026]

1. About this notice

This privacy notice explains how Paul Hayman, trading as Northrey Executive Education (“Northrey”, “we”, “us” or “our”), collects, uses and protects personal information when you visit our website, contact us, register for a programme or otherwise interact with us.

For the purposes of UK data protection law, Paul Hayman, trading as Northrey Executive Education, is the data controller.

2. Information we collect

We may collect personal information that you provide directly to us, including your name, email address, telephone number, organisation, job-related information and the content of enquiries or other communications you send to us.

If you register for a programme, we may also collect information necessary to administer your registration, communicate with you about the programme and provide programme materials.

We may also collect limited technical information when you use our website, such as your IP address, browser type, device information and information about how you interact with the site. The information collected will depend on the cookies, analytics and other technologies in use on the website.

3. How we use your information

We may use your personal information to:
– respond to enquiries and communicate with you;
– administer programme registrations and participation;
– provide programme information, joining instructions and supporting materials;
– process and maintain records relating to purchases and payments;
– manage our relationship with individuals and organisations;
– operate, maintain and improve our website and services;
– comply with legal, regulatory, tax and accounting obligations;
– protect the security and integrity of our website and business; and
– send marketing communications where we have an appropriate lawful basis to do so.

4. Our lawful bases

We process personal information only where we have an appropriate lawful basis under applicable data protection law.

Depending on the circumstances, this may be because processing is necessary to perform a contract with you or take steps at your request before entering into a contract; because it is necessary for our legitimate interests or those of a third party; because we need to comply with a legal obligation; or because you have given consent.

Where we rely on legitimate interests, we consider whether those interests are proportionate and appropriately balanced against your rights and interests.

5. Payments

Payments for Northrey programmes are processed using Stripe. When you make a payment, Stripe processes payment and transaction information in accordance with its own privacy practices.

Northrey does not receive or store your full payment-card details when payment is handled directly by Stripe.

6. Service providers and sharing your information

We do not sell your personal information.

We use third-party services to operate our website and deliver our programmes. Depending on how you interact with Northrey, these may include:

Namecheap for website hosting, domain and email-related services;

Microsoft Teams for the delivery of live online programmes;

Stripe for payment processing;

Google Analytics for understanding how visitors use our website; and

CookieAdmin for managing website cookie preferences and consent.

These providers may process personal information on our behalf or, in some circumstances, act as independent controllers of information they receive.

We may also disclose information where required by law or where reasonably necessary to establish, exercise or defend legal rights.

Namecheap, for example, states that for its hosting service the website operator acts as controller and Namecheap as processor, and that hosting logs may collect visitors’ IP addresses.

7. International transfers

Some of our service providers operate internationally and may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with applicable data protection law and that appropriate safeguards are used where required.

8. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet any applicable legal, regulatory, tax, accounting or reporting requirements.

Retention periods vary depending on the type of information and why we hold it. We periodically review the information we retain and securely delete or anonymise information that is no longer required.

9. Marketing communications

Where permitted by law, we may send information about Northrey programmes, events or services that we think may be relevant to you.

You can opt out of marketing communications at any time by using an unsubscribe facility provided in the communication or by contacting us at enquiries@northreyexecutive.com

Communications necessary to administer or deliver a programme for which you have registered are service communications and are not treated as marketing.

10. Cookies and analytics

Our website uses cookies and similar technologies.

We use CookieAdmin to manage cookie preferences and consent and Google Analytics to help us understand how visitors use the website.

Where consent is required, non-essential cookies and similar technologies will not be used until you have provided the appropriate consent. You can subsequently change your preferences through the cookie controls available on the website.

This distinction is important: the ICO says website visitors need to be told about cookies and, where cookies are not strictly necessary, agreement is generally required before using them.

11. Your rights

Under UK data protection law, you may have rights in relation to your personal information, including rights to:

– request access to personal information we hold about you;
– ask us to correct inaccurate or incomplete information;
– ask us to delete your information in certain circumstances;
– ask us to restrict certain processing;
– object to certain processing;
– receive certain information in a portable format; and
– withdraw consent where processing is based on consent.

These rights are subject to conditions and exceptions under applicable law.

To exercise a data protection right, contact enquiries@northreyexecutive.com

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are concerned about how your personal information has been handled.

Information Commissioner’s Office

12. Security

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

13. Third-party websites

Our website may contain links to websites operated by third parties. We are not responsible for the privacy practices of those websites. You should review the privacy information provided by the relevant third party when using its services.

14. Changes to this notice

We may update this privacy notice from time to time to reflect changes to our services, technology, service providers or legal obligations.

The date shown at the top of this page indicates when this notice was last updated.

15. Contact

For questions about this privacy notice or the way Northrey handles personal information, contact:

Northrey Executive Education

Email: enquiries@northreyexecutive.com