Innovate Nonprofit

Legal

Privacy Policy

Last updated: 23 September 2026

1. Who we are

Innovate NP Ltd, trading as Innovate Nonprofit, is the controller responsible for the personal information described in this privacy policy.

Our details are:

  • Legal name:Innovate NP Ltd
  • Trading name:Innovate Nonprofit
  • Company number:14004484
  • Registered office:3 Acre End Street, Eynsham, Witney, England, OX29 4PE
  • ICO registration reference:ZB410351
  • Email:info@innovatenonprofit.com

This policy explains how we collect, use, store and protect personal information when you visit our website, contact us or work with us.

2. What this policy covers

This policy applies to personal information relating to:

  • visitors to innovatenonprofit.com;
  • people who contact us with an enquiry;
  • prospective clients;
  • clients and their representatives; and
  • other professional contacts.

It does not cover websites or services operated by other organisations that we may link to. Those organisations are responsible for their own privacy practices.

3. Information we collect

Information you provide to us

When you complete our contact form, email us or otherwise contact us, we may collect:

  • your first and last name;
  • your organisation;
  • your email address;
  • your telephone number, if supplied;
  • your area of interest;
  • the contents of your enquiry;
  • subsequent correspondence; and
  • any other information you choose to provide.

If you become a client, we may also process information needed to manage our working relationship, deliver services, maintain project records, issue invoices and meet our legal and accounting obligations.

Please do not include sensitive personal information in an enquiry unless it is genuinely necessary.

Information collected when you use the website

Our hosting and security provider may process limited technical information needed to deliver and protect the website. This can include:

  • IP address;
  • browser and device information;
  • requested pages;
  • dates and times of requests;
  • referral information; and
  • security and diagnostic information.

We use Cloudflare Web Analytics to understand how the website is used and how well it performs. It provides aggregated information such as page views, popular pages, referral sources, approximate country, device or browser type and website performance measurements.

Cloudflare Web Analytics does not use analytics cookies or browser storage and is not used by us to build profiles of individual visitors.

Information received from other sources

Most information is collected directly from you. Occasionally, a colleague, employer or professional contact may introduce you to us or provide your business contact details. We may also use publicly available professional information where reasonably necessary for a genuine business purpose.

4. Why we use personal information

Responding to enquiries

We use your information to review and respond to your enquiry, understand what support you may need and arrange further conversations.

Our lawful basis is taking steps at your request before entering into a contract, where applicable, and our legitimate interest in responding to genuine business enquiries.

Delivering and managing services

We use information to prepare proposals, enter into and administer agreements, deliver consultancy services, manage projects and communicate with clients.

Our lawful basis is performance of a contract where the contract is with you. Where you represent an organisation, our lawful basis is our legitimate interest in managing the professional relationship and delivering the agreed services.

Business administration and legal obligations

We may use information for invoicing, accounting, tax, record-keeping, insurance, dispute resolution and compliance with legal or regulatory requirements.

Our lawful bases are compliance with legal obligations and our legitimate interest in operating and protecting our business.

Website security and performance

We process limited technical information to operate, secure, troubleshoot and improve the website.

Our lawful basis is our legitimate interest in providing a secure, reliable and effective website.

Website analytics

We use aggregated, cookie-free analytics to understand which pages are useful, how visitors find the website and how the website performs.

Our lawful basis is our legitimate interest in understanding and improving our website and services.

Marketing

Submitting an enquiry does not automatically add you to a marketing list.

If we introduce an email newsletter or other direct marketing, we will explain this separately and provide an appropriate choice to opt in or opt out. Where we rely on consent, you may withdraw it at any time.

5. Information required when contacting us

Fields marked as required on our contact form are needed so that we can understand and respond to your enquiry. Your telephone number is optional.

There is no statutory obligation to provide this information. However, if you do not provide the required details, we may be unable to respond properly.

6. How contact-form submissions are handled

When you submit the website contact form:

  1. the submission is received through our Cloudflare-hosted website;
  2. it is securely forwarded through Zapier;
  3. the enquiry is recorded in Google Sheets; and
  4. a notification is sent to us through Google Workspace.

Access is restricted to people who need the information for legitimate business purposes.

We do not sell personal information.

7. Who we share information with

We use carefully selected service providers to operate the website and our business. These currently include:

  • Cloudflare,for website hosting, delivery, security, form processing and privacy-focused website analytics;
  • Zapier,for securely automating contact-form submissions;
  • Google Workspace,including Gmail and Google Sheets, for communications and enquiry management;
  • Sanity,for managing and delivering public website article content;
  • professional advisers, insurers, regulators, courts or law-enforcement bodies where reasonably necessary or legally required.

These organisations may act as processors on our behalf or as independent controllers for aspects of their own services.

We only provide service providers with the information needed for their role and expect them to protect it appropriately.

8. International transfers

Some of our service providers operate internationally and may process information outside the United Kingdom.

Where personal information is transferred internationally, we take reasonable steps to ensure that an appropriate legal transfer mechanism is used. Depending on the destination and provider, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful safeguard.

You may contact us if you would like more information about the safeguards relevant to your information.

9. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

Our normal retention periods are:

  • general enquiries that do not result in a client relationship: up to 24 months after the last meaningful contact;
  • client, contract, project and financial records: for the duration of the relationship and for up to seven years afterwards where needed for tax, accounting, insurance or legal purposes;
  • website security logs and analytics: for the period supported by the relevant service and only for as long as reasonably necessary for security, performance and analysis.

We may retain information for longer where required by law, where a dispute or legal claim exists, or where another legitimate reason applies. When information is no longer needed, it will be deleted or anonymised in accordance with our normal deletion and backup cycles.

10. Cookies and similar technologies

We do not use advertising cookies or behavioural-tracking cookies.

Cloudflare Web Analytics uses a lightweight browser beacon to provide aggregated website usage and performance information. It does not use analytics cookies, local storage or cross-site tracking.

Cloudflare may use strictly necessary security technologies or cookies in limited circumstances, such as detecting malicious activity or completing a security challenge. These are used to protect and deliver the website rather than for advertising.

If we introduce technologies that require consent, we will update this policy and provide an appropriate consent mechanism before using them.

11. How we protect information

We use reasonable technical and organisational measures to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure.

These measures include controlled account access, authentication, encrypted connections, reputable service providers and limiting access to people who need the information.

No online system can be guaranteed to be completely secure, but we regularly review our arrangements and take proportionate steps to reduce risk.

12. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • ask for a copy of the personal information we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • ask us to delete your information;
  • ask us to restrict how your information is used;
  • object to certain uses of your information;
  • receive certain information in a portable format; and
  • withdraw consent where processing is based on consent.

Your right to object

Where we rely on legitimate interests, you have the right to object to our use of your personal information. We will stop processing it unless we can demonstrate compelling legitimate grounds to continue or the information is required for legal claims.

These rights are subject to conditions and exemptions under data-protection law.

To exercise a right, email info@innovatenonprofit.com. We may need to verify your identity before completing a request. We will normally respond within one month and do not usually charge a fee.

13. Automated decision-making

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects.

14. Children’s information

Our website and services are intended for organisations and adult professional contacts. We do not knowingly collect personal information directly from children through this website.

15. Complaints

If you have a concern about how we have used your personal information, please contact us first at info@innovatenonprofit.com so that we can investigate.

You also have the right to complain to the Information Commissioner’s Office:

16. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. The latest version will always be published on this page with its last-updated date.

If you have any questions about this policy, please get in touch.