Project Educate

Privacy Notice

Last updated: 19 August 2026

Project Educate has prepared this Privacy Notice to explain how we collect, use, disclose, store and protect personal data when you visit this website, communicate with us, subscribe to updates, submit an expression of interest or application, or otherwise interact with our programmes and activities.

This notice may be supplemented by a separate notice for a particular programme, scholarship, event, partnership or other interaction where additional processing takes place.

1. Controller and contact details

The organisation responsible for the processing described in this notice is:

Project Educate
Registered charity in England and Wales
Registered Charity Number: 1219319
Registered office and postal address: to be added before public launch once the new public register entry is available.
Email: general@project-educate.com

Project Educate was entered onto the Register of Charities by the Charity Commission for England and Wales on 19 August 2026. No personal names are published in this notice.

2. Scope of this notice

This notice applies to personal data processed through this website, email communications, online forms and related offline interactions with Project Educate. It does not apply to third-party websites that may be linked from this website.

3. Personal data we collect

Depending on how you interact with us, we may process the following categories of personal data:

  • Website and security data: IP address, date and time of access, requested page or file, referrer information, browser and device information, operating system, response status and similar technical log data.
  • Newsletter data: email address, subscription status, date of consent and information needed to document or manage the subscription.
  • Correspondence data: name, email address, telephone number and the content of messages sent to us.
  • Team application data: name, email address, telephone number, address, profession and any information you choose to provide in connection with your application.
  • Programme or scholarship data: identity and contact information, date of birth, education and employment history, curriculum vitae, application documents, supporting evidence, references, interview notes, assessment and decision records, correspondence and, where funding is approved, payment and administration data.
  • Partner and supplier data: professional contact details, role, organisation and information relating to our relationship with you or your organisation.

Please do not provide sensitive personal data or personal data about another person unless we expressly request it and you are authorised to provide it. Where special categories of data are genuinely required for a programme, we will provide additional information and request explicit consent where required by law.

4. How we collect personal data

We collect personal data directly from you when you email us, subscribe to updates, complete a form or application, participate in a selection process or otherwise communicate with us. We may also receive information from references, partner organisations, publicly available sources or other third parties where this is lawful and relevant to our activities.

Technical information is collected automatically by the web server and through essential session technology when you use the website.

5. Purposes and legal bases

We process personal data only where a legal basis applies. Depending on the context, we use personal data for the following purposes:

  • to operate, secure, maintain and improve the website and to prevent misuse or cyberattacks, based on our legitimate interests under Article 6(1)(f) GDPR;
  • to respond to enquiries and take steps requested by you, based on Article 6(1)(b) GDPR or our legitimate interests under Article 6(1)(f) GDPR;
  • to administer team, programme, partnership and scholarship applications, including assessment, selection, communication, documentation and, where applicable, funding, based on Article 6(1)(b) and/or Article 6(1)(f) GDPR;
  • to send newsletters or other optional communications where you have consented, based on Article 6(1)(a) GDPR;
  • to manage relationships with programme participants, partners, advisers and service providers, based on Article 6(1)(b) and/or Article 6(1)(f) GDPR;
  • to comply with legal, regulatory, tax, accounting and reporting obligations, based on Article 6(1)(c) GDPR; and
  • to establish, exercise or defend legal claims, based on Article 6(1)(f) GDPR.

Where we rely on consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Online forms, newsletter and email

The website currently provides a newsletter form and a team application form. Form submissions may be stored in our database, sent to our designated organisational email account and, once configured, transferred to a contracted customer or relationship management system. Access is limited to authorised persons who need the information for the relevant purpose.

The Contact page does not contain a contact form. If you contact us by email, the information in your message will be processed to respond to and manage your enquiry.

The donation and payment function is currently disabled. The website does not currently collect payment-card or donation transaction data. This notice must be updated before a payment provider or donation CRM is activated.

7. Read-aloud feature

The read-aloud controls play pre-recorded, AI-generated audio files hosted with this website. Playback does not require microphone access and does not send the page text or your personal data to a live speech provider. Standard technical access data may be recorded by the web server when an audio file is requested, as described in this notice.

8. Cookies and similar technologies

This website currently uses only an essential session cookie named project_educate_session. It supports security functions such as request protection, status messages and rate limiting. The cookie is limited to the browser session, is not used for advertising and is configured with security protections including HttpOnly and SameSite.

We do not currently use analytics, advertising or social-media tracking cookies. If non-essential technologies are introduced later, this notice will be updated and consent will be requested where required.

9. Recipients and service providers

We do not sell personal data. We disclose personal data only where necessary and lawful. Recipients may include:

  • website hosting, IT infrastructure, database, email and security service providers;
  • contracted CRM or communication service providers;
  • authorised staff, trustees, reviewers, advisers and programme or selection partners who require access for the relevant purpose;
  • banks or payment service providers where funding or payments are later administered; and
  • courts, public authorities, regulators or professional advisers where disclosure is legally required or necessary to protect legal rights.

Service providers acting on our behalf are required to process personal data only on documented instructions and to apply appropriate confidentiality and security measures.

10. International data transfers

Some service providers or programme partners may process personal data outside the European Economic Area. Where personal data are transferred to a country without an applicable adequacy decision, we use an appropriate transfer mechanism and safeguards required under Articles 44 et seq. GDPR, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where necessary.

11. How long we retain personal data

We retain personal data only for as long as necessary for the relevant purpose and any applicable legal obligations. The criteria include the duration of our relationship, the status of an application or programme, statutory retention requirements, limitation periods and the need to resolve disputes or protect legal rights.

  • Technical log data are retained only for the period needed for operation, troubleshooting and security under the hosting configuration, unless a security incident requires longer preservation.
  • Newsletter data are retained until you unsubscribe or withdraw consent, with limited records retained where necessary to demonstrate consent or comply with legal obligations.
  • Unsuccessful team applications are generally deleted no later than six months after the process ends, unless you consent to longer retention or a legal reason requires it.
  • Unsuccessful scholarship or programme applications are generally deleted no later than twelve months after the decision.
  • Approved funding and payment records are retained for the funding period and thereafter for applicable contractual, accounting, tax and legal retention periods.
  • Correspondence and partner records are retained for as long as needed to manage the matter or relationship and any applicable legal obligations.

Data may be anonymised instead of deleted where it can no longer be linked to an identifiable person.

12. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, misuse, alteration, unauthorised access or disclosure. These include access controls, secure session settings, request protection, rate limiting and restrictive browser security policies. No transmission or storage system can be guaranteed to be completely secure.

13. Your rights

Subject to the applicable legal requirements, you may have the right to:

  • request access to your personal data under Article 15 GDPR;
  • request correction of inaccurate data under Article 16 GDPR;
  • request deletion under Article 17 GDPR;
  • request restriction of processing under Article 18 GDPR;
  • receive data you provided in a portable format under Article 20 GDPR;
  • object to processing based on legitimate interests under Article 21 GDPR; and
  • withdraw consent at any time with effect for the future.

To exercise your rights, email general@project-educate.com. We may need to verify your identity before responding.

You also have the right to lodge a complaint with a competent data protection supervisory authority, particularly in the EU or EEA country of your habitual residence, place of work or the place of the alleged infringement.

14. Children and young people

Our mission concerns education and young people, but this website is not intended to collect personal data directly from children without an appropriate lawful basis and, where required, the involvement of a parent or guardian. If you believe that a child has provided personal data to us inappropriately, please contact us so that we can review and, where required, delete it.

15. Links to third-party websites

This website may contain links to third-party websites. Project Educate is not responsible for their content or privacy practices. Please review the privacy information of each third-party service before providing personal data.

16. Changes to this Privacy Notice

We may update this notice when our organisation, programmes, website functions, service providers or legal obligations change. The date at the top indicates when the notice was last revised. Material changes will be communicated where required.

17. Contact us

Questions about this notice or the use of personal data should be sent to:

Project Educate
Registered Charity Number: 1219319
Email: general@project-educate.com

Please do not send payment-card details, passwords or unnecessary sensitive personal data by email.