Privacy notice

This website is run by Small Firms Enterprise Development Initiative Limited (SFEDI), a not-for-profit company limited by guarantee, registered in England and Wales (company number 03563642). Our registered office is 19 Victoria Road, Darlington, DL1 5SF. In this notice, "SFEDI", "we" and "us" mean that company.

We are the controller for the personal information collected through this website. We are registered with the Information Commission (ICO), registration number Z350173X.

SFEDI Awards, which awards the qualifications described on this site, is a separate company with its own privacy notice. When you follow a link to the SFEDI Awards website, its privacy notice applies.

This notice covers www.sfedi.co.uk. It does not cover other websites we link to.

When you contact us. If you use our enquiry form, we collect the details you give us: your name, email address, organisation (if you give it), what your enquiry is about and your message. We also record that you agreed to us using your details to respond. If you email us, we collect your email address and anything you include in your message.

When you submit a form. We use Cloudflare Turnstile to check that forms are sent by people rather than automated programs. To do this, Cloudflare processes your IP address and information about your browser and device. Cloudflare uses this information only to provide the check.

When you visit the site. Our hosting provider automatically records technical information when pages are requested, such as your IP address, the date and time, the page requested and your browser type. This is used to run the site, fix faults and protect it from attack.

We do not use advertising cookies or tracking technologies, we do not collect website analytics, and we do not build profiles of visitors.

Data protection law requires us to have a lawful basis for each use of your information.

• To reply to your enquiry and give you the information you asked for. Our lawful basis is legitimate interests (responding to people who contact us). Where your enquiry is about using one of our services, our basis is taking steps at your request before entering into a contract.
• To keep a record of enquiries, so we can follow up and improve our service. Our lawful basis is legitimate interests.
• To keep the site secure and stop spam and misuse. Our lawful basis is legitimate interests.
• To meet our legal obligations, for example if we are required to disclose information by law. Our lawful basis is legal obligation.

We will not send you marketing emails because you used the enquiry form. We will only send you news or updates if you have asked us to.

Where we rely on legitimate interests, we have considered your interests and rights and believe they are not overridden. You can ask us for more detail.

We use service providers to run this website. They act on our instructions, under contract, and may only use your information to provide their service to us:

• Vercel, which hosts the website
• MongoDB, which provides the database where enquiries are stored (MongoDB Atlas)
• Cloudflare, which stores images and files used on the site and provides the Turnstile form check
• Brevo, which delivers form notifications to our team by email
• [TO CONFIRM: the provider of the support@sfedi.co.uk mailbox, for example Microsoft 365 or Google Workspace]

If your enquiry is about something another organisation provides, such as a qualification awarded by SFEDI Awards, we will either ask you to contact them directly or tell you before we pass your details on.

We may also share information where the law requires it. We do not sell personal information.

The website and the database where enquiries are stored run in Ireland, in the European Economic Area. Some of our service providers may also process information elsewhere outside the UK. Where information is transferred outside the UK, it is protected by UK adequacy regulations (for example, transfers to the European Economic Area, or to US companies certified under the UK Extension to the EU-US Data Privacy Framework), or by the international data transfer agreement or addendum approved for use in the UK.

• Enquiries: [TO CONFIRM: suggested, two years from our last contact with you], then deleted. If your enquiry leads to an ongoing working relationship, we keep the relevant records for as long as that relationship needs them.
• Server logs: kept by our hosting provider for [TO CONFIRM: the retention period on SFEDI's Vercel plan], then deleted.
• Form check data: kept by Cloudflare in line with its own retention policy.

You have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use your information
• object to how we use your information, where we rely on legitimate interests
• ask for your information in a format you can take to another organisation, where this applies

To use any of these rights, email support@sfedi.co.uk. There is no charge in most cases. We will reply within one month, and may need to confirm your identity first. If your request is complex, we may extend this, and we will tell you why.

If you are unhappy with how we have handled your personal information, please tell us first. Email support@sfedi.co.uk with "Data protection complaint" in the subject line, or write to us at our registered office. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

If you are still unhappy, you can complain to the Information Commission (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint (opens in a new tab) or on 0303 123 1113.

Our Cookies page explains the cookies this site uses.

We will update this notice when we change how we use personal information, for example when we add new services to the site. The date at the top shows when it was last changed.