Privacy Policy

1. Introduction

AweSTEM Limited ("AweSTEM", "we", "us", "our") provides STEM education services, including coding, robotics and game design holiday camps, term-time courses and after-school clubs for children in Surrey and the surrounding areas. We take the privacy and security of personal data seriously, whether it belongs to a parent, guardian, child, school partner or website visitor.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and what rights you have. It applies to our website (awestem.co.uk), social media, publications to external vendors, our bookings, our camps and clubs, and our communications with you.

This policy covers data protection only. Related matters are covered in our separate Cookie Policy, Safeguarding Policy, and Terms and Conditions, each available on our website.

We are the "data controller" for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who This Policy Applies To

This policy applies to:

• Parents and guardians who book our camps, clubs or services
• Children who attend our camps, clubs and workshops
• Schools and partner organisations we work with
• Visitors to our website
• Prospective clients who contact us for information

3. The Personal Data We Collect

3.1 Parent / Guardian Data

• Full name
• Email address and phone number
• Home address, where relevant for billing or safeguarding purposes
• Payment and billing details
• Emergency contact details
• Communication history with us (enquiries, emails, feedback)

3.2 Child Data

• Full name, date of birth or age
• School attended and year group
• Session bookings and attendance records
• Parent/guardian and emergency contact details
• Photographs and video footage taken during camps, clubs and events (see Section 6)

3.3 Special Category Data

Where relevant to the safe delivery of our camps and clubs, we may collect:

• Medical conditions, allergies and dietary requirements
• Special educational needs (SEN) or additional support requirements
• Any other welfare information a parent/guardian chooses to share with us so we can look after a child safely

This is "special category data" under UK GDPR and is treated with additional care — see Section 5 for the legal basis on which we process it.

3.4 Website and Marketing Data

• Cookies and similar technologies used for website analytics (see Section 8)
• Email marketing preferences and engagement data, where you have opted in to our newsletter or promotions (see Section 9)
• Enquiry form submissions

3.5 Payment Data

We do not store full card details ourselves. Payments are processed securely by our third-party payment processor(s) — see Section 7.

4. How We Collect Personal Data

• Directly from you, when you book a camp or club, complete a form on our website, email or call us, or sign a consent form
• From schools or partner organisations who make bookings on behalf of pupils, with appropriate authority
• Automatically, via cookies and analytics when you visit our website

5. Our Legal Basis for Processing

We rely on the following lawful bases under UK GDPR Article 6:

• Bookings / Contract / Joiner Notes — to provide the camps, clubs and services you have booked
• Legitimate interests — to run and improve our business, ensure the safety of children in our care, and communicate with existing clients about similar services
• Consent — for photography/video use in marketing, and for email marketing communications
• Legal obligation — to comply with our obligations, e.g. safeguarding, tax and accounting records

Where we process special category data (health, medical or SEN information), we do so under UK GDPR Article 9(2)(a) — explicit consent — and, where relevant, Article 9(2)(b) or (g) for safeguarding and substantial public interest purposes such as ensuring a child's safety and wellbeing during our activities.

6. Photographs and Video

We may take photographs or video during our camps, clubs and events for use in marketing materials, solely for purposes of AweSTEM website, social media and marketing.

• We ask for consent from a parent/guardian before using any identifiable image of a child for marketing purposes. This consent is usually mentioned in communications, joiner notes, and on the website, and you can tell us immediately if you do not want to provide permission.
• You may decline photo/video consent at the time of booking or the session, and this will be respected.
• You can withdraw consent at any time by contacting us. We will remove images from future use and, where reasonably practicable, from our own website and social media — though we cannot guarantee removal from material already shared by AweSTEM to other parties.
• Photos taken purely for internal safeguarding or record-keeping purposes (e.g. registers) are not used for marketing. Our handling of these images is set out in our separate Safeguarding Policy.
• All photos and video taken by us, our staff, partners and suppliers are strictly only used for AweSTEM-related purposes.

7. Who We Share Your Data With

7.1 Third Parties We Work With

We share personal data with the following categories of third party, only where necessary:

• Payment processors (e.g. Stripe, PayPal), to process camp and club fees securely
• Our booking/scheduling platform, to manage enrolments, sessions and attendance
• Our CRM/email platform, to manage client communications and, where you have opted in, marketing emails
• Schools or venue partners, where a booking is made through, or delivered at, a partner school
• Professional advisers (e.g. accountants, solicitors), where necessary
• Regulatory or law enforcement bodies, where required by law or to protect the safety of a child

We do not sell personal data to third parties. Any third party that processes data on our behalf does so under a data processing agreement requiring them to protect your data and use it only for the purposes we specify.

7.2 What Third Parties Can and Cannot Do with Your Data

Where we share personal data with a third-party provider, that provider acts as our "data processor" under UK GDPR — meaning they may only handle personal data on our instructions, for the specific purpose we've engaged them for. We require this in writing through a data processing agreement with every provider we work with.

Third parties CAN:

• Process personal data solely to deliver the specific service they are contracted for (e.g. taking a card payment, hosting a booking record, sending a newsletter you've opted into)
• Store data securely on our behalf, in line with their data processing agreement with us
• Use limited data as needed to maintain, secure and support their own systems (e.g. fraud prevention on a payment platform)
• Retain data for as long as reasonably necessary to fulfil their contracted service and their own legal obligations (e.g. a payment processor's financial record-keeping requirements)

Third parties CANNOT:

• Use personal data for their own marketing, advertising or commercial purposes
• Sell, rent, or otherwise disclose personal data to any other organisation
• Use a child's name, photo, or other data for any purpose beyond the specific service we've contracted them to provide
• Combine data we share with them with data from other sources to build unrelated profiles
• Transfer personal data outside the UK or EEA without appropriate legal safeguards in place (see Section 10)
• Retain personal data for longer than necessary once their contract with us ends, other than as required by their own legal obligations
• Make independent decisions about how personal data is used — as processors, they act only on our documented instructions, not their own

8. Cookies and Website Analytics

Our website uses cookies and similar technologies to understand how visitors use the site, remember your preferences, and support email sign-up and website functionality. When you first visit our website, you will see a cookie banner where you can choose whether to accept non-essential cookies; you can change your choice at any time.

• Essential cookies are needed for the site to function, such as managing your booking session, and are always active.
• Analytics and advertising cookiesonly load once you accept them via the cookie banner. These currently comprise Microsoft Clarity, which records session behaviour and heatmaps so we can understand how visitors use the site, and the Meta Pixel, which sets a "_fbp" cookie, and, where you arrive via an advert, an "_fbc" cookie, to help us measure and target our Facebook and Instagram advertising. Data collected through the Meta Pixel is shared with Meta Platforms Ireland Ltd and is subject to Meta's own privacy policy (facebook.com/privacy/policy).

We also use Umami, a cookieless analytics tool that counts page views without setting any cookies; it runs regardless of your cookie choices.

You can control or disable cookies via the cookie banner or through your browser settings; disabling cookies may affect some website functionality.

9. Email Marketing

We may send you newsletters, camp/club updates and promotional emails using a third-party email marketing platform. Every marketing email includes an unsubscribe link, and you can opt out at any time. We will never share your email address with third parties for their own marketing purposes.

10. International Data Transfers

Some of our third-party service providers (e.g. payment processors, email/CRM platforms) may store or process data outside the UK. Where this happens, we ensure appropriate safeguards are in place — such as the UK's International Data Transfer Agreement/Addendum, or reliance on an adequacy decision — so that your data receives a level of protection equivalent to that under UK law.

11. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected, including:

• Booking and attendance records: for the duration of enrolment plus 10 years for accounting/safeguarding purposes
• Medical/SEN information: for the duration of the camp or club, plus a short retention period, then securely deleted
• Marketing consent and contact data: until you unsubscribe or withdraw consent
• Financial records: as required by HMRC (currently 6 years)

12. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. This includes restricted access to records, secure storage of consent forms, and payment processing through PCI-compliant providers. Access to systems containing client and child data is limited to authorised staff and family members directly involved in delivering AweSTEM's services.

13. Children's Privacy

We recognise that much of the personal data we hold relates to children, and we take extra care to protect it. We do not knowingly collect personal data directly from children without parental or guardian involvement, and our website is not designed to directly target children for data collection. Any collection of a child's data is carried out with the knowledge and, where required, the consent of a parent or guardian.

14. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you or your child
• Request correction of inaccurate data
• Request erasure of your data ("right to be forgotten"), subject to legal retention requirements
• Restrict or object to certain processing
• Request data portability
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, contact us at info@awestem.co.uk. We will respond within one month, as required by law.

15. How to Contact Us

For any questions about this Privacy Policy or how we handle personal data, please contact:

16. Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website.