Privacy Policy

Blastbeat Education ("we", "us", "our") is committed to protecting the privacy of all visitors to our website and participants in our programmes. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with applicable data protection legislation.

1. Data We Collect

We may collect the following categories of personal data:

Information you provide directly

• Contact forms and applications: Name, email address, phone number, school name, role (student, teacher, administrator), and any message content you submit through our website forms.
• Newsletter subscriptions: Email address.
• Programme registration: Student name, age, school, parent/guardian contact details, and relevant programme information.
• Partner and school applications: Organisation name, contact person details, and institutional information.

Information collected automatically

• Analytics data: Pages visited, time spent on site, referral source, browser type, device type, operating system, and approximate geographic location (country/region level).
• Cookies and similar technologies: See Section 7 (Cookie Policy) below.
• Log data: IP address, access times, and pages viewed.

2. How We Use Your Data

We use personal data for the following purposes:

• Programme delivery: To administer and deliver the Blastbeat Event Social Enterprise programme, including registration, communication with schools and students, and event coordination.
• Communication: To respond to enquiries, send programme updates, newsletters (where consent has been given), and important notices about our services.
• Website improvement: To analyse how visitors use our website and improve its functionality, content, and user experience.
• Legal obligations: To comply with legal and regulatory requirements, including safeguarding obligations.
• Reporting and impact measurement: To produce anonymised and aggregated reports on programme impact for funders, partners, and stakeholders.

3. Legal Basis for Processing (GDPR)

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we process personal data on the following lawful bases:

• Consent: Where you have given clear consent for us to process your data for a specific purpose (e.g., newsletter sign-up).
• Contractual necessity: Where processing is necessary for the performance of a contract or to take steps at your request before entering into a contract (e.g., programme registration).
• Legitimate interests: Where processing is necessary for our legitimate interests (e.g., improving our services, website analytics), provided these interests are not overridden by your rights.
• Legal obligation: Where processing is necessary for compliance with a legal obligation (e.g., safeguarding).

4. Your Rights Under GDPR

If you are located in the UK or European Economic Area, you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to restrict processing: You may request that we limit the processing of your data in certain circumstances.
• Right to data portability: You may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, please contact us at robert@blastbeat.education. We will respond within 30 days.

5. POPIA Compliance (South Africa)

For participants and users located in South Africa, we comply with the Protection of Personal Information Act (POPIA). In addition to the rights outlined above, South African data subjects have the right to:

• Be notified that personal information is being collected and the purpose of collection.
• Request access to and correction of personal information held.
• Request deletion or destruction of personal information.
• Object to the processing of personal information.
• Lodge a complaint with the Information Regulator (South Africa).

Our Information Officer can be contacted at robert@blastbeat.education.

6. Children's Privacy (COPPA Considerations)

While our programme primarily engages students aged 13–18, we recognise the importance of protecting children's data:

• We do not knowingly collect personal information from children under the age of 13 without verifiable parental consent.
• For students aged 13–15, programme registration is completed through schools, and parental/guardian consent is obtained as part of the school's enrolment process.
• For students aged 16–18, consent may be provided directly by the student in accordance with applicable law.
• Schools participating in the Blastbeat programme are responsible for ensuring that appropriate parental consent has been obtained before sharing student data with us.
• If you believe we have collected data from a child without appropriate consent, please contact us immediately at robert@blastbeat.education.

7. Cookie Policy

Our website uses cookies and similar technologies to enhance your browsing experience.

What are cookies?

Cookies are small text files placed on your device when you visit a website. They help the site remember your preferences and understand how you interact with the content.

Cookies we use

• Essential cookies: Required for the website to function properly (e.g., cookie consent preference stored in localStorage).
• Analytics cookies: Help us understand how visitors interact with our site, which pages are most popular, and how users navigate the site. This data is collected in aggregate and does not personally identify you.
• Functional cookies: Remember your preferences and settings to improve your experience.

Managing cookies

You can manage or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. You can also manage your preferences via the cookie consent banner displayed on your first visit.

8. Third-Party Services

We may use the following third-party services that process data on our behalf:

• Netlify: Website hosting and form submission processing.
• Google Fonts: Typography delivery (may collect anonymised usage data).
• Analytics providers: Website traffic analysis (anonymised and aggregated data).

We ensure that all third-party processors comply with applicable data protection legislation and have appropriate safeguards in place for international data transfers.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Enquiry and contact form data: Up to 2 years after last interaction.
• Programme participant data: For the duration of participation and up to 3 years after programme completion for impact reporting.
• Newsletter subscriptions: Until you unsubscribe.
• Analytics data: Up to 26 months (anonymised).

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission (HTTPS), secure hosting, and access controls.

11. International Data Transfers

As Blastbeat operates in multiple countries, personal data may be transferred internationally. Where data is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or adequacy decisions.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Email: robert@blastbeat.education
• Organisation: Climate Actions Now group

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). In South Africa, this is the Information Regulator.