Privacy Policy

Last updated: 24 October 2026

The Evidence Academy may be referred to as TEA throughout this document.

The Evidence Academy respects your privacy and is committed to protecting your personal information. This privacy policy explains what information we collect, why we collect it, how it is used and stored, and the rights you have under UK data-protection law.

1. Who we are

The Evidence Academy is operated by:

Karina Northover trading as The Evidence Academy
Clyde Offices
48 West George Street
Glasgow G2 1BP
United Kingdom

Email: karina@theevidenceacademy.co.uk

Karina Northover trading as The Evidence Academy is the data controller responsible for the personal information described in this policy.

The Evidence Academy is registered with the Information Commissioner’s Office (ICO).

ICO registration number: ZC252503

2. Information we may collect

The information we collect will depend on how you interact with The Evidence Academy.

It may include:

Your name and contact details, including your email address, telephone number and postal address.
Booking, payment and transaction information.
The name and age or age range of a child or young person attending a workshop.
Emergency contact information.
Information about allergies, medical conditions, accessibility needs, additional support needs or reasonable adjustments where this is relevant to safe participation.
Workshop attendance records.
Enquiries, messages, feedback and correspondence.
Information supplied by schools, home-education families, community groups or other organisations arranging a workshop.
Your marketing preferences and areas of interest.
Your general location or preferred workshop area.
Responses to a market research survey, if you choose to take part, and contact details only if a survey asks for them and you choose to provide them.
Photographs or recordings where separate permission has been provided.
Technical information collected when you use our website, such as your IP address, device type, browser information and cookie preferences.
Any other information you choose to provide when contacting or booking with us.

We aim to collect only the information reasonably necessary for the relevant purpose. Where possible, we request a child’s age or age range rather than their full date of birth.

We identify required information on our forms. If essential booking, contact, age or safety information is not provided, we may be unable to complete the booking or arrange participation safely. Marketing subscriptions, survey participation and promotional photography consent are optional.

3. How we collect information

We may collect personal information when you:

Visit or use our website.
Complete an enquiry, registration or booking form.
Book or pay for a workshop.
Create a customer account.
Join our mailing list.
Complete a market research survey.
Contact us by email, telephone, social media or another messaging service.
Attend one of our workshops or events.
Complete a consent, medical, accessibility, feedback or photography form.
Represent a school, organisation, venue or community group working with us.

We may also receive information from a parent or carer, school, organisation, venue, booking provider, payment provider or another person making arrangements on your behalf.

4. Why we use personal information

We may use personal information to:

Respond to enquiries.
Process and manage bookings, payments, cancellations and refunds.
Deliver workshops, programmes and events.
Confirm that a workshop is suitable for the participant’s age.
Make appropriate arrangements for accessibility, additional needs, allergies or medical requirements.
Maintain workshop attendance records.
Provide attendance confirmations, certificates or information about the workshop content and learning objectives covered, where requested.
Contact parents, carers or emergency contacts when necessary.
Communicate important information about a booking, venue, cancellation or schedule change.
Manage customer accounts.
Maintain financial, tax, insurance and business records.
Protect the health, safety and welfare of participants.
Manage safeguarding concerns, complaints or incidents.
Improve our workshops and services.
Analyse survey responses to understand interest in workshops, locations and pricing.
Send marketing communications where valid consent has been provided.
Promote The Evidence Academy using photographs or recordings where separate permission has been provided.
Maintain the security, functionality and performance of our website.
Meet our legal and regulatory responsibilities.

5. Our lawful bases

Under UK data-protection law, we must have a lawful basis for using personal information.

Responding to enquiries and arranging and delivering bookings, including payments, attendance and requested certificates: Contract or steps requested before entering a contract; legitimate interests where appropriate for participant information.
Arranging and delivering a session booked by a school or organisation, including relevant participant and staff contact details: Legitimate interests in arranging and delivering the agreed session.
Keeping financial and tax records required by law: Legal obligation.
Maintaining other necessary business and administrative records: Legitimate interests, where appropriate.
Handling complaints, incidents, insurance matters or legal claims: Legitimate interests in resolving matters and protecting legal rights.
Sending promotional emails to adult subscribers: Consent.
Analysing identifiable market research responses: Legitimate interests in understanding demand and planning services.
Using identifiable photographs or recordings for promotional purposes: Consent, obtained separately for the intended use.
Operating and securing our website and improving our services: Legitimate interests; consent where required for optional cookies or similar technologies.

Children and young people have their own data-protection rights. Where we rely on consent, we explain the intended use in age-appropriate language and consider the young person's understanding. In Scotland, children aged 12 or over are presumed capable of exercising their data-protection rights unless there is evidence otherwise. Where a child cannot provide valid consent, we seek it from someone with parental responsibility or other appropriate legal authority.

Health, accessibility and support needs

We collect relevant information about allergies, medical conditions, disabilities and support needs to make reasonable adjustments and deliver workshops safely. Please provide any relevant information, including sensitivities to workshop materials, when booking and notify us of any changes.

Our Article 6 lawful basis is legitimate interests in providing safe, accessible workshops. Where information constitutes special category health data, we rely on explicit consent under Article 9(2)(a) of the UK GDPR for routine participation arrangements. Consent is obtained separately from the participant where they have sufficient understanding, or otherwise from someone with appropriate legal authority.

Where a school or organisation provides health or support information, we agree how any necessary explicit consent for TEA's use will be obtained and recorded. Permission to share information with us does not automatically constitute consent for our use of it.

We assess individual needs and may need to pause or postpone participation if essential safety arrangements cannot be confirmed.

Explicit consent can be withdrawn at any time by contacting us. This does not affect earlier lawful processing. Where withdrawal affects safe participation, we will discuss suitable arrangements. Relevant information may still be retained or used where another lawful basis and applicable special category condition permit this, such as for safeguarding or legal claims.

Accidents, emergencies and safeguarding

Where an accident, emergency or safeguarding concern arises, we may record, use or share relevant information to protect those involved. Our usual Article 6 basis is legitimate interests, or vital interests where necessary to protect someone's life and they cannot give consent.

Where special category information is involved, we rely on an applicable additional legal condition, which may include vital interests or safeguarding where the relevant legal requirements are met.

We may act without consent where permitted by law, including where seeking consent could increase the risk of harm. We will not delay necessary emergency action to seek separate permission.

Workshops arranged by schools and organisations

Where a school or organisation arranges a workshop, it will normally manage participant registration, parental communications, emergency contacts, relevant permissions and its own participant records.

The Evidence Academy aims to receive only the information reasonably necessary to plan and deliver the workshop safely, such as relevant allergies, accessibility requirements, support needs or safety precautions. Where possible, information may be provided without identifying individual participants. We do not routinely require medical records or parental contact details already held by the organisation.

Before delivery, we agree what information needs to be shared, who will obtain any necessary permissions, and the arrangements for supervision, emergencies and safeguarding.

Each organisation remains responsible for its own handling of personal information. The Evidence Academy is responsible for information it processes in its own capacity, including records needed for safety, safeguarding, legal or business purposes.

6. Information about children and young people

The Evidence Academy provides workshops and programmes for children and young people. We take particular care when collecting and using their information.

Bookings and marketing subscriptions are intended for a parent, carer or authorised representative of a school or organisation.

We will:

Collect only information that is relevant to participation, safety, accessibility or workshop administration.
Explain how information will be used in clear language.
Keep children’s information appropriately secure.
Avoid knowingly sending direct marketing communications to children.
Obtain separate permission before using an identifiable child’s photograph or recording for promotional purposes.
Share information without consent where this is necessary to protect a child or comply with a safeguarding or legal responsibility.

7. Marketing communications

We send promotional emails about The Evidence Academy’s workshops, programmes and events only to people who have actively chosen to receive them. You can sign up through our website or choose a separate, optional marketing box when making an enquiry or booking. We do not add you to our mailing list simply because you contacted us or booked a workshop.

If you subscribe, we may use the interests, preferred workshop area and age ranges you choose to tell us about to make our emails more relevant. We do not use a child’s medical or support information for marketing, and we do not knowingly send direct marketing to children.

You can withdraw your marketing consent at any time through the unsubscribe link in an email or by emailing: karina@theevidenceacademy.co.uk

Unsubscribing does not stop messages needed to manage an existing booking, such as confirmations, venue details or cancellations.

8. Photography and recordings

Where photography or recording is planned, we will explain the intended uses and seek separate permission before taking or using identifiable images for our promotion. This may include use on our website, social media or printed material where those uses have been specified in the permission request. Choosing not to give photography permission will not affect participation.

As an additional safeguarding measure, for promotional photographs and recordings of participants under 16, TEA requires permission from someone with parental responsibility or appropriate legal authority, alongside the child or young person’s agreement. Participants aged 16 or over will normally provide their own consent.

Participants can take their workshop work home. We may also photograph their work for promotional purposes. Where a photograph identifies, or could reasonably identify, a participant, we will obtain separate consent covering the intended promotional use. Choosing not to give consent will not affect participation.

You can withdraw consent by emailing us. We will stop using identifiable images or recordings for the promotional purposes covered by that consent, including further distribution of printed materials containing them, and remove them from our website and accounts we control without undue delay. We cannot recall printed materials already distributed or guarantee removal of copies independently saved or shared by others.

For sessions arranged by a school or organisation, we will agree in advance who is responsible for obtaining and recording permission for any photography or recording. We will not use identifiable images for The Evidence Academy’s own promotional purposes unless the permission obtained covers that specific use.

9. Storage and security

We take the security of personal information seriously and use appropriate technical and organisational measures to protect it.

Personal information may be stored on secure servers, encrypted devices or in locked physical storage. Access is limited to Karina Northover and, where necessary, authorised contractors who require access for the purposes described in this policy.

While we use reliable service providers, the transmission of information via the internet is not completely secure. We cannot guarantee the absolute security of information sent to us electronically.

10. Sharing information

We do not sell personal information. When necessary for the purposes above, we may share relevant information with:

Website, booking, payment, email and other IT providers working on our behalf.
A venue or delivery partner where necessary for the safe and effective delivery of a workshop.
A school or organisation arranging a group session, where necessary to confirm attendance or provide requested certificates or information about workshop content and learning objectives covered.
Emergency contacts, emergency services, healthcare professionals, safeguarding services or police, where appropriate to the circumstances.
Our accountant, insurer, legal advisers, regulators or public authorities where needed for advice, a claim or a legal requirement.

Some organisations, such as payment providers, social media platforms and messaging services, also process information under their own privacy notices. We limit the information we share with each recipient to what is needed.

Processing outside the UK

Some digital providers may process information outside the UK when providing services such as website hosting, bookings and email.

We use Wix for our website and related services, and Titan email supplied through 123 Reg. Their published data-processing terms address international transfers, including reliance on UK adequacy arrangements or approved contractual safeguards, as applicable. Providers are responsible for the transfer arrangements they undertake, while The Evidence Academy remains responsible for its own obligations as data controller.

Further information about their processing arrangements and applicable transfer protections is available in the Wix Data Processing Agreement and 123 Reg Data Processing Addendum. You can also contact us for information about the protections relevant to your personal information, including how to obtain a copy of applicable safeguards.

11. Data retention

We keep personal information only for as long as needed for the purpose for which it was collected.

Our usual periods are below. We may retain a particular record longer where a legal duty, complaint, insurance matter, safeguarding concern or claim requires it. In that case, we limit access and review whether we still need to keep it.

Enquiries with no booking: Up to two years after our last contact.
Identifiable market research survey responses: Up to two years after the survey closes; anonymous results may be kept without identifying respondents.
Routine booking and attendance details: Up to three years after the final workshop, subject to the exceptions above.
Routine allergy, medical and accessibility details: While needed for ongoing participation or repeat bookings, normally up to 12 months after the participant’s last attendance. Information is checked for accuracy when booking again. Relevant incident or safeguarding records may be retained separately for longer.
Financial and tax records required for self assessment: At least five years after the 31 January tax-return deadline for the relevant tax year, or longer if another requirement applies.
Marketing preferences: While subscribed; a limited suppression record may be retained after unsubscribing.
Photographs, recordings and evidence of permission: While needed for the agreed promotional purposes, subject to periodic review and withdrawal of consent (see Section 8). Limited consent and withdrawal records may be retained to demonstrate compliance and honour withdrawals.
Safeguarding, accident, serious incident and complaint records: Held separately and securely. We assess how long each record needs to be retained in light of the nature of the concern, applicable guidance, insurance terms and the possibility of a legal claim. We review these records rather than automatically deleting them with routine booking information.

When a retention period ends, we securely delete or anonymise the information unless a specific reason requires us to keep it longer.

12. Your rights

Depending on the circumstances, you or a participant may have the right to access information, correct it, request deletion, restrict or object to its use, and receive certain information in a portable format. You can withdraw consent at any time where we rely on it.

Your right to object: You can object to processing based on legitimate interests for reasons relating to your particular situation. You have an unconditional right to object to the use of your information for direct marketing.

Rights are subject to legal conditions and exceptions; for example, we may need to retain a record required by law or needed for a claim.

To make a request, email karina@theevidenceacademy.co.uk. We may need to verify identity or a person’s authority to act for a child before disclosing information. Withdrawing consent does not make earlier use based on that consent unlawful.

13. Cookies

Our website and its service providers may use cookies or similar technologies for essential site functions and, where enabled, for optional functions such as analytics. We provide information about the technologies in use and a means to manage optional choices through our website’s cookie controls. Where consent is required, optional technologies will not be used until that consent is given.

You can also manage cookies in your browser. Blocking essential technologies may affect site functions.

The precise technologies may change as website features are added. The information shown in the website’s cookie controls should be checked alongside this policy.

14. Third-party links

Our website may contain links to external websites, such as social media platforms, partner organisations or news articles. We are not responsible for the privacy practices or content of these third-party sites.

15. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The 'Last updated' date at the top of the policy will show when it was most recently revised.

16. How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at karina@theevidenceacademy.co.uk. We will acknowledge your data-protection complaint within 30 days of receiving it, take appropriate steps to investigate it without undue delay, keep you informed of progress and tell you the outcome.

You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data.

Helpline number: 0303 123 1113

Website: ico.org.uk

17. Contact us

If you have any questions about this privacy policy, please contact Karina Northover at karina@theevidenceacademy.co.uk

Download the full Privacy Policy (DOCX)

↑