FIELD STATION · 55°N 2°W
Tools Contact

Data protection policy

How we collect, use, store and protect personal data under UK data protection law.

Adopted
September 2026
Next review
September 2027
Owner
The directors
Company
17318613 ↗
Data protection contact
privacy@fieldstation.xyz

1. What this policy covers

This policy explains how we collect, use, store and protect personal data. It follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It covers our client projects, our own administration, our website and newsletter, and any research or writing that involves personal data. Our privacy notice tells people what this means for them.

2. Our two roles: controller and processor

When we are the controller. We decide why and how some personal data is used. Examples are our contact lists, invoices, newsletter, email enquiries, and projects where we design the data collection ourselves. In these cases this policy and our privacy notice apply in full.

When we are a processor. Often a client asks us to handle personal data for its own project. The client is then usually the controller and we are its processor. When this happens, we:

  • use the data only on the client's written instructions, under a data processing agreement
  • follow the client's privacy notice and retention rules
  • pass any request from a person about their data to the client straight away
  • tell the client without delay if something goes wrong with the data
  • return or delete the data when the work ends, as the client instructs.

At the start of each project we agree with the client which role we have, and we write it down.

3. Our principles

Personal data must be:

  • used fairly, lawfully and openly
  • collected only for clear, specific reasons, and not used for anything else
  • kept to the minimum we need, never collected "just in case"
  • accurate, and corrected or deleted quickly if it is wrong
  • kept only as long as we need it
  • protected by the measures in our information security statement.

When we are the controller, we use these legal bases:

  • Contract for working with clients, associates and suppliers.
  • Legal obligation for tax and company records.
  • Legitimate interests for running projects, replying to enquiries and keeping in touch with people we work with. We check first that our use is fair, necessary and does not override people's rights.
  • Consent for our newsletter. People can unsubscribe at any time.

Some data needs extra protection, such as health information or information about someone's access needs. For this, we rely on the person's explicit consent. For a safeguarding concern, we may rely on the safeguarding condition in the Data Protection Act 2018, or on the need to protect someone's life. We write down which basis applies before we use the data.

5. What data we collect

Usually we collect a person's name, contact details and organisation, and information linked to a project, such as attendance, feedback or messages. We only collect more sensitive data if someone chooses to share it, or if a safeguarding concern arises. We mark sensitive data so it gets the extra care set out in section 8.

6. Who we share data with

We share personal data only with:

  • the client or funder for a project, where the project needs it
  • the associates working on that project, under written agreements
  • service providers that store or process data for us, listed in our information security statement
  • professional advisers, such as our accountant, who must keep it confidential
  • official bodies, where the law says we must.

We do not sell personal data or share it for marketing.

7. How long we keep data

  • Project data where we are the controller: the length of the project plus three years, then we delete or anonymise it.
  • Project data where we are a processor: as long as the client's agreement says, then we return or delete it.
  • Financial and company records: six years from the end of the financial year they relate to, in line with HMRC rules.
  • Newsletter subscribers: until the person unsubscribes.
  • Email enquiries: up to two years after our last contact. If an enquiry becomes a project, the project period applies instead.

8. Extra care for sensitive data

We store sensitive data and safeguarding records apart from general project files. Only the people who need them can see them. We handle safeguarding records under our safeguarding policy and this policy.

9. People's rights

People have the right to:

  • know how we use their data
  • see a copy of their data
  • correct data that is wrong
  • have their data deleted
  • limit how we use their data
  • object to some uses of their data
  • receive their data in a portable format, in some cases
  • withdraw consent at any time, where we rely on consent.

Requests go to privacy@fieldstation.xyz. We reply within one month. For complex requests we may need up to two more months, and if so we will say why within the first month.

10. Complaints

If someone is unhappy with how we have handled their data, we want to know. They can complain to us at privacy@fieldstation.xyz, or in any other way that suits them. We will acknowledge the complaint within 30 days, look into it without delay and tell them what we find. They have the right to complain to the Information Commissioner's Office (ICO) too, at ico.org.uk or on 0303 123 1113.

11. If something goes wrong

If anyone suspects a data breach, they tell a director straight away, and within 24 hours at most. The director works out how serious it is and what risk it poses to people. If there is a risk to people's rights, we tell the ICO within 72 hours of finding out. If the risk is high, we tell the people affected without delay. When we are a processor, we tell the client without delay and help it meet its own duties. We keep a record of every breach we look into, including ones we do not report, and our reasons.

12. Sending data outside the UK

We only send personal data outside the UK where the law allows it. That means one of two things. Either the UK has recognised the country as protecting data properly, as it has for the European Economic Area and Switzerland. Or the provider has signed the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. We check this before we start using any service based outside the UK.

13. Automated decisions

We do not make decisions about people using only automated means. Our AI use policy sets out how we use AI tools.

14. Training and review

Directors and associates learn about this policy before they handle personal data. We keep a note of data protection questions, near misses and breaches, and use them to improve how we work. We review this policy every year, and sooner if the law changes.