Privacy Notice

1. INTRODUCTION

This privacy notice provides you with details of how we collect and process your personal data through your use of our site niaavanna.com.

By providing us with your data, you warrant to us that you are over 13 years of age.

Nia Avanna Limited is the data controller and we are responsible for your personal data, referred to as “we”, “us” or “our” in this privacy notice.

Contact Details

Full name of legal entity: Nia Avanna Limited

Email address: [email protected]

It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at [email protected].

2. WHAT DATA DO WE COLLECT ABOUT YOU, FOR WHAT PURPOSE AND ON WHAT GROUND WE PROCESS IT

Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may process the following categories of personal data about you:

Communication Data

This includes any communication that you send to us whether through the contact form on our website, through email, text, social media messaging, social media posting, telephone calls or any other communication that you send us. This may include your name, email address, phone number, business name, job title, social media handle and the content of your communication.

We process this data for the purposes of communicating with you, responding to enquiries, keeping records and establishing, pursuing or defending legal claims.

Our lawful grounds for this processing are:

our legitimate interests, which in this case are to reply to communications sent to us, keep appropriate business records and manage our business; and

where relevant, taking steps at your request to enter into a contract with you or performing a contract with you.

Customer and Client Data

This includes data relating to purchases of our services, consultancy, tools, products, courses, memberships, webinars, events or other offerings.

This may include your name, email address, phone number, postal address, billing address, business name, job title, payment information, purchase details, discovery call notes, client onboarding information, client project information and other information you provide to us in connection with our work together.

We do not store full payment card details, as these are processed by our payment processors.

We process this data to supply the services, products, courses, memberships, tools, consultancy, webinars or events you have purchased, to manage our relationship with you, to take payment, to provide customer support, to administer client projects and to keep records of transactions and communications.

Our lawful grounds for this processing are:

where you are contracting with us personally, including where you are purchasing for business, career or professional development purposes, performance of a contract between you and us;

where you are acting on behalf of a business or organisation, our legitimate interests in managing our business, communicating with you, delivering our services, administering client projects and keeping appropriate records; and

where relevant, compliance with our legal obligations.

Transaction Data

This includes data about payments between us and other details of purchases made by you.

We process this data for the purpose of supplying the goods, services, memberships, courses, consultancy, events or tools you have purchased and to keep proper records of those transactions.

Our lawful grounds for this processing are:

where you are contracting with us personally, including where you are purchasing for business, career or professional development purposes, performance of a contract between you and us;

where you are acting on behalf of a business or organisation, our legitimate interests in administering our business, processing transactions, managing our relationship with that business or organisation and maintaining accurate records; and

where relevant, compliance with our legal obligations.

User Data

This includes data about how you use our website, online courses, membership platform, online community, webinars, digital resources and other online services.

This may include your login email, account details, course or membership access information, content you view, progress through online materials, comments, posts, questions, feedback, survey responses and other information you submit through our website, online community or related services.

Please avoid submitting special category data, such as information about your health, ethnicity, religious beliefs, political opinions, trade union membership, sex life or sexual orientation, or information about criminal convictions or offences, unless we specifically ask you for this information.

We process this data to operate our website, courses, memberships, online community and other services, to provide you with access to the relevant content and resources, to monitor and support your use of our services, to respond to your questions and feedback, to administer and moderate our online community, to ensure relevant content is provided to you, to maintain back-ups of our website and/or databases, to improve our services and user experience and to administer our business.

Our lawful grounds for this processing are:

where you are contracting with us personally, including where you are purchasing or registering for business, career or professional development purposes, performance of a contract between you and us;

where you are acting on behalf of a business or organisation, our legitimate interests in providing access to our services, administering our website, platforms, online community and business, communicating with you and managing our relationship with that business or organisation; and

our legitimate interests in improving our services, user experience, website, platforms and online resources.

Technical Data

This includes data about your use of our website, platforms and online services.

This may include your IP address, browser type and version, device information, time zone setting, browser plug-in types and versions, operating system and platform, page views, navigation paths, length of visit, frequency of use and other technology on the devices you use to access our website, platforms or online services.

We process this data to administer and protect our website, platforms, online services and business, to monitor and analyse use of our website and online services, to improve our website, platforms, services and user experience, to deliver relevant website content to you, to measure the effectiveness of our marketing, and, where you have consented, to deliver relevant advertisements or marketing to you.

Our lawful grounds for this processing are:

our legitimate interests in properly administering, securing and improving our website, platforms, online services and business;

our legitimate interests in understanding how users interact with our website, platforms and online services, improving our services and informing our marketing strategy; and

where required by law, your consent, including where we use cookies, pixels, tags or similar technologies for analytics, advertising, remarketing, tracking or other non-essential purposes.

Where cookies, pixels, tags or similar technologies require consent under the Privacy and Electronic Communications Regulations, we will request your consent through our cookie banner before those cookies, pixels, tags or similar technologies are used.

Marketing Data

This includes data about your preferences in receiving marketing from us, your communication preferences and details of how you interact with our marketing emails, adverts and content.

We process this data to send you newsletters, updates, free resources, invitations, offers and information about our consultancy, tools, products, memberships, courses, webinars, events and related services, and to measure and improve the effectiveness of our marketing.

Our lawful grounds for this processing are:

your consent where consent is required by law, including where required under the Privacy and Electronic Communications Regulations;

your consent where consent if required by law, including where required under the Privacy and Electronic Communications Regulations;

our legitimate interests in marketing our business, products and services to business contacts, corporate subscribers, existing customers, leads and people who have expressed an interest in our services, provided that your rights and interests do not override those interests; and

our legitimate interests in understanding how people interact with our marketing and improving our marketing strategy.

Where we send electronic marketing communications, we will do so in accordance with the Privacy and Electronic Communications Regulations. This means that we will only send email or text marketing to individual subscribers where we have consent, or where the soft opt-in applies. The soft opt-in may apply where you have brough, or negotiated to buy, similar goods or services from us, we gave you the opportunity to opt when we collected your details, and you have not opted out since.

You can ask us to stop sending you marketing communications at any time by clicking the unsubscribe link in our emails or by contacting us.

Where our advertising, analytics or marketing activity involves non-essential cookies, pixels, tags or similar tracking technologies, we will comply with the Privacy and Electronic Communications Regulations and obtain consent where required. Further information about our use of cookies and similar technologies is set out in our Cookie Policy.

We may also use Customer Data, User Data, Technical Data and Marketing Data to send marketing communications to you. Our lawful ground for this processing is either your consent, where we have asked for and obtained consent, or our legitimate interests, namely to grow our business and carry out direct marketing.

Direct marketing is now expressly recognised as an example of a legitimate interest under UK data protection law. However, where we rely on legitimate interests, we must still consider the impact on your rights and freedoms, and we must still comply with the Privacy and Electronic Communications Regulations where they apply, including consent requirements for certain electronic marketing and non-essential cookies or tracking technologies.

We will comply with the Privacy and Electronic Communications Regulations when sending electronic marketing communications, including emails, texts and similar communications. You can opt out of receiving marketing communications from us at any time.

We may also use Communications Data, Customer Data, User Data, Technical Data and Marketing Data where necessary for the establishment, exercise or defence of legal claims. Our lawful ground for this processing is our legitimate interests, namely to establish, exercise or defend legal claims.

Event and Webinar Data

This includes data about your name, email address, business name, job title, registration details, attendance information, questions submitted, chat messages, survey responses, feedback and, where relevant, images, audio, video recordings, webinar recordings, screenshots or testimonials.

We process this data to register you for events or webinars, deliver the event or webinar, manage attendance, enable participation, answer questions, provide replays or follow-up materials, communicate with you about the event or webinar, obtain feedback, improve our events, webinars and services, and keep appropriate business records.

Our lawful grounds for this processing are:

where you are contracting with us personally, including where you are purchasing or registering for business, career or professional development purposes, performance of a contract between you and us;

where you are acting on behalf of a business or organisation, our legitimate interests in delivering the event or webinar, managing attendance, communicating with you and managing our relationship with that business or organisation;

our legitimate interests in delivering, administering, recording and improving our events, webinars, services and business;

our legitimate interests in using general event or webinar images, recordings or screenshots for business, training, record-keeping or promotional purposes, where your rights and interests do not override those interests; and

your consent where we use your image, recording, testimonial, feedback or other contribution in a way that requires consent.

Where an event, webinar or session is recorded, we will take reasonable steps to inform you before or at the start of the event or webinar. If you do not wish to appear in a recording, you should keep your camera switched off, avoid sharing personal information in the chat or Q&A, and contact us if you have any concerns.

Where we ask to use a testimonial, review, case study, screenshot, photograph, video clip or other identifiable contribution for promotional purposes, we will obtain your consent where required and you may withdraw that consent at any time.

Testimonials, Photos and Video Data

This includes data about testimonials, reviews, feedback, case studies, photographs, screenshots, audio recordings, video recordings or other content that you provide to us or that is captured during your participation in our services, events, webinars, programmes, courses, memberships or online communities.

We may use testimonials, reviews, feedback or case studies in an identifiable form, for example by using your name, photograph, video, audio, business name, job title, website, social media handle or other information that identifies you. We may also use testimonials, reviews, feedback or case studies in an anonymised or partly anonymised form, for example by using your first name, initials, business sector, general location or a general description instead of your full name.

We process this data to display feedback about our services, promote our business, demonstrate the impact of our work, share client or customer experiences, create marketing and promotional materials, improve our services and keep appropriate business records.

Our lawful grounds for this processing are:

your consent, particularly where we use identifiable photographs, video recordings, audio recordings, screenshots, detailed testimonials, reviews or case studies for promotional purposes;

our legitimate interests in promoting our business and services, sharing feedback and demonstrating the impact of our work, provided that your rights and interests do not override those interests; and

where relevant, performance of a contract where the creation or use of content forms part of the service we have agreed to provide to you.

Where you give us a testimonial, review, case study, photograph, video, audio clip, screenshot or other content for promotional use, it may be published on our website, social media channels, email marketing, sales pages, presentations, advertisements and other promotional materials, unless we agree otherwise with you.

Where we ask to use your testimonial, review, case study, photograph, screenshot, video clip, audio clip or other identifiable contribution for promotional purposes, we will obtain your consent where required. You may withdraw your consent at any time by contacting us. If you withdraw your consent, we will stop using the relevant material for future promotional purposes where reasonably practicable, but this will not affect any use that has already taken place before your consent was withdrawn.

Please avoid including special category data in testimonials, reviews, case studies, photographs, videos, audio clips or other content, such as information about your health, ethnicity, religious beliefs, political opinions, trade union membership, sex life or sexual orientation, or information about criminal convictions or offences, unless we specifically ask you for this information.

Consultancy and Stakeholder Mapping Data

This includes data processed in connection with the consultancy, stakeholder mapping, community intelligence, community insight, community engagement, communications planning, public affairs, research and related services that we provide to our clients.

Depending on the nature of the project, this may include:

names;

job titles;

organisation or business details;

business or professional contact details;

public roles and responsibilities;

professional profiles;

social media handles or publicly available social media information;

information provided to us by our clients;

information provided to us by stakeholders or community members during engagement activity;

records of communications, meetings, interviews, consultations, workshops or engagement events;

stakeholder categories;

areas of interest, involvement or influence;

geographical area or community connection;

declared interests;

committee memberships;

public appointments;

public statements;

voting records;

published policy positions;

publicly expressed views on matters relevant to the project;

publicly available information about involvement in community groups, campaigns, organisations or public initiatives; and

other information relevant to understanding stakeholders, communities, relationships, communication needs and engagement requirements.

This category of data may relate to you where you are connected with, involved in, affected by, or relevant to a client project, consultation, engagement activity, community issue, public matter or stakeholder mapping exercise.

We process Consultancy and Stakeholder Mapping Data to:

provide consultancy services to our clients;

identify, understand and map relevant stakeholders, communities, issues, interests, relationships, views, concerns and engagement needs

support stakeholder mapping, community intelligence, community insight, consultation, participation, engagement, communications planning and public affairs activity;

identify relevant themes, risks, opportunities or issues;

prepare project materials, including reports, briefings, recommendations, strategies and engagement materials;

administer and manage client projects;

maintain appropriate project records;

respond to queries, complaints or concerns;

manage our client relationships; and

establish, exercise or defend legal claims where necessary.

Where relevant to a project, we may process publicly available information about individuals such as elected representatives, councillors, political party representatives, candidates, public officials, community leaders, campaigners, organisational representatives, local interest group representatives, residents, consultation participants or other public-facing stakeholders.

This may include information about their public role, responsibilities, party affiliation, committee membership, voting record, public statements, policy positions, published views, involvement in relevant matters, or relationship to a project, issue, community or organisation.

Where we use publicly available information, this does not mean that data protection law does not apply. We only use publicly available personal data where we have a lawful basis to do so and where the use is fair, relevant, necessary and proportionate for the services we are providing. We do not treat information as appropriate to use simply because it is available online. We consider the source, context, purpose, relevance, fairness, proportionality and the reasonable expectations of the individuals concerned.

As part of our work, we may categorise stakeholders or community participants by reference to relevant project criteria. This may include role, organisation, sector, geography, community connection, area of interest, level of involvement, level of influence, relationship to a project or issue, stated concerns, publicly stated position on a relevant issue, or communication or engagement needs.

We only carry out this type of categorisation where it is relevant, necessary and proportionate for the project. We do not collect or record speculative, excessive or irrelevant information about individuals’ private views, beliefs, affiliations or personal lives. We aim to distinguish between factual information, publicly stated positions and our professional analysis.

We do not use solely automated decision-making that produces legal or similarly significant effects on individuals.

We may use AI-assisted tools to help us research, organise, summarise and analyse information for the purposes of consultancy, stakeholder mapping, community intelligence, community insight, communications planning and engagement-related services. This may include using AI-assisted tools to identify relevant themes, summarise publicly available information, organise information provided by clients or stakeholders, analyse consultation responses or engagement records, categorise stakeholders by relevant project criteria, support professional analysis and prepare draft summaries, reports, briefings or planning materials.

Where we use AI-assisted tools in connection with personal data, we only do so where we have a lawful basis and where the use is fair, necessary and proportionate. We do not rely solely on AI to make decisions about individuals that produce legal or similarly significant effects. AI-assisted outputs are subject to human review before being relied upon in our client work.

We take steps to check that information used in our work is relevant, proportionate and, where appropriate, accurate. We do not use AI to generate speculative or unsupported assumptions about individuals’ private views, beliefs, affiliations, motives or personal lives. Where appropriate, we keep a record of the underlying source material used for our analysis rather than relying solely on AI-generated summaries.

Further information about our use of AI-assisted tools is set out in the section of this Privacy Notice headed AI Tool Data.

Some of the information we process may reveal special category data under UK data protection law. This may include, in particular, information revealing political opinions, political affiliations or philosophical beliefs.

For example, stakeholder mapping or community intelligence work may involve processing information about an elected representative’s political party, a councillor’s voting record, a candidate’s stated policy position, a public-facing campaigner’s published views, a representative’s public statement on a relevant issue, or an individual’s publicly stated involvement in a relevant political, community or campaigning activity.

We only process special category data where it is relevant, necessary and proportionate for the specific project, where we have identified an appropriate lawful basis and special category condition, and where suitable safeguards are in place.

Where we process political opinion data, this will usually be limited to information that has been manifestly made public by the individual, such as where an elected representative, candidate, political party representative, campaigner or other public-facing stakeholder has publicly stated their affiliation, role, voting position, policy position or view on a relevant issue.

We do not assume that special category data has been manifestly made public simply because it appears somewhere online. We consider the source, context, purpose, relevance and fairness of using the information.

Where necessary, we may also process special category data for the establishment, exercise or defence of legal claims.

Where we act as a controller, our lawful bases for processing Consultancy and Stakeholder Mapping Data may include:

legitimate interests — in providing consultancy, stakeholder mapping, community intelligence, community insight, communications planning, engagement and related services to our clients;

our clients’ legitimate interests — in understanding, communicating with and engaging appropriately with communities, stakeholders, elected representatives, public officials, organisations and other relevant individuals;

legitimate interests — in managing our client relationships, administering projects, maintaining appropriate business records, quality checking our work and developing our services;

legitimate interests — in establishing, exercising or defending legal claims;

contract — where we process personal data relating to our client contacts in order to perform a contract with the client or take steps before entering into a contract; and

legal obligation — where we are required to process certain information to comply with legal or regulatory obligations.

Where we rely on legitimate interests, we consider the impact of the processing on the individuals concerned and apply appropriate safeguards to ensure that the processing is fair, proportionate and not unduly intrusive.

Where we process special category data, such as political opinion data, we also identify an additional condition for processing under UK data protection law. This may include that the relevant information has been manifestly made public by the individual, or that the processing is necessary for the establishment, exercise or defence of legal claims.

Our role under data protection law may vary depending on the nature of the project and our arrangements with the client. In some cases, we may act as an independent controller because we determine how and why personal data is used in order to provide our consultancy, stakeholder mapping, community intelligence, community insight or engagement-related services. In some cases, we may act as a processor and process personal data only on our client’s documented instructions. In some cases, we and our client may act as joint controllers where we jointly determine the purposes and means of processing personal data.

Where we act as a processor, our client is responsible for identifying the appropriate lawful basis for the processing and for providing relevant privacy information to individuals, unless otherwise agreed. Where required, we enter into appropriate data processing arrangements with our clients.

Where we act as joint controllers, we will agree appropriate arrangements with the client setting out our respective responsibilities.

We apply appropriate safeguards to Consultancy and Stakeholder Mapping Data, including limiting the personal data we collect to what is reasonably necessary, using relevant and proportionate sources, avoiding unnecessary collection of special category data, avoiding speculative or unsupported assumptions, distinguishing between factual information, publicly stated positions and professional analysis, limiting access to project data, applying appropriate technical and organisational security measures, reviewing AI-assisted outputs before relying on them, taking reasonable steps to ensure relevant information is accurate and up to date where appropriate, applying suitable retention periods, and deleting or anonymising personal data when it is no longer required.

We retain Consultancy and Stakeholder Mapping Data only for as long as necessary for the purposes for which it was collected, including for the purposes of delivering the relevant project, managing our client relationship, maintaining appropriate business records, complying with legal obligations and establishing, exercising or defending legal claims.

The applicable retention period may vary depending on the nature of the project, the type of data involved, our contractual arrangements with the client and any legal or regulatory requirements.

Further information about retention is set out in the section of this Privacy Notice headed Data Retention.

Survey and Questionnaire Data

This includes data collected through surveys, questionnaires, feedback forms, assessment tools, consultation forms, polls or similar resources.

Survey and Questionnaire Data may include your name, email address, business name, job title, organisation, role, opinions, feedback, preferences, responses, assessment results and any other information you choose to provide.

We may process Survey and Questionnaire Data for purposes including:

understanding the needs, views and experiences of our clients, customers, members, stakeholders and communities; improving, developing and tailoring our business, services, resources, tools and training; carrying out research, analysis, consultancy, stakeholder engagement, community engagement and consultation-related work; preparing reports, recommendations, summaries, insights or assessments; measuring the effectiveness of our services, resources, events, consultations or engagement activities; identifying trends, themes, risks, needs or opportunities; and keeping appropriate records of feedback, responses and engagement.

Where possible and appropriate, we may use survey and questionnaire responses in an anonymised or aggregated form, so that individuals are not identified. However, some surveys, questionnaires or assessment tools may require us to process identifiable personal data, for example where we need to respond to you, provide you with results, deliver a service, administer membership benefits, carry out client work or analyse responses by organisation, role, stakeholder group or community group.

We may process Survey and Questionnaire Data that you provide directly to us. We may also process Survey and Questionnaire Data provided to us by our clients where we are carrying out consultancy, consultation, stakeholder engagement, community engagement or similar work on their behalf.

Our lawful bases for processing Survey and Questionnaire Data are:

legitimate interests — in understanding the needs of our clients, customers, members, stakeholders and communities, improving and developing our business, services, resources and tools, carrying out research and analysis, supporting consultancy work, producing insights and improving engagement;

contract — where the processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract with you, including where a survey, questionnaire, assessment or feedback process forms part of the services we provide to you;

consent — where we specifically ask for your consent for a particular survey, questionnaire or use of your responses; and

legal obligation — where we are required to process or retain the data to comply with a legal obligation.

Where we rely on legitimate interests, we consider the impact of the processing on the individuals concerned and use appropriate safeguards, such as limiting the data collected, using anonymised or aggregated information where possible, and restricting access to identifiable responses where appropriate.

Where we rely on consent, you may withdraw your consent at any time. This will not affect the lawfulness of any processing carried out before consent was withdrawn.

Surveys and questionnaires may sometimes invite you to provide information that could include special category data, such as information about your health, disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation. We do not intentionally collect special category data through surveys or questionnaires unless it is necessary for the relevant purpose and we have a lawful basis and an additional special category condition under data protection law.

Where a survey or questionnaire relates to community engagement, consultation, equality, accessibility, inclusion or stakeholder mapping, special category data may be processed where it is relevant, proportionate and appropriate safeguards are in place.

We may use survey and questionnaire responses to produce anonymised or aggregated reports, summaries, statistics, insights or recommendations. These outputs will not usually identify you personally unless this has been made clear to you or is necessary for the relevant purpose.

AI Tool Data

This includes data contained in prompts, instructions, uploaded documents, client materials, stakeholder information, consultation responses, meeting notes, transcripts, audio recordings, summaries, research materials, draft documents, reports, analysis, outputs or other content that we provide to, generate through, or receive from artificial intelligence tools, including generative AI tools, automation tools, transcription tools, summarisation tools and AI-assisted analysis tools.

We may use AI tools to support our business operations and the services we provide. This may include using AI tools for administration, drafting, research support, note-taking, transcription, summarising information, content creation, data organisation, analysis, planning, improving our services, client project work, stakeholder mapping, community intelligence, community insight, communications planning and engagement-related services.

The personal data processed through AI tools may include names, job titles, business contact details, organisation details, publicly available professional information, client contact information, information provided to us by clients, information provided by stakeholders or community members, records of communications, meeting notes, consultation responses, engagement records and other information relevant to the relevant business purpose or client project.

Where possible, we use anonymised, pseudonymised or non-identifiable information when using AI tools. We do not intentionally input personal data into AI tools unless we have a lawful basis to do so and appropriate safeguards are in place.

Where AI tools are used in connection with stakeholder mapping, community intelligence, public affairs, consultation or engagement-related work, we may use them to help organise, summarise or analyse relevant information. This may include publicly available information and information provided to us by our clients, stakeholders or community members.

We do not use AI tools to generate speculative or unsupported assumptions about individuals’ private views, beliefs, motives, affiliations or personal lives. We may use AI-assisted outputs to support our work, but we do not rely solely on AI tools to make decisions about individuals that have legal effects or similarly significant effects. AI-assisted outputs are subject to human review before being relied upon in our work.

We process AI Tool Data to operate our business efficiently, use appropriate technology, support the delivery of our services, improve our services, carry out research, analysis, administration, drafting, planning, consultancy, stakeholder mapping, community intelligence, community insight, communications planning and engagement-related work, and keep appropriate business records.

Our lawful grounds for this processing are:

our legitimate interests in operating our business efficiently, using appropriate technology, supporting and improving our services, carrying out research, analysis, administration, drafting, planning, consultancy, stakeholder mapping, community intelligence, communications planning and engagement-related work, provided that your rights and interests do not override those interests;

performance of a contract where the processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract with you;

legal obligation where processing is necessary for us to comply with a legal or regulatory obligation; and

our legitimate interests in establishing, exercising or defending legal claims.

Where we use AI tools, we take appropriate steps to reduce data protection risks, including by:

limiting the personal data entered into AI tools to what is necessary and proportionate;

using anonymised, pseudonymised or non-identifiable information where possible;

checking whether the AI tool provider uses input data to train its models;

using settings that restrict model training from our inputs where available;

reviewing AI-generated outputs before relying on them;

checking outputs for accuracy, relevance and fairness where appropriate;

avoiding the use of AI to make unsupported inferences about individuals;

applying appropriate access controls within our business;

considering supplier security, confidentiality and retention arrangements; and

considering whether a data protection impact assessment is required for higher-risk uses of AI.

We do not intentionally input special category data into AI tools unless it is necessary, proportionate, we have a lawful basis under data protection law and an additional special category condition applies. Special category data may include information revealing political opinions, political affiliations, philosophical beliefs, religious beliefs, health information, trade union membership, racial or ethnic origin, sex life or sexual orientation.

Where special category data is processed in connection with stakeholder mapping, community intelligence, consultation or engagement-related work, this will usually be limited to information that is relevant to the project and, where applicable, information that has been manifestly made public by the individual, such as a public political role, publicly stated policy position or publicly available statement on a relevant issue.

Some AI tool providers may process personal data on our behalf as processors. Others may act as independent controllers or have their own purposes for processing data. Where required, we carry out appropriate checks on AI tool providers and put appropriate contractual protections in place.

Some AI tool providers may process or store personal data outside the UK. Where this happens, we ensure that appropriate international transfer safeguards are in place, where required by data protection law.

Further information about how we process personal data in connection with consultancy, stakeholder mapping, community intelligence, community insight and engagement-related work is set out in the section headed Consultancy and Stakeholder Mapping Data.

Required Processing

In some circumstances, we may be required to collect or process certain personal data by law. We may also need certain personal data in order to enter into or perform a contract with you.

Where we need personal data for these reasons and you do not provide it when requested, we may not be able to provide the relevant products, services, membership benefits, information or support to you. For example, we may be unable to process your order, deliver services, respond to your enquiry, provide access to resources or administer your account. If this means that we need to cancel or stop providing a product or service, we will notify you where appropriate.

We may also process your personal data without asking for your consent where we are required or permitted to do so by law, provided that we have a lawful basis for doing so under data protection law.

Purposes of Processing

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose and that purpose is compatible with the original purpose.

Where we use your personal data for a compatible purpose, we will only do so where data protection law allows this and where we have a lawful basis for the processing.

If we need to use your personal data for a new purpose which is not compatible with the original purpose, we will notify you and explain the lawful basis we rely on, unless the law allows or requires us to process the data without doing so.

If you would like more information about how we decide whether a new purpose is compatible with the original purpose, please contact us at s[email protected].

Sensitive data, criminal conviction data and automated processing

We do not usually seek to collect special category data. However, because of the nature of the consultancy, stakeholder mapping, community intelligence, community insight, community engagement, communications planning, public affairs, research and related services that we provide, we may sometimes process information that reveals or may suggest special category data about individuals.

Special category data includes information about race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, health, sex life, sexual orientation, genetic data and biometric data used to identify an individual.

Where relevant to a project, the special category data we may process may include publicly available information, client-provided information, stakeholder-provided information or engagement information which reveals or may suggest:

political opinions, political roles, voting records, published policy positions, campaign involvement or publicly expressed views on relevant matters;

religious or philosophical beliefs, where relevant to a project or community engagement activity;

trade union membership or involvement, where relevant to a project;

health, disability, accessibility needs or other engagement requirements, where provided to us or where relevant to engagement activity;

race, ethnicity or cultural background, where relevant to community insight, engagement planning or understanding the needs of particular communities.

We will only process special category data where it is relevant and necessary for the relevant project or service and where data protection law allows us to do so. Where possible, we seek to minimise the special category data we process and avoid including unnecessary special category data in our records, reports, stakeholder maps, engagement plans and other materials.

Where we process special category data, we will identify an appropriate lawful basis under UK data protection law and an appropriate special category condition. Depending on the circumstances, this may include where the information has been manifestly made public by the individual, where we have explicit consent, where processing is necessary for reasons of substantial public interest, or where processing is necessary for the establishment, exercise or defence of legal claims.

We do not usually collect information about criminal convictions and offences. However, if information relating to criminal convictions, offences, allegations, investigations or related proceedings becomes relevant to a particular project, we will only process that information where it is necessary and where we have a lawful basis and appropriate condition under data protection law to do so.

We may analyse, categorise or summarise stakeholder and community information in order to provide our services. This may include creating stakeholder maps, engagement plans, community insight reports, communications plans, briefings, recommendations, strategies or similar materials.

We do not use personal data to make decisions about individuals based solely on automated processing where those decisions have a legal or similarly significant effect on them.

Automated decision making

We do not carry out automated decision making. We may use software tools, including data analysis tools, research tools, customer relationship management systems, project management tools or artificial intelligence tools, to help us organise, analyse, categorise, summarise or understand stakeholder and community information as part of the consultancy, stakeholder mapping, community intelligence, community insight, community engagement, communications planning, public affairs, research and related services that we provide.

These tools may help us prepare stakeholder maps, engagement plans, community insight reports, communications plans, briefings, recommendations, strategies or similar materials. However, we do not rely solely on automated processing to make decisions about individuals. Our outputs are subject to human review and professional judgement.

3.  HOW WE COLLECT YOUR PERSONAL DATA

We may collect personal data about you in the following ways:

Directly from you, for example when you contact us, complete a form on our website, send us an email, speak with us by phone or video call, attend a meeting or event, participate in an engagement activity, respond to a survey or otherwise provide information to us.

Automatically when you use our website, for example through cookies and similar technologies. Please see our cookie policy for more details about this: https://www.niaavanna.com/cookie-policy.

From our clients, where they provide us with information about stakeholders, community members, organisations, representatives, contacts or other individuals relevant to a project or service that we are providing.

From publicly available sources, such as Companies House, the Electoral Register, local authority websites, government websites, planning portals, public registers, professional directories, organisation websites, social media platforms, published reports, news articles, press releases, public consultations, public meeting papers, public statements and other publicly accessible sources.

From third parties, such as event organisers, community organisations, partner organisations, research providers, consultants, suppliers, referral sources, analytics providers, advertising networks, search information providers, technical service providers, payment providers, delivery providers, data brokers or data aggregators.

From cookies, pixels and similar technologies, including analytics and advertising tools, where these are used on our website or in connection with our online services.

Some of the third parties referred to above may be based outside the UK.

Where we receive personal data from a third party or from a publicly available source, we will comply with our obligations under data protection law, including by providing privacy information where required.

4.  MARKETING COMMUNICATIONS

Our lawful basis for processing your personal data to send you marketing communications is either your consent or our legitimate interests, namely to promote and grow our business and to provide information about our services, products, events, resources, training and professional development opportunities that may be relevant to businesses, organisations and people working in community engagement, stakeholder engagement, communications, public affairs or related professional roles.

We may send you marketing communications where you have requested information from us, purchased products or services from us, signed up to receive our updates, downloaded a resource, attended one of our events, engaged with us in a professional capacity, or otherwise indicated that you are interested in our services, products, training, resources or related information, provided that we are permitted to do so under applicable data protection and electronic marketing laws.

Under the Privacy and Electronic Communications Regulations, where you are an individual subscriber, which includes individual consumers, sole traders and certain types of partnership, we will only send you electronic marketing communications where we have your consent or where we can rely on the “soft opt-in”. The soft opt-in may apply where you have purchased, or negotiated to purchase, similar goods or services from us, you were given a clear opportunity to opt out when your details were collected, and you are given a clear opportunity to opt out in every marketing communication.

Where we send marketing emails to corporate subscribers, such as limited companies, LLPs, incorporated organisations, public bodies or other corporate entities, including to individuals using business email addresses, we may rely on our legitimate interests to send relevant marketing communications, provided that you have not opted out.

We may also use your personal data to show you relevant advertising on third-party platforms, such as social media platforms, search engines or advertising networks. This may include using your contact details to create custom audiences or similar audiences, or using cookies, pixels or similar tracking technologies to deliver, measure and improve our advertising. Where required by law, we will obtain your consent before using non-essential cookies, pixels or similar technologies. Please see our Cookie Policy for more information about how we use cookies and similar technologies.

You can ask us to stop sending you marketing messages at any time by following the unsubscribe link in any marketing email or by emailing us at [email protected].

If you opt out of receiving marketing communications, this will not apply to personal data provided to us as a result of a purchase, contract or other transaction. We may still contact you where necessary for non-marketing purposes, such as providing products or services you have bought from us, responding to your enquiries, sending administrative messages, managing your account, dealing with payments or complying with our legal obligations.

We will not share your personal data with any third party for their own marketing purposes.

5.  DISCLOSURES OF YOUR PERSONAL DATA

We may have to share your personal data with the parties set out below:

Service providers who provide IT, website hosting, email, system administration, customer management, payment processing, course or digital product delivery, booking, analytics, advertising and marketing services.

Professional advisers including legal advisers, accountants, bankers, auditors and insurers.

Government bodies, regulators and other authorities that require us to report processing activities or otherwise disclose your personal data.

Contractors, freelancers or other support providers who help us operate our business and provide our products and services.

Advertising, analytics and social media platforms where we use those platforms to deliver, measure or improve our marketing, including where we use custom audiences, similar audiences, pixels, cookies or similar technologies.

Third parties to whom we sell, transfer, or merge parts of our business or our assets.

Where we appoint third parties to process personal data on our behalf, we only allow them to process your personal data for specified purposes and in accordance with our instructions. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

6.  INTERNATIONAL TRANSFERS

Some of our external third-party service providers are based outside the UK or may process personal data outside the UK. This means that their processing of your personal data may involve a transfer of data outside the UK.

We use service providers for purposes such as website hosting, online course and digital product delivery, email and business administration, accounting, productivity tools, artificial intelligence tools and other business support services.

We are subject to the provisions of the UK General Data Protection Regulation and the Data Protection Act 2018, which protect your personal data. Where we transfer your personal data outside the UK, we ensure that a similar degree of protection is afforded to it by ensuring that at least one of the following safeguards is implemented:

We may transfer your personal data to countries or territories that the UK government has approved as providing an adequate level of protection for personal data.

If we use US-based providers that are certified under the UK-US Data Bridge, being the UK Extension to the EU-US Data Privacy Framework, we may transfer personal data to them on that basis.

Where we use service providers that are established outside the UK and no adequacy regulation applies, we may use specific contracts approved for use in the UK, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any required transfer risk assessment.

Where permitted by data protection laws, we may rely on another lawful safeguard, derogation, code of conduct or certification mechanism.

If none of the above safeguards are available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.

7.  DATA SECURITY

We have put in place appropriate technical and organisational security measures to help prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation.

We limit access to your personal data to those employees, contractors, service providers and other third parties who have a business need to know. Where those parties process personal data on our behalf, they will only process your personal data on our instructions and they are required to keep it confidential.

We use third-party service providers to help us operate our business and provide our services. Where appropriate, we take steps to ensure that those providers have suitable security measures in place to protect personal data.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach if we are legally required to do so.

8. DATA RETENTION

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, reporting, regulatory or contractual requirements.

When deciding how long to keep personal data, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data, whether those purposes can be achieved by other means, and any applicable legal requirements.

We may keep basic information about our customers and clients, including Contact, Identity, Financial and Transaction Data, for up to six years after they stop being customers or clients, for legal, accounting and record-keeping purposes.

Where you have opted in to receive marketing communications from us, we will retain your contact details for marketing purposes until you unsubscribe or withdraw your consent, unless we have another lawful reason to retain them. If you unsubscribe, we may retain limited information to ensure that we do not send you further marketing communications.

Where you make an enquiry but do not become a customer or client, we will retain your personal data for a reasonable period so that we can deal with your enquiry and follow up with you where appropriate.

In some circumstances, we may anonymise your personal data so that it can no longer be associated with you. Where we do this, we may use such anonymised information indefinitely without further notice to you.

9.  YOUR LEGAL RIGHTS

Under data protection laws, you have rights in relation to your personal data. These may include the right to:

request access to your personal data;

request correction of the personal data that we hold about you;

request erasure of your personal data;

object to the processing of your personal data;

request restriction of processing of your personal data;

request the transfer of your personal data to you or to a third party; and

withdraw consent at any time, where we are relying on consent to process your personal data.

If you are within the UK, you can see more about these rights at:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/

If you wish to exercise any of the rights set out above, please email us at [email protected].

You will not usually have to pay a fee to access your personal data or to exercise any of your other rights. However, we may charge a reasonable fee, or refuse to comply with your request, if your request is manifestly unfounded or excessive, including where it is repetitive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data, or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We may also contact you to ask you for further information in relation to your request, including to clarify the scope of the request. If we need to ask you for further information to verify your identity or clarify your request, the response period will be paused while we wait for that information, in line with the Data (Use and Access) Act 2025.

When responding to a request to access your personal data, we are only required to carry out searches that are reasonable and proportionate in the circumstances. This means we may take into account factors such as the nature of the information sought, the context in which it is held, any difficulty involved in locating it, and the potential benefit to you of receiving it.

We try to respond to all legitimate requests within one month of receiving the request or, where applicable, within one month of receiving the identity verification information or clarification we have asked for.

Occasionally, it may take us longer than one month if your request is particularly complex or you have made a number of requests. In this case, we may extend the response period by up to a further two months. We will notify you within one month of receiving your request if an extension is needed and explain why.

10.  HOW TO COMPLAIN

If you have a complaint about how we handle your personal data, we ask that you contact us first so that we can try to resolve it for you.

You can submit a data protection complaint to us by emailing us at [email protected].

We will acknowledge your complaint within 30 days of receiving it. We will investigate your complaint without undue delay, keep you informed of our progress, and communicate the outcome to you clearly with sufficient detail for you to understand how we reached our conclusion.

If you are within the UK and are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection issues. You can contact the ICO at: www.ico.org.uk

11.  THIRD-PARTY LINKS

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

12.  COOKIES

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see:  https://www.niaavanna.com/cookie-policy.

Last update: 15th September 2026

Privacy Notice

Stay Connected