Privacy policy

The data controller is The Nest Collective. For privacy questions, contact us or email nestcollective.manchester@gmail.com.

Depending on how you use the site, we may process:

• Contact form: name, email, phone (if you provide it), message content, and any class or context you include in the form or URL.
• Register interest / booking interest: name, email, phone (optional), message (optional), and a timestamp.
• Pregnancy walk updates: if you sign up for reminders about our free Thursday walks ("Bumps in the Park"), we collect your first name, surname, and email to send those updates. See our walk announcement.
• Research questionnaire (where you are invited to take part): your responses as submitted through the form, and technical metadata needed to run the service (for example time of submission). Do not include names or identifying details unless we have told you it is appropriate.
• Payments (if enabled): if you pay through Stripe, Stripe processes payment details — we do not receive your full card number. We may receive your name, email, and payment status linked to your booking.
• Website use: our hosting provider may process technical data such as IP address, browser type, and request logs for security and reliability.
• Analytics (if you opt in): if you choose "Accept analytics" on our cookie notice, we load Google Analytics 4 (GA4) to understand how the site is used (for example pages viewed and general location). GA4 may set cookies and process data as described in Google's privacy policy. You can change your mind later by clearing site data for this website in your browser (which removes the saved choice) or contacting us. If you choose "Essential only", we do not load GA4.

• To respond to you and manage enquiries — our legitimate interests in running the business and communicating with prospective customers, or steps at your request before a contract.
• To register interest in a course and contact you when bookings open — legitimate interests / pre-contract.
• To send pregnancy walk updates you signed up for (email reminders and where to meet) — consent when you submit the signup form.
• To run research you have agreed to — usually consent or our legitimate interests in managing a research project, as explained in the invitation you received.
• To take payment and deliver a course — contract and legal obligations where applicable.
• To keep the site secure — legitimate interests.
• To measure website use (GA4) — only if you choose "Accept analytics"; consent.

We do not sell your personal data. We use trusted service providers ("processors") where needed:

• Web3Forms (web3forms.com) — delivers form submissions to our inbox when configured.
• Upstash (upstash.com) — optional encrypted storage for interest lists, walk sign-ups, or research responses so we can review them in admin tools.
• Stripe (stripe.com) — payment processing, if you pay online.
• Google (Google Analytics / Google privacy) — if you opt in to analytics, Google processes usage data under their terms; see section 2 above.
• Hosting (for example Vercel) — runs the website and may process technical logs.

Some providers may process data outside the UK. Where that happens, we rely on appropriate safeguards (such as the UK extension to the EU–US Data Privacy Framework or standard contractual clauses) as required by law.

• Enquiries and interest registrations: long enough to follow up, run the relevant cohort, and meet accounting or legal requirements — typically up to three years after last contact unless we need longer for a legal claim or HMRC rules.
• Research responses: as described in your participant information, or otherwise for the duration of the project plus a reasonable archive period, then deleted or anonymised where possible.
• Server logs: short retention by our host (often days to weeks) unless needed for security investigations.

Under UK data protection law you may have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Ask us to delete data in certain situations.
• Restrict or object to processing in certain situations.
• Data portability (where processing is based on consent or contract and is automated).
• Withdraw consent at any time, where we rely on consent (without affecting earlier lawful use).
• Lodge a complaint with the ICO (ico.org.uk).

To exercise your rights, email us using the address above. We may need to confirm your identity before we act.

We use reasonable technical and organisational measures to protect personal data. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

Our services are aimed at adults who are pregnant or supporting a pregnancy. We do not knowingly collect data from children. If you believe a child has given us personal data, please contact us and we will delete it where appropriate.

Our site may link to other websites (for example partners or venues). Their privacy practices are their own; read their policies before you submit data there.

We may update this policy from time to time. The "Last updated" date at the bottom will change when we do. For significant changes, we will take reasonable steps to draw your attention to them where appropriate.

Booking and cancellation terms are in our booking & cancellation policy.