Legal
Privacy policy
How Neurodivergent Excellence collects, uses and protects personal data. Last updated 14 October 2026.
Esta política de privacidad está disponible por ahora solo en inglés. Si necesita una versión en español, escríbanos a info@neurodivergentexcellence.com.
Who we are
Neurodivergent Excellence is the data controller for personal data collected through neurodivergentexcellence.com. We decide why and how that data is used. Neurodivergent Excellence is the trading name of Claire Brett, of 47 Bengal Street, Ancoats, Manchester M4 6BB, United Kingdom.
- Privacy contact: info@neurodivergentexcellence.com
- We have no staff or premises in the EU and have not appointed an EU representative.
This policy applies to visitors, people who contact us, school staff who hold a portal login and people whose details appear in documents a school uploads. We follow the UK GDPR and Data Protection Act 2018, and apply EU GDPR standards to people in the EU. Where the two differ, we apply the stricter rule to everyone.
What we collect and why
We only collect what each activity needs.
| Situation | What we collect | Why | Lawful basis | Kept for |
|---|---|---|---|---|
| Contact or membership enquiry | Name, work email, school, role, country, optional phone number, message; IP address (spam limit only) | To reply and arrange follow-up | Legitimate interests (answering people who contact us) | 24 months after last contact |
| Free sample audit | Name, school, email and your overall score and domain scores | To show your full breakdown and to follow up about the full audit if relevant | Legitimate interests (following up on a sample audit you chose to complete); you can object at any time | 12 months |
| Member portal login (schools, consultants, parents) | Email, name, hashed password, login attempts and lock-outs, session cookie, which library sections you can open | To run your account securely and give you access to the resource library | Contract; legitimate interests (security) | Life of the membership or access plus 6 months |
| Audit and certification | Questionnaire answers, interview times and our notes, ratings, report, certificate | To carry out the audit you commissioned and issue the report | Contract | 7 years from the decision (business records) |
| Evidence files a school uploads | PDF, Word and PowerPoint documents, with their file names | So we can assess the evidence for the audit | Contract | 90 days from the audit decision, then deleted |
| Public certificate verification | School name, campus, country, certificate ID, tier, dates, status | So anyone can check that a certificate is genuine | Legitimate interests (preventing false claims of certification); contract | Permanently. We never delete certification records; an expired one shows as expired |
| Staff named in an audit | Name, job title, work email, interview participation | To schedule interviews and address the report | Contract (with the school); legitimate interests | Same as the audit |
| Payments (when introduced) | Invoice details. Card data is handled by Stripe, not stored by us | To bill and meet tax law | Contract; legal obligation | 6 years (UK tax records) |
| Running the site | Server logs: IP address, browser, pages visited, errors | Security and fixing faults | Legitimate interests | 30 days |
We do not send marketing emails. If that changes, we will ask for your consent first and you will be able to withdraw it at any time.
Documents schools upload
We do not ask schools for student names or health information. Schools must upload only redacted evidence with no personal details: policies, procedures, training records and anonymised examples.
- Please remove or black out names, photos and health details of students and staff before uploading.
- If a document does contain this, we treat it as special category data and use it only to assess the audit. Every uploaded evidence file is deleted automatically 90 days after the audit decision.
- The school remains responsible for having a lawful reason to share anything about its pupils with us. We do not make decisions about individuals; the audit judges the school.
Who we share data with
We never sell personal data. We share it only with providers that run the service for us, under a data processing agreement.
| Provider | What for | Data involved |
|---|---|---|
| Hostinger (VPS hosting, UK) | Runs the website, database and file storage | All data on the site |
| Resend (email) | Sends enquiry notifications and portal emails | Name, email, message content |
| Stripe (when payments are introduced) | Takes payments | Billing details; Stripe is the controller of card data |
| Professional advisers | Legal and accounting advice | Only what they need |
We may also disclose data where the law requires it. Certificate verification is public by design: anyone can look up a certificate ID.
Transfers outside the UK and EU
Our server is in the United Kingdom. Some providers, such as Resend and Stripe, may process data in the United States. Where data leaves the UK or EEA, we rely on an adequacy decision, the UK International Data Transfer Addendum or EU Standard Contractual Clauses, or the provider's certification under the UK–US and EU–US Data Privacy Framework. You can ask us for a copy of the safeguards.
Security
- Encrypted connections (HTTPS) on every page.
- Passwords are stored only as salted hashes, and accounts lock after repeated failed logins.
- Uploaded documents are stored privately, outside the public web folder, with random file names and can only be downloaded by the owning school and our assessor.
- Administrator access is limited to the founder.
If a breach puts people's rights at risk, we will report it to the ICO (and the relevant EU authority where required) within 72 hours and tell affected people without undue delay.
Your rights and how to complain
Under UK and EU GDPR you can ask us to:
- give you a copy of your data (access);
- correct anything inaccurate;
- erase your data, unless we must keep it by law (we keep certification records so verification stays reliable);
- restrict or object to our use of it, including any use based on legitimate interests;
- move your data to another provider (portability), where we use it by consent or contract;
- withdraw consent at any time, without affecting earlier use.
Email info@neurodivergentexcellence.com. We reply within one month and do not charge a fee. We may need to confirm who you are first.
You can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or to the data protection authority in the EU country where you live or work, for example the Agencia Española de Protección de Datos in Spain. We would appreciate the chance to put things right first.
Cookies
We use only cookies the site needs to work. We do not use advertising or analytics cookies, so there is no cookie banner. If that changes, we will ask for consent first.
| Cookie | Purpose | Lasts |
|---|---|---|
| Session and CSRF cookies | Keep you signed in to the member portal and protect forms | Session, up to 30 days |
| Language cookie | Remembers whether you chose English or Spanish | 1 year |
Changes to this policy
We will update this page when our practices change and show the date of the latest version at the top. For material changes we will email member schools in advance. Last updated: 14 October 2026.