Privacy Policy

1. Who we are

NHA EduTech is the trading name of Next Horizon Achievements Ltd, a technology company based in the United Kingdom. We build web applications and websites for schools, businesses, and organisations across education, agriculture, business, and community sectors.

This Privacy Policy explains how we collect, use, and protect personal data when you use our website (nhaedutech.co.uk) or any of our applications, including Career Spotlight Day and the Sports Day Scoring System.

2. What data we collect

We only collect data that is necessary for the service being provided. Depending on which product or page you use, this may include:

• Contact form submissions — your name, email address, organisation type, and message
• Review submissions — your name, role, organisation, product used, star rating, and review text
• Career Spotlight Day — student usernames, names, year groups, form groups, and career session bookings (provided by the school via MIS export)
• Sports Day Scoring System — athlete names, year groups, event results, and house points (provided by the school)

We do not collect payment information, government identifiers, or sensitive personal data.

3. How we use your data

We use the data we collect only for the purpose it was provided:

• Contact form data is used to respond to your enquiry
• Review data is used to display testimonials on our website (with your consent)
• Student and athlete data in our school apps is used solely to run the event — generating timetables, recording results, and producing reports for school staff

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal basis for processing

We process personal data under the following lawful bases under UK GDPR:

• Legitimate interests — responding to enquiries and providing contracted services to schools
• Consent — when you submit a review for publication on our website
• Contract — processing student data necessary to deliver the school application service

5. Data storage and security

Our web applications are hosted on Render.com, a cloud hosting provider based in the United States with data centres in the EU. Databases are hosted on PostgreSQL infrastructure with encrypted connections.

Our website is hosted on GitHub Pages. Contact and review form submissions are handled by Formspree, which stores submissions securely and forwards them to our email.

We take reasonable technical measures to protect data from unauthorised access, including HTTPS encryption on all pages, password-protected staff areas, and environment-variable based secret management.

6. Data retention

We retain data only as long as necessary:

• Contact form enquiries — up to 12 months, then deleted
• School application data (student records, bookings, results) — deleted or archived at the end of each academic event cycle, or upon request by the school
• Published reviews — retained while displayed on the site; removed on request

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing of your data
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at nexthorizon@nhaedutech.co.uk and we will respond within 30 days.

8. Cookies

Our main website (nhaedutech.co.uk) does not use tracking or advertising cookies. We use Google Fonts, which may set performance cookies. Formspree may set functional cookies when you submit a form.

Our school applications (Career Spotlight Day, Sports Day Scoring System) use a session cookie to keep staff logged in. This cookie is essential for the application to function and does not track you across other websites.

9. Third-party services

We use the following third-party services, each with their own privacy policies:

• Formspree (formspree.io) — contact and review form handling
• Render.com — application hosting
• GitHub Pages — website hosting
• Google Fonts — typography

10. Schools and student data

When schools use our applications, they act as the data controller for student data — NHA EduTech acts as the data processor. We process student data only on the instructions of the school and do not use it for any other purpose.

Schools are responsible for obtaining appropriate consent or having a lawful basis for sharing student data with us, in line with their own GDPR obligations.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

12. Contact us