Privacy Policy

Enabling Place Ltd Last updated: August 2026 Version: 1.0

This Privacy Notice explains how Enabling Place Ltd collects, uses, and protects your personal data when you interact with us through our website, attend our events, or use our services. It is written in plain language to help you understand what we do with your information and the rights you have.

Who We Are

Enabling Place Ltd is the data controller for the personal information you provide to us. The company is registered in England and Wales.

Data Protection Contact: Enabling Place Ltd Cambridge, England admin@enablingplace.co.uk 07350 859358

If you have any questions about this Privacy Notice or how we handle your data, please contact us using the details above.

What Personal Data We Collect

We only collect personal data that is necessary for the purposes described below. The types of data we may collect include:

  • Name

  • Email address

  • Phone number

  • Job title and organisation (if relevant to your enquiry or booking)

  • Emergency contact details and relevant medical information (for outdoor events where safety requires it)

  • Dietary requirements (for events where catering is provided)

  • Payment details (bank transfer reference; we do not store card numbers)

  • Correspondence (emails, messages, and form submissions)

We do not collect special category data (such as health information) unless it is directly relevant to your safety during an outdoor event, and only with your explicit consent.

How We Collect Your Data

  • Website forms — when you submit an enquiry via our Contact page or apply for a Netwalk

  • Direct correspondence — when you email or call us

  • Event registration — when you book a Day Challenge, Weekend Programme, or Expedition

  • DofE participation — when you take part in a Duke of Edinburgh expedition we are supervising

  • Professional consultancy — when you engage us for property or capital programme services

Why We Use Your Data (Lawful Basis)

We process your personal data under the following lawful bases:

PurposeLawful BasisExamplesResponding to enquiriesLegitimate interestsReplying to website form submissions, emails, or phone callsManaging event bookings and deliveryContractual necessityProcessing netwalk applications, organising Day Challenges and expeditions, managing safetyMaintaining client recordsContractual necessityDelivering consultancy services, issuing invoices, managing contractsSending relevant updatesConsentOccasional emails about upcoming netwalks or events (you can unsubscribe at any time)Safety managementLegal obligation and legitimate interestsCollecting emergency contact and medical information for outdoor eventsTax and accounting recordsLegal obligationRetaining invoices and payment records for HMRC compliance

Third Parties Who Process Your Data

We do not sell or share your personal data with third parties for marketing purposes. We do use the following services to operate our business:

ProviderWhat They DoData SharedSquarespaceHosts our website and processes form submissionsName, email, phone, and any information you submit via website formsProton MailProvides our encrypted email serviceName, email address, and correspondence contentYour bank / our bankProcesses payments for paid eventsPayment references only; we do not store card detailsDofE Licensed Organisation / AAPManages expedition records for supervised participantsParticipant names, emergency contacts, and expedition logs — shared only when required for DofE delivery

All third-party providers are based in or offer adequate safeguards for data processed under UK GDPR.

How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes described above:

Data TypeRetention PeriodReasonWebsite enquiry / netwalk application data12 months after last contactTo manage event attendance and follow-upClient consultancy records6 years after engagement endsTax, accounting, and legal complianceBooking and payment records6 yearsHMRC requirementsEvent safety data (emergency contacts, medical info)Duration of event plus 6 monthsRisk management and incident reportingDofE participant dataAs required by the DofE Licensed OrganisationDofE safeguarding requirementsMarketing consent dataUntil you unsubscribeRespect for your communication preferences

After these periods, data is securely deleted or anonymised.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access — you can ask for a copy of the personal data we hold about you

  • Right to rectification — you can ask us to correct inaccurate or incomplete data

  • Right to erasure — you can ask us to delete your data (subject to legal retention requirements)

  • Right to restrict processing — you can ask us to limit how we use your data

  • Right to data portability — you can request your data in a structured, machine-readable format

  • Right to object — you can object to us processing your data for legitimate interests

  • Right to withdraw consent — where we rely on consent, you can withdraw it at any time

To exercise any of these rights, please contact us at admin@enablingplace.co.uk

We will respond to your request within one calendar month. If we need more time, we will let you know and explain why.

Cookies

Our website uses essential cookies to function properly. Squarespace (our website platform) may also use analytics cookies to understand how visitors use the site. We do not use cookies for advertising or third-party tracking.

You can control cookies through your browser settings. Disabling some cookies may affect how the website functions.

Data Security

We take data security seriously. Our measures include:

  • Encrypted email — we use Proton Mail, which provides end-to-end encryption

  • Own data infrastructure — we do not rely on third-party marketing platforms or CRM tools that aggregate personal data

  • Dedicated data protection contact — admin@enablingplace.co.uk is monitored regularly for privacy-related enquiries

  • Access controls — personal data is only accessible to authorised personnel within the business

  • Secure payment handling — we do not store card details; payments are processed by bank transfer

International Transfers

We do not transfer your personal data outside the UK. Where any third-party provider processes data internationally (e.g., Squarespace), adequate safeguards are in place under UK GDPR provisions.

Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. We will update the date and version number at the top of this page when we do.

Right to Complain

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone: 0303 123 1113 Website: ico.org.uk

We would appreciate the opportunity to address any concerns directly before you approach the ICO.

Enabling Place Ltd | Cambridge, England admin@enablingplace.co.uk | 07350 859358