Privacy policy

1. Who we are

This website is run by Nadia Abudulkadir, trading as Progress & Purpose, a sole trader and SEND education consultant registered with HMRC as self-employed. For the purposes of UK data protection law, Nadia Abudulkadir is the "data controller" for the personal data this site collects — the person responsible for deciding how and why it's used.

Contact address: [ADDRESS]
Contact email: [CONTACT EMAIL]

This business is entirely separate from any other organisation Nadia Abudulkadir is involved with. Nothing on this page, or anywhere else on this site, applies to or is shared with any other organisation.

2. What personal data is collected, and why

Enquiry form. The contact form asks for your name, email address, organisation, role and message, and optionally which package you're asking about. This is used only to reply to your enquiry, and to keep a record of the conversation if it leads to further work.

Buying a digital resource. Payment for digital resources is taken on a page hosted by [PAYMENT PROCESSOR — e.g. Stripe or Payhip, to be confirmed], not on this site. That means your name, email address and billing details (such as card details) are collected and stored by [PAYMENT PROCESSOR] directly, under its own privacy policy, and are never entered into or stored on this website. Nadia Abudulkadir receives confirmation that an order was placed and the buyer's name and email address, so the resource can be delivered and any support queries handled.

Newsletter or mailing list. The Parent and Carer Guide on the Resources page is planned to be offered in exchange for signing up to a mailing list, but that sign-up isn't switched on yet — no email address is currently collected for marketing purposes anywhere on this site. Once it is, this section will be updated first, to name the mailing list provider used, explain what's collected and why, and describe how to unsubscribe at any time.

Website analytics. Analytics are not currently switched on for this site. If they are turned on in future, this site is set up to use Plausible, a privacy-friendly, cookie-free analytics tool, and visitors will be asked first via an on-page banner. This section will be updated to reflect that change when it happens.

3. Our legal basis for using your data

Under UK GDPR, personal data can only be used if there's a valid legal reason. Here's the reason for each use above:

• Enquiry form: legitimate interests — responding to a business enquiry you've chosen to send — and, where it leads towards a contract for services, to take the steps needed to set that up.
• Buying a resource: performance of a contract — to deliver what you've paid for — and, for records kept afterwards, a legal obligation to keep accounting and tax records.
• Newsletter (if added later): consent, given by you when you sign up, which you can withdraw at any time.
• Analytics (if switched on): legitimate interests — understanding which pages are useful, using a tool designed to have as little impact on your privacy as reasonably possible.

4. How long data is kept

Enquiries that don't lead to further work are normally kept for up to 12 months, then deleted. Records connected to a paid order — including invoices and correspondence — are normally kept for 6 years, in line with HMRC's record-keeping requirements for a self-employed sole trader. You can ask for enquiry details to be deleted sooner; see "Your rights" below.

5. Who data is shared with

Personal data is shared only with the services that are needed to run this site and deliver what you've asked for:

• Netlify Forms — receives and stores enquiry form submissions, so they can be read and replied to.
• [PAYMENT PROCESSOR — e.g. Stripe or Payhip, to be confirmed] — handles payment and billing details for digital resources, and tells Nadia Abudulkadir that an order was placed.
• [HOSTING PROVIDER — e.g. Netlify or Cloudflare Pages, to be confirmed] — hosts this website and, as with any web server, keeps basic technical logs (such as IP address and page requested) for security and reliability.
• Plausible — if analytics are switched on (see above), processes anonymous visit statistics only.

Your data is never sold, and it is never shared with anyone else for their own marketing purposes.

6. Cookies

This site does not set any cookies for tracking or advertising. Analytics are currently switched off, so nothing is stored on your device for that purpose either. If that changes, you'll be asked first via an on-page banner, and this section will be updated. There is no separate cookie policy at this time, because there is nothing beyond what's described here to explain.

7. Keeping data secure

Reasonable technical and organisational steps are taken to protect personal data, including: sending the site itself only over an encrypted (HTTPS) connection; keeping access to the enquiry form and order records limited to Nadia Abudulkadir; and relying on established providers (named above) for payment and hosting, who maintain their own security standards. No method of storing or sending data online is completely without risk, but reasonable care is taken to reduce that risk.

8. International transfers

This site and its hosting are intended to operate within the UK and EU. If the payment processor chosen above is based outside the UK (for example, in the United States), your billing details may be processed there; providers such as Stripe and Payhip commit to recognised safeguards (such as the UK's International Data Transfer Agreement or Standard Contractual Clauses) for that. Once the payment processor is confirmed, this section will be updated to say plainly whether this applies.

9. Your rights

Under UK GDPR, you have the right to:

• ask for a copy of the personal data held about you (right of access);
• ask for it to be corrected if it's wrong (rectification);
• ask for it to be deleted, in some circumstances (erasure);
• ask for its use to be limited, in some circumstances (restriction);
• object to it being used, in some circumstances (objection); and
• ask for a copy in a format you can reuse elsewhere (portability), where that applies.

To use any of these rights, contact Nadia Abudulkadir at [CONTACT EMAIL]. If you're unhappy with how your data has been handled, you can also complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk (opens in a new tab).

10. Children's data

This site and its services are aimed at professionals and other adults working in schools, colleges and local authorities — not at children. It is not marketed to children, and no personal data is knowingly collected from children.

11. Changes to this policy

This policy may be updated from time to time, particularly if the tools or services this site uses change. The date at the top of this page shows when it was last updated. Significant changes will be reflected here; there is no separate notification list to update, since none exists.

12. Contact us

Questions or complaints about how personal data is used on this site can be sent to Nadia Abudulkadir at [CONTACT EMAIL], or by post to [ADDRESS].