1. Introduction
NourifyMe respects your privacy and is committed to handling personal information fairly, lawfully and transparently. This Privacy Policy explains how we process personal information when you visit nourifyme.co.uk, contact us or register your interest in becoming a Founding Member.
This policy is intended to provide the information required by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK privacy and electronic communications laws.
2. Who controls your information
Nourify Ltd, trading as NourifyMe, is the controller responsible for the personal information described in this policy. This means we decide why and how that information is used.
You can contact us about privacy or data protection at contact@nourifyme.co.uk.
3. Scope of this policy
This policy currently covers:
- the public NourifyMe website;
- Founding Member interest registrations;
- emails and other direct enquiries sent to NourifyMe;
- optional NourifyMe news and development updates; and
- security, fraud prevention and technical operation of the website.
NourifyMe is currently in development and is not presently taking payments or selling products or services through this website. If we introduce accounts, community features, purchases, deliveries, subscriptions or additional tracking technologies, we will update this policy before or when those activities begin.
4. Information we collect
Information you provide
Depending on how you interact with us, this may include:
- your first name and email address;
- your stated areas of interest;
- the type of device you expect to use;
- your optional explanation of why you would like to join;
- your acknowledgements and communication preferences;
- the contents of emails or enquiries you send us; and
- records of our communications with you.
Technical and security information
When you use the website, our hosting and security providers may process technical information such as your IP address, browser and device information, request timestamps, security signals, page or endpoint requested, and limited diagnostic logs. This information is used to deliver the website, maintain reliability and identify automated, abusive or malicious activity.
Special category information
We do not ask you to provide health information, diagnoses or other special category personal information through the Founding Member form. The form specifically asks users not to include sensitive medical information.
If you nevertheless send sensitive information voluntarily, we will minimise, redact or delete it where reasonably possible and will not use it for a new purpose unless we have both a lawful basis and an applicable condition under data protection law.
5. How we collect information
We collect personal information:
- directly from you when you complete a form or contact us;
- automatically through essential website hosting, security and logging systems; and
- from service providers acting on our instructions when they deliver the website or process a submission.
We do not currently purchase personal information, obtain contact lists from data brokers or combine Founding Member data with advertising profiles.
6. How and why we use your information
UK data protection law requires us to identify a lawful basis for each use of personal information. The bases that currently apply are set out below.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Receive, review and manage Founding Member applications | Contact details, interests, device type, application responses and acknowledgements | Our legitimate interests in developing and testing NourifyMe with suitable volunteers |
| Contact applicants about their application, testing availability or operational information | Name, email address, application status and relevant communications | Our legitimate interests in administering the programme and responding to the person's request |
| Respond to enquiries and maintain appropriate correspondence records | Contact details and message contents | Our legitimate interests in communicating with users and operating the business; steps requested before entering a contract where relevant |
| Send optional NourifyMe news and development updates | Name, email address, consent record and communication preferences | Consent |
| Protect the website, prevent spam and investigate misuse | Technical logs, IP address, security signals, form metadata and honeypot results | Our legitimate interests in securing the website and preventing fraud or abuse |
| Comply with legal duties and establish, exercise or defend legal claims | Relevant application, communication, consent and technical records | Legal obligation and/or our legitimate interests in protecting our legal rights |
The required privacy checkbox on the Founding Member form confirms that you have read the relevant privacy information. It is not the lawful basis for the core administration of your application. The optional marketing checkbox is separate and is used to record consent for promotional or development updates.
Where we rely on legitimate interests, we consider the purpose, necessity and likely effect on your rights. You may object to processing based on legitimate interests as explained in section 13.
7. Marketing communications
We will send optional NourifyMe news or development updates by email only where you have actively chosen to receive them, or where another lawful route is available and permitted by UK law. At present, the Founding Member form uses an unticked optional consent box.
You may withdraw consent at any time by using the unsubscribe option in an email or contacting contact@nourifyme.co.uk. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.
We may retain a minimal suppression record, such as your email address and opt-out date, to ensure we respect your choice and do not add you back to the same mailing activity by mistake.
8. Cloudflare Turnstile
We use Cloudflare Turnstile on the Founding Member form to help distinguish genuine users from automated submissions. Turnstile may process technical and interaction information, including IP address, browser or device characteristics and security signals, to provide a verification result.
The result and token are used only to validate the submission. NourifyMe does not use Turnstile to build advertising profiles. Cloudflare processes information under its own privacy terms and, where it acts for us, under applicable data-processing safeguards.
Turnstile and closely related storage are treated as necessary for protecting the form and website. More information will be set out in our Cookie Policy.
9. Who we share information with
We do not sell or rent personal information. We disclose it only where needed for the purposes described in this policy, including to the following categories of recipient:
- Cloudflare, which provides website delivery, security, Workers and Turnstile services;
- Google service infrastructure, including Google Apps Script and Google Sheets, used to receive and store Founding Member submission records;
- professional advisers, insurers, auditors or IT support providers where access is reasonably necessary and subject to suitable duties;
- regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law; and
- a buyer, investor or successor organisation if Nourify Ltd is restructured, sold or transferred, subject to confidentiality and data-protection requirements.
Service providers may use personal information only to deliver their contracted services, meet legal obligations and maintain security. We seek to limit access to people and systems that need it.
10. International transfers
Some providers supporting the website operate internationally, so personal information may be processed outside the United Kingdom. Where a destination is not recognised by the UK as providing an adequate level of protection, we require an appropriate transfer mechanism where applicable, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard.
Providers may also rely on an applicable UK adequacy regulation. You may contact us for further information about the safeguards relevant to your information.
11. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose collected, including legal, accounting, security and dispute-resolution needs. Our current working periods are:
- Founding Member applications: normally up to 12 months after submission where no invitation or ongoing relationship develops;
- invited testers and related correspondence: for the testing relationship and normally up to 24 months afterwards;
- general enquiries: normally up to 24 months after the enquiry is resolved;
- marketing records: until consent is withdrawn, the address becomes invalid or we determine the list is no longer active;
- suppression records: as long as reasonably necessary to honour an opt-out; and
- technical and security logs: generally for a short operational period, commonly between 30 and 90 days, unless an incident requires longer preservation.
We may keep a record longer where required by law, necessary for a live complaint or legal claim, or justified by a documented security investigation. Information may also be anonymised so it can no longer identify an individual; genuinely anonymised data is not personal information.
12. How we protect information
We use proportionate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or access. These measures include restricted access, account security, encrypted network connections, service-provider controls, anti-automation checks and review of access where appropriate.
No online system can be guaranteed completely secure. You should avoid sending unnecessary sensitive information by email or through website forms. If we identify a personal-data breach, we will assess it and notify affected people and the Information Commissioner's Office where required by law.
13. Your data protection rights
Depending on the circumstances, UK data protection law may give you the right to:
- ask whether we use your personal information and receive a copy;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information in certain circumstances;
- ask us to restrict how information is used in certain circumstances;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- withdraw consent where processing relies on consent;
- receive information you provided in a portable format where the legal conditions apply; and
- not be subject to certain solely automated decisions with legal or similarly significant effects.
These rights are not absolute and exemptions may apply. To make a request, email contact@nourifyme.co.uk. Please describe what you need clearly. We may request information reasonably necessary to confirm your identity and protect your data.
We normally respond within one month. The law permits an extension for complex or numerous requests, in which case we will explain the delay. We do not usually charge a fee, although the law allows a reasonable fee or refusal where a request is manifestly unfounded or excessive.
14. Children's privacy
The current Founding Member testing registration is intended for people aged 18 or over. We do not knowingly invite children to submit the form or provide personal information through it.
The public educational website may be viewed by younger people, but it does not currently provide child accounts or personalised services. If we learn that a child has submitted personal information without an appropriate lawful basis or authorisation, we will take reasonable steps to delete it.
If future NourifyMe services are likely to be accessed by children, we will assess the Children's Code, complete any required data protection impact assessment and provide age-appropriate privacy information and safeguards before launching those features.
15. Automated decisions and profiling
We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects. Turnstile produces an automated security verification, but it is used to protect the form rather than to evaluate your suitability as a Founding Member.
Founding Member applications may be reviewed and prioritised based on practical testing needs, such as device coverage and stated interests. Selection is not guaranteed and is not currently made solely by an automated system.
16. Third-party links
The website may link to external websites or services that we do not control. Their privacy practices are governed by their own notices. You should review those notices before providing personal information to them.
17. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The latest version will be published on this page with a revised effective date. Where a change materially affects how we use information already collected, we will provide an additional notice or seek fresh consent where required.
18. Contact and complaints
Questions, concerns and rights requests can be sent to:
Nourify Ltd, trading as NourifyMe
Email:
contact@nourifyme.co.uk
Company number: 16819542
We would appreciate the opportunity to resolve a concern directly. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator. Current complaint routes and contact details are available on the ICO's official website.