Privacy Policy
Last updated: 31 July 2026
1. About this privacy policy
This privacy policy explains how Nodiculture Ltd collects, uses, stores and protects personal information when people:
visit our websites;
contact us or submit an enquiry;
express an interest in contributing to our research;
complete one of our research forms or surveys;
participate in an interview, call or other research activity; or
use services linked to or embedded within our websites.
This policy applies to:
forms, surveys and scheduling services linked from those websites
2. Who we are
Nodiculture Ltd is the controller responsible for the personal information described in this policy.
Our details are:
Legal name: Nodiculture Ltd
Trading name: Nodiculture
Company number: [INSERT COMPANY NUMBER]
Registered office: [INSERT REGISTERED OFFICE ADDRESS]
Privacy contact: hello@nodiculture.com
References in this policy to “Nodiculture”, “we”, “us” or “our” mean Nodiculture Ltd.
3. Information we collect
Depending on how you interact with us, we may collect the following information.
Contact and professional information
This may include your:
name;
email address;
telephone number;
location;
organisation or employer;
job title; and
professional background or area of experience.
Enquiry and expression-of-interest information
This may include:
information you include in an enquiry;
your interest in contributing to our research;
your suitability or availability for a particular research activity;
correspondence between you and Nodiculture; and
records of our interactions with you.
Research information
Where you contribute to our research, we may collect:
answers submitted through forms and surveys;
opinions, experiences and feedback provided during interviews or discussions;
interview or call recordings, where you have agreed to recording;
transcripts and written notes;
scheduling and participation information; and
records of your agreement to participate or to particular uses of your information.
We do not intend to collect special category information, such as information about health, ethnicity, religious beliefs, political opinions, trade-union membership or sexual orientation.
Please do not provide this type of information unless we have specifically requested it and explained why it is needed.
Website and technical information
When you visit our websites or use connected online services, we may collect technical information including:
your internet protocol address;
browser and device type;
operating system;
approximate location derived from your IP address;
pages viewed and links selected;
the date, time and duration of your visit;
referral information; and
cookie identifiers and similar technical information.
We collect this information through Squarespace and, where you have provided any required consent, services such as Google Analytics and Squarespace Analytics.
4. How we collect information
We collect personal information:
directly from you when you complete a form, survey or expression of interest;
when you contact us by email, telephone or another communication channel;
when you participate in an interview, call or research activity;
through Typeform, Google Forms, Calendly and other services used to administer our research;
automatically when you use our websites; and
from consultants or contractors working for us, where they have collected the information on our behalf.
5. How and why we use personal information
We use personal information for the following purposes.
Operating and protecting our websites
We use technical information to operate, maintain and secure our websites, identify errors and prevent misuse.
Our lawful basis is our legitimate interest in operating a secure and functional website.
Responding to enquiries
We use your contact information and the contents of your enquiry to respond to you and manage our communications.
Our lawful basis is our legitimate interest in responding to people who contact us and managing our business relationships.
Assessing expressions of interest
We use the information you provide to:
understand your background and experience;
determine whether you may be relevant to our research;
select potential research contributors; and
contact you about a possible interview, survey or discussion.
Our lawful basis is our legitimate interest in identifying and speaking to appropriate research contributors.
Submitting an expression of interest does not guarantee that you will be invited to participate in our research.
Conducting and administering research
We may use your information to:
arrange interviews, surveys and discussions;
manage your participation;
conduct research into relevant practices, needs, experiences and market conditions;
analyse research responses;
identify common themes and findings; and
develop and evaluate our research, services and business plans.
Our lawful basis is our legitimate interest in conducting research relevant to Nodiculture’s work and understanding the needs and experiences of potential users, customers, partners and other stakeholders.
Your agreement to take part in a particular research activity is separate from the lawful basis on which we process your personal information. We will explain the nature of the activity before you participate.
Recording interviews and producing transcripts
We will only record an interview or call after telling you that it will be recorded and obtaining your consent.
Recordings may be used to produce a transcript, check the accuracy of our notes and analyse the research discussion.
You can decline to be recorded and may withdraw your consent by contacting hello@nodiculture.com. Withdrawing consent will not affect processing that took place before your withdrawal.
Contacting you about future research
We may ask whether you would like us to retain your contact information and contact you about future research opportunities.
We will do this only where you have provided consent. You may withdraw your consent at any time by emailing hello@nodiculture.com.
We will not use this information to send general advertising or marketing communications unless we obtain separate permission to do so.
Using research findings
We may combine research responses to produce aggregated findings, summaries and internal reports.
We will not attribute a quotation, comment or finding to you by name, job title, organisation or other identifying information without obtaining your specific consent.
Where information has been irreversibly anonymised so that it can no longer identify you, it is no longer treated as personal information.
Meeting legal and regulatory obligations
We may process information where necessary to:
comply with a legal or regulatory obligation;
respond to a lawful request from a regulator, court or law-enforcement body;
protect our legal rights;
establish, exercise or defend legal claims; or
investigate a complaint or suspected misuse of our services.
Our lawful basis will be compliance with a legal obligation or our legitimate interest in protecting our organisation and legal rights, depending on the circumstances.
6. Our legitimate interests
Where we rely on legitimate interests, those interests may include:
responding to enquiries;
identifying suitable research contributors;
conducting relevant business and market research;
understanding stakeholder needs and experiences;
improving and developing our work;
administering our organisation;
protecting our websites and systems; and
establishing or protecting our legal rights.
We consider whether using your information is necessary for these purposes and balance our interests against your rights, interests and reasonable expectations.
You may object to processing based on legitimate interests by contacting hello@nodiculture.com.
7. Cookies and similar technologies
Our websites use cookies and similar technologies.
Some technologies are necessary for the websites to function, maintain security, remember privacy choices or enable forms and other requested services.
Subject to your cookie choices, we may also use analytics technologies to understand:
how visitors find our websites;
which pages are used;
how visitors interact with the websites; and
how we can improve website performance and content.
The services used on or in connection with our websites may include:
Squarespace Analytics;
Google Analytics;
Google reCAPTCHA;
Typeform;
Google Forms; and
Calendly.
Where consent is required, non-essential cookies and similar technologies will only be used after you have made an affirmative choice through our cookie controls.
You can change or withdraw your cookie preferences through the cookie settings available on our websites. You can also control cookies through your browser, although disabling certain cookies may affect how the websites work.
More detailed information about individual cookies, their providers, purposes and duration should be provided through our cookie settings or a separate cookie policy.
8. Who we share information with
We may share personal information with the following categories of recipient where necessary.
Employees
Relevant Nodiculture employees may access information where they need it to respond to enquiries, administer research or perform their roles.
Consultants and contractors
We may share information with consultants or contractors who support our research, website, technology, administration or professional activities.
They must only use personal information for the agreed purpose and must protect it appropriately.
Technology and service providers
We use service providers to host our websites, receive forms, communicate, schedule interviews, administer surveys and analyse website activity.
These providers may include:
Squarespace;
Google, including Google Workspace, Gmail, Google Analytics, Google Forms and reCAPTCHA;
Typeform; and
Calendly.
These organisations may process personal information on our behalf or, for certain aspects of their services, under their own privacy terms.
Professional advisers and authorities
We may disclose information to:
lawyers, accountants, insurers and other professional advisers;
regulators and public authorities;
courts and tribunals; and
law-enforcement bodies,
where reasonably necessary or legally required.
We do not sell personal information.
We do not share identifiable research submissions with Carbon13, academic institutions, potential investors or commercial partners unless we have told you in advance, have an appropriate lawful basis and, where necessary, have obtained your consent.
Research findings shared outside Nodiculture will be aggregated or otherwise presented without identifying individual participants, unless a participant has specifically agreed to be identified.
9. International transfers
Some of our technology providers operate internationally and may process or allow access to personal information from countries outside the United Kingdom.
Where personal information is transferred outside the UK, we take steps to ensure that the transfer is lawful and that an appropriate level of protection applies.
Depending on the destination and provider, these measures may include:
transferring information to a country covered by UK adequacy regulations;
using contractual safeguards approved for use under UK data protection law;
using the UK International Data Transfer Agreement or an approved UK Addendum; or
relying on another legally permitted transfer mechanism.
You can contact hello@nodiculture.com for further information about the safeguards relevant to your information.
10. How long we retain information
We retain personal information only for as long as it is reasonably needed for the purposes for which it was collected.
Our intended retention periods are:
General enquiries
We normally retain general enquiries and related correspondence for up to 24 months after the enquiry has been resolved or our last substantive contact with you.
We may retain certain records for longer where needed for legal, regulatory or record-keeping purposes.
Expressions of interest where the person is not selected
We normally retain unsuccessful expressions of interest for up to 12 months after making our decision.
Where you have separately agreed that we may contact you about future research, the future-research retention period below will apply instead.
Future research contacts
Where you have consented to being contacted about future research, we may retain your contact information for up to 24 months after your consent or our last substantive interaction with you.
At the end of that period, we will delete the information or ask whether you wish to remain on our research contact list.
Research participants and research responses
Information about selected participants, research responses, interview transcripts and research notes may normally be retained for up to three years after the relevant research project or workstream has ended.
Information may be deleted or anonymised earlier where it is no longer needed.
Audio or video recordings
Unless we explain and agree otherwise, recordings will normally be deleted within 90 days after an accurate transcript or research record has been produced and checked.
Consent and compliance records
Records demonstrating consent, withdrawals, privacy requests or data protection complaints may be retained for up to six years after the relevant matter has ended, where necessary to demonstrate compliance or establish, exercise or defend legal claims.
Anonymised and aggregated information
We may retain genuinely anonymised or aggregated research information for longer because it no longer identifies an individual.
We periodically review the information we hold and securely delete or anonymise it when it is no longer needed.
11. How we protect information
We use appropriate organisational and technical measures designed to protect personal information against:
unauthorised access;
accidental loss;
improper disclosure;
alteration;
destruction; and
other unlawful use.
These measures may include access controls, password protection, secure technology providers, limited internal access and confidentiality obligations.
No internet transmission or information-storage system can be guaranteed to be completely secure. You should take care when deciding what information to provide online.
12. Your data protection rights
Depending on the circumstances, you may have the right to:
ask for confirmation of whether we process your personal information;
request access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to delete your information;
ask us to restrict how we use your information;
object to processing based on legitimate interests;
receive certain information in a portable format;
ask us to transfer certain information to another organisation; and
withdraw consent where our processing relies on consent.
These rights are not absolute and may not apply in every circumstance.
You will not normally be required to pay a fee to exercise your rights. We may need to ask for information to confirm your identity before responding.
To exercise your rights, contact hello@nodiculture.com.
13. Data protection complaints
You may raise a complaint about how we have handled your personal information by emailing:
Please provide enough information for us to understand and investigate your concern.
We will acknowledge receipt of a data protection complaint within 30 days, investigate it appropriately, keep you informed where necessary and explain the outcome.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator responsible for data protection.
We would appreciate the opportunity to address your concern directly before you approach the Information Commissioner’s Office, although you are not required to contact us first.
14. Automated decision-making
We do not use personal information collected through the websites to make decisions about people solely through automated processing where those decisions have legal or similarly significant effects.
Decisions about whether to invite someone to participate in research will involve human assessment.
15. Adults only
Our expressions of interest and research activities are intended for people aged 18 or over.
People under 18 should not submit personal information through our forms or participate in our research.
If we learn that we have unintentionally collected personal information from someone under 18, we will take reasonable steps to delete it.
16. Third-party websites and services
Our websites may contain links to third-party websites or services.
Where you follow an external link, the third party may collect and use information under its own privacy policy. We are not responsible for independent third-party websites that are not operated on our behalf.
Services such as Typeform, Google Forms and Calendly may be used as part of our data-collection and scheduling processes. This policy explains how Nodiculture uses information obtained through those services.
17. Changes to this policy
We may update this privacy policy to reflect changes to our activities, technology, service providers or legal obligations.
The latest version will be published on our websites and the date at the top of the policy will be updated.
Where a change materially affects how we use information already collected, we will take reasonable steps to bring the change to the attention of affected individuals.
18. Contact us
Questions, privacy requests and data protection complaints should be sent to:
Nodiculture Ltd
[INSERT REGISTERED OFFICE ADDRESS]
Email: hello@nodiculture.com