Privacy Policy

Version 1.0 · Last updated: 27 July 2026

Hendexa ("Hendexa", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect personal data about visitors to hendexa.com, prospective and existing clients, partners, mentors, volunteers, and anyone who contacts us. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are & how to contact us

Hendexa is a UK-based educational organisation providing academic guidance, workshops, mentoring, and training. For questions about this policy or your personal data, or to exercise any of the rights described in section 8:

• Email: privacy@hendexa.org
• Post: (to be added on incorporation)

We are the data controller for the personal data described in this policy — meaning we decide what data is collected and how it is used.

2. What personal data we collect

We collect only the data we need. Depending on how you interact with us, this may include:

a) Data you give us directly

• Contact form submissions — your name, email address, the topic you selected ("I'm interested in…"), and your message.
• Newsletter subscriptions — your email address, and the fact you have subscribed.
• Client engagement data — information relevant to delivering a service (for example, drafts of essays, applications, or research plans you share with a Hendexa mentor).
• Correspondence — any messages you send us by email or via our forms, and our replies.

b) Data collected automatically when you visit our site

• Server access logs — collected by our hosting provider (Vercel). These typically include IP address, browser type, referring page, and timestamp. Logs are retained for a short period for operational security and abuse prevention.
• Font loading — the site loads Montserrat and JetBrains Mono from Google Fonts. Google may receive your IP address when your browser fetches these files. See Google's privacy policy for details.
• Contact form metadata — when you submit the contact form, we also record the submission timestamp, IP address, and user-agent string alongside the submission, purely for abuse prevention and record-keeping.

c) Data we don't currently collect

• We do not use third-party analytics (e.g. Google Analytics) at this time. If we add analytics in future, we will obtain your consent first and update this policy.
• We do not use advertising cookies or tracking pixels.
• The help chatbot on our site runs entirely in your browser. No chat messages, questions, or answers leave your device. See section 10.

3. How and why we use your data

4. Our legal bases (UK GDPR)

We only process personal data where we have a lawful basis under UK GDPR:

• Consent (Art. 6(1)(a)) — for newsletter subscriptions, and where you actively opt in to something.
• Contract (Art. 6(1)(b)) — to deliver services you have engaged us to provide, and to respond to your requests.
• Legitimate interests (Art. 6(1)(f)) — to operate and secure our website, prevent fraud and abuse, and improve our services in ways you would reasonably expect. You have the right to object (see section 8).
• Legal obligation (Art. 6(1)(c)) — where processing is required by UK law.

5. Who we share your data with

We do not sell your personal data and do not share it for advertising. We share it only with trusted third parties who help us operate — each of whom is bound by data-processing agreements and is chosen for its security and compliance posture.

We may also disclose personal data if we are required to do so by law, court order, or regulatory authority, or where necessary to protect our rights, property, or safety, or that of our clients or others.

6. International transfers

Some of our processors are based in the United States or process data in multiple regions. Where personal data is transferred outside the UK, we rely on appropriate safeguards, including the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent mechanism approved under UK data-protection law.

7. How long we keep your data

• Contact-form submissions — the backup copy in our Redis store is limited to the most recent 500 submissions (older entries are automatically removed). Email copies in our inbox are retained for up to 24 months unless we need to keep them longer to deliver a service or respond to a complaint.
• Newsletter subscriptions — retained until you unsubscribe, plus a short grace period.
• Client engagement records — retained for the length of the engagement plus up to 6 years, in line with UK contractual, tax, and record-keeping norms.
• Server access logs — retained by Vercel per their standard retention (typically short-term).

8. Your rights

Under UK GDPR, you have the right to:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure ("right to be forgotten") in certain circumstances.
• Restrict or object to processing in certain circumstances.
• Request data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Not to be subject to a solely automated decision producing legal or similarly significant effects. (We do not carry out such automated decision-making.)

To exercise any of these rights, email privacy@hendexa.org. We will respond within one calendar month.

9. Cookies & local storage

We aim to keep our use of cookies and similar technologies minimal. The Hendexa site currently uses:

See our Cookie Policy for full detail. We will update this section and obtain your consent before setting any non-essential cookies.

10. The Hendexa help chatbot

Our on-site help chatbot ("Ask Hendexa") is designed with privacy as a first principle:

If you use a link the chatbot suggests (for example, to open the contact form), and you then submit that form, the normal contact-form processing described in this policy applies.

11. Security

We take appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (HTTPS/TLS) for all traffic to and from our site.
• Server-side validation, rate-limiting, and honeypot filtering on forms.
• Access controls on the systems that store personal data.
• Use of reputable, compliance-oriented processors (see section 5).

No system is perfectly secure, and we cannot guarantee absolute security — but we work continuously to keep your data safe.

12. Children

Some of our services are aimed at students aged 15 and above. Where a service involves someone under 18, we ask that a parent, guardian, or school arrange the engagement on their behalf and consent to any data processing. We do not knowingly collect personal data directly from children under the age of 13.

13. Changes to this policy

We may update this Privacy Policy from time to time — for example, if we add a new service, change a processor, or respond to changes in the law. Material changes will be highlighted on this page with a revised "Last updated" date. Where the change is significant, we may also notify you directly where we have your contact details.

14. Complaints

If you are concerned about how we have handled your personal data, please contact us first at privacy@hendexa.org and we will do our best to resolve it. You also have the right to complain to the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Data controller

Hendexa
United Kingdom
Privacy contact: privacy@hendexa.org
General contact: hello@hendexa.org

Company registered name and number will be added on formal incorporation.