Privacy Policy

Version date: 12 August 2026

1. About this Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored and shared when you visit or interact with www.outdoorplayresearchcentre.co.uk (the “Website”) or otherwise engage with the Outdoor Play Research Centre project.

The Website forms part of a joint project between Connect Public Affairs Limited (“Connect”) and the University of Exeter (“the University”).

For the personal data covered by this Privacy Policy, Connect and the University jointly determine the purposes and means of processing and therefore act as joint data controllers under applicable UK data protection law.

This means that both organisations are responsible for ensuring that your personal data is handled lawfully, fairly and securely.

Connect manages the Website and may act as the principal point of contact for enquiries relating to information collected through it. However, you may exercise your data protection rights in relation to the relevant processing by contacting either Connect or the University.

This Privacy Policy should be read alongside any more specific privacy information provided when we collect personal data from you.

2. Who we are

Connect Public Affairs Limited

Connect Public Affairs Limited, trading as Connect, is a company registered in England and Wales with company number 03449749.

Registered office:

2 Manor Farm Court
Old Wolverton Road
Old Wolverton
Milton Keynes
MK12 5NN

Privacy enquiries may be sent to:

Email: gdpr@connectpa.co.uk

University of Exeter

The University of Exeter is a university incorporated by Royal Charter and is a joint project partner in relation to the Outdoor Play Research Centre.

Data protection enquiries for the University may be directed to:

Information Governance Team
Compliance and Risk
Lafrowda House
St German's Road
Exeter
EX4 6TL

Email: informationgovernance@exeter.ac.uk

Together, Connect and the University are referred to in this Privacy Policy as “we”, “us” or “our” where appropriate.

3. Our joint-controller arrangements

Connect and the University work together on the Outdoor Play Research Centre project and jointly determine how certain personal data collected in connection with the Website and project is used.

The organisations have arrangements in place to determine their respective responsibilities for complying with data protection law.

In broad terms, Connect is responsible for the day-to-day management of the Website and the collection and administration of information submitted through it. The University participates in determining how information collected for the project is used for the project’s agreed research, engagement, evaluation and related purposes.

Where appropriate, information may be shared between Connect and the University so that the project can be delivered and evaluated.

Regardless of these arrangements, you may contact either organisation about your personal data and your legal rights.

4. What personal data we collect

The personal data we collect depends on how you interact with the Website and the project.

We may collect the following categories of information:

Category and Examples

Identity information - Your name and, where relevant, title
Contact information - Email address, telephone number, postal address
Professional information - Employer, organisation, job title, professional role or sector
Enquiry and correspondence information- Information you provide when contacting us, responding to a consultation, completing a form or corresponding with the project
Research and project information - Responses, views, feedback, survey answers or other information provided as part of research, engagement or evaluation activity
Event information -Information provided when registering for or participating in project events
Technical information - IP address, browser type, device information and information about how you use the Website
Communications preferences -Your preferences regarding emails and other communications

We will only collect personal data that is relevant and reasonably necessary for the purpose for which it is being processed.

If we collect information that requires additional protection under data protection law, including special category personal data, we will explain this and the relevant basis for processing at the point of collection where required.

5. How we collect your personal data

We may collect personal data directly from you when you use the Website, complete a form, take part in a survey or research activity, register for an event, subscribe to communications, contact us by email or otherwise communicate with the project.

We may also receive information from project partners, organisations participating in the project, publicly available professional sources or other third parties where it is lawful and appropriate for us to do so.

Where personal data is obtained from another source rather than directly from you, we will provide appropriate privacy information as required by data protection law.

6. How we use your personal data

We may process your personal data to operate, administer and improve the Website; respond to enquiries and requests; manage your participation in the project; conduct research, consultation, engagement or evaluation activities associated with the Outdoor Play Research Centre; communicate with stakeholders and participants; organise events and activities; analyse the effectiveness and use of the Website and project; maintain appropriate administrative and project records; protect the security and integrity of our systems; comply with legal and regulatory obligations; and, where you have agreed or where otherwise permitted by law, send you relevant information about the project and related activities.

We will not use your personal data for purposes that are incompatible with the purposes for which it was originally collected unless permitted or required by law.

7. Our lawful bases for processing

Data protection law requires us to have a lawful basis whenever we process personal data. The basis that applies will depend on the particular activity.

Purpose and Likely lawful basis

Responding to enquiries and administering project participation - Legitimate interests and, where applicable, steps taken at your request
Operating and securing the Website - Legitimate interests and legal obligations where applicable
Research, evaluation and project activity - Legitimate interests and/or, where applicable to the University, processing necessary for a task carried out in the public interest
Sending optional marketing or promotional communications - Consent where consent is required
Organising paid services or events, where applicable - Performance of a contract
Keeping records required by law - Legal obligation

Where we rely on legitimate interests, we consider whether our interests are appropriate and balanced against your rights and interests.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect processing that took place before consent was withdrawn.

Additional information about the applicable lawful basis may be provided when your information is collected.

8. Research and project information

As the Website supports a project being undertaken jointly by Connect and the University of Exeter, information submitted through surveys, consultations, questionnaires, interviews, events or other engagement activities may be used for research, analysis and evaluation connected with the Outdoor Play Research Centre.

Where appropriate, results may be aggregated or anonymised for analysis, reporting, academic, policy or public-engagement purposes.

Where information is fully anonymised so that individuals can no longer be identified, it is no longer personal data for the purposes of data protection law.

If a particular research activity requires additional privacy information, you will be given an appropriate participant privacy notice or other information at the time your data is collected.

9. Children’s privacy

Unless specifically stated as part of a research activity, the Website is not directed at children and we do not knowingly collect personal data from children.

Where research activities involve children, appropriate participant information, safeguarding arrangements and consent procedures will be provided.

10. Who we share your personal data with

Personal data collected in connection with the project may be shared between Connect and the University of Exeter where necessary for the purposes described in this Privacy Policy.

We may also use third-party organisations that provide services such as website hosting, IT support, data storage, email distribution, customer or stakeholder relationship management, analytics, event administration and other technical or professional services.

These organisations are only permitted to process personal data in accordance with our instructions or another appropriate lawful basis, and appropriate data-protection arrangements will be put in place where required.

We may also disclose personal data where required by law, regulation, court order or a competent authority, or where necessary to establish, exercise or defend legal claims.

We do not sell or rent your personal data.

11. International transfers

Some of the organisations that provide services to us may process personal data outside the United Kingdom.

Where this amounts to a restricted international transfer under UK data protection law, we will ensure that an appropriate mechanism is in place to protect your personal data.

Depending on the circumstances, this may include transferring information to a country covered by applicable UK adequacy regulations or putting in place an approved safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission Standard Contractual Clauses, together with any additional measures required by law.

12. How long we keep your personal data

We will keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including any legal, accounting, research, reporting or regulatory requirements.

Different retention periods may apply to different categories of information.

In determining an appropriate retention period, we consider the nature and sensitivity of the information, the purposes for which it is processed, any legal or contractual requirements and whether those purposes can be achieved in another way.

Certain financial, contractual or legal records may need to be retained for a longer period where required or appropriate for legal and regulatory purposes.

Where personal data is no longer required, it will be securely deleted or anonymised.

13. Your data protection rights

Depending on the circumstances and the applicable legal requirements, you may have rights to request access to the personal data held about you; request correction of inaccurate or incomplete information; request deletion of your personal data; request restriction of processing; object to certain types of processing; request transfer of your information in a portable format; withdraw consent where processing is based on consent; and object to direct marketing.

Not every right applies in every circumstance, and some rights are subject to exemptions under data protection law.

Where you object to the use of your personal data for direct marketing, we will stop using it for that purpose.

Because Connect and the University act as joint controllers for the processing described in this Privacy Policy, you may exercise your rights by contacting either organisation.

To contact Connect, email gdpr@connectpa.co.uk.

To contact the University of Exeter about data protection, email informationgovernance@exeter.ac.uk.

14. Complaints

If you have concerns about how your personal data has been handled, we encourage you to contact Connect or the University of Exeter so that the issue can be investigated.

You also have the right to make a complaint to the UK Information Commissioner’s Office (“ICO”), the independent regulator responsible for data protection.

Further information is available from the ICO at ico.org.uk.

15. Security

We use appropriate technical and organisational security measures including:

Multi-factor authentication (MFA) where appropriate
Role-based access controls
Strong password controls
Endpoint protection and anti-malware software
Regular software patching and vulnerability management
Encryption of personal data in transit using TLS
Encryption of sensitive personal data at rest where appropriate
Secure backup procedures
Staff cyber security awareness training
Incident monitoring and logging

These measures are designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal data is restricted to people who require it for legitimate purposes and, where third-party service providers process information for us, appropriate contractual and security requirements are put in place.

Although we take appropriate steps to protect information, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

We maintain procedures for identifying, reporting and managing personal data breaches.

Where required by law, we will notify the Information Commissioner's Office and affected individuals without undue delay.

16. Cookies and Website information

The Website may use cookies and similar technologies to provide necessary Website functionality, understand how visitors use the Website and improve its performance and content.

Non-essential cookies are not deployed until consent has been obtained. Information collected through cookies and similar technologies may include IP address, browser and device information, pages visited, the time spent on pages, links followed and referring websites.

Further information about the cookies actually used on the Website, their purposes and how long they remain on your device should be provided through the Website's cookie notice or cookie-management tool.

You can also control cookies through your browser settings, although disabling certain cookies may affect the operation of the Website.

17. Links to other websites

The Website may contain links to websites operated by third parties.

If you follow a link to another website, that organisation will normally be responsible for how it collects and uses your personal data. We are not responsible for the privacy practices of third-party websites and encourage you to review their privacy information before providing personal data.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the project, the Website, our processing activities or applicable legal requirements.

Any updated version will be published on the Website and the version date will be updated.

Where a change materially affects how we use personal data, we will take appropriate steps to bring the change to the attention of affected individuals.

19. Contact us

For questions, requests or complaints concerning personal data processed through the Outdoor Play Research Centre project, you may contact either joint controller.

Connect Public Affairs Limited
2 Manor Farm Court
Old Wolverton Road
Old Wolverton
Milton Keynes MK12 5NN
Email: gdpr@connectpa.co.uk

University of Exeter – Information Governance Team
Compliance and Risk
Lafrowda House
St German's Road
Exeter EX4 6TL
Email: informationgovernance@exeter.ac.uk

You may also complain to the Information Commissioner’s Office if you are dissatisfied with the way your personal data has been handled.

Version date: 12 August 2026