← Back to Application

1. Who We Are

Data Processor: ProjectHindsight, operated by Chijioke Onwuka (Founder). Contact: privacy@projecthindsight.co.uk

Data Controller: Your organisation (e.g. Portsmouth Water) is the Data Controller for the project and lessons data entered into this platform. ProjectHindsight processes that data on your organisation's behalf under a Data Processing Agreement.

This platform is hosted on servers located in the United Kingdom (London region) in compliance with UK GDPR data residency requirements.

2. What Personal Data We Collect

Data Category	Specific Data	Why We Collect It
Account data	Name, work email address, department, job role	To create and manage your account
Authentication data	Hashed password (we never store your actual password), login timestamps	To verify your identity securely
Activity logs	Record of actions you take in the system (e.g. created lesson, searched projects) with timestamp	Security auditing and accountability
Usage data	IP address at login, browser type via standard web server logs	Security monitoring and fraud prevention
Content data	Lessons learned, project descriptions you create or contribute to	Core platform functionality — the organisational knowledge base

We do not collect: health or medical data, financial account details, biometric data, racial or ethnic origin, political opinions, religious beliefs, or any other special category data under UK GDPR Article 9.

3. How We Use Your Data

Purpose	Legal Basis (UK GDPR Art. 6)
Providing you access to the platform	Contract performance (Art. 6(1)(b))
Maintaining your account and preferences	Contract performance (Art. 6(1)(b))
Security monitoring and audit logging	Legitimate interests (Art. 6(1)(f)) — protecting the platform and your organisation's data
Complying with legal obligations (e.g. ICO requests)	Legal obligation (Art. 6(1)(c))

We do not use your data for marketing, advertising, or profiling. We do not sell or share your data with third parties for commercial purposes.

4. How Long We Keep Your Data

Data Type	Retention Period
Active user accounts	Duration of your organisation's contract with ProjectHindsight
Deactivated user accounts	12 months after deactivation, then permanently deleted
Activity (audit) logs	2 years, then deleted
Database backups	30 days rolling — older backups are automatically deleted
Project and lessons data	Duration of contract + 1 year, unless your organisation requests earlier deletion
Server access logs (nginx)	90 days

5. Who Can Access Your Data

• You — can view and edit your own account data at any time
• Your organisation's administrators — can view user accounts and audit logs within your organisation's workspace
• ProjectHindsight operations staff — limited access for platform support and maintenance, subject to confidentiality obligations
• No one else — we do not share personal data with third parties, advertisers, or data brokers

All data is stored in the UK. We do not transfer personal data outside the UK or EEA.

6. Security Measures

We implement the following technical and organisational measures to protect your data:

• All passwords are hashed using bcrypt with a unique salt — we cannot recover your password
• All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
• Database backups are encrypted using AES-256
• Role-based access control ensures users only see data they are authorised to access
• Login attempts are rate-limited to prevent brute force attacks
• All user actions are recorded in a tamper-evident audit log
• Platform hosted in a UK data centre with infrastructure-level encryption at rest

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of these rights, email privacy@projecthindsight.co.uk. We will respond within 30 days.

If you are unsatisfied with how we handle your request or your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

8. Cookies

ProjectHindsight uses no third-party cookies and no advertising or analytics cookies. The only data stored in your browser is your authentication token (localStorage), which is necessary for you to remain logged in. This token expires after 8 hours and is deleted when you log out.

9. Changes to This Notice

We will notify all users via the platform if we make material changes to this Privacy Notice. The "Last updated" date at the top of this page will always reflect when it was last revised. Continued use of the platform after notification constitutes acceptance of the updated notice.

10. Contact Us