Privacy Policy


Enterprise Nation Ltd is a company registered in England and Wales (company number 04676798) whose registered office is at Column House, London Road, Shrewsbury, Shropshire, SY2 6NN. References to we, us and our means Enterprise Nation Ltd. We are registered with the Information Commissioners Office with reference number ZA299265.

We are working with Brunel University London, a Royal Charter company (company number RC000079) (Brunel), as part of a collaborative research project called “HeadsUp!” which looks at boosting the performance of small businesses by adopting digital technologies in order to increase company productivity (the Project). The Project will be delivered by engaging small businesses to take part in certain training sessions and activities (Training) and the results will be measured by changes in revenue, output and employee satisfaction. The Project will assess whether online training in digital business tools increases cloud-based service take-up and productivity for micro businesses, when compared with off-line workshops. When taking part in the Project, for the purposes of the data protection legislation, we act as a joint controller together with Brunel. Brunel is registered with the Information Commissioners Office with reference number Z6640381.

This privacy policy describes the ways we capture your personal information and governs what we will do with it. We want to be upfront about the information we collect, how we use it, who we share it with and the choices we give you to control, access and update your information.

Please read this privacy policy carefully. We may occasionally amend this privacy policy to reflect regulatory requirements and changes in our information collection and disclosure practices.

Questions, comments and requests regarding this privacy policy are welcome and should be emailed to us at [email protected]


We ensure that your privacy is respected at all times and our primary goal is to improve upon and make sure our services and messaging are relevant for all our users, while also ensuring that personal information of all users is respected and protected.

This policy explains what personal information we collect when you apply to and/or take part in the Project.

To learn more about the information we collect and how we use your personal information once you have been accepted onto the Project, please read APPENDIX 1: (Participants).


We collect the majority of your personal information directly from you, via our website. However, we may also collect personal information from cookies on our website – for more information on our use of cookies, please see the section on cookies, below.


This privacy policy applies to the personal information we collect about you through our website by telephone, in person, or when you otherwise communicate with us. In particular, we collect your:

  • Business information: this includes the name of your business, how many full-time employees you have, the location of your business, the company registration number, VAT registration number and/or the company unique tax payer number and the sector or industry in which it operates. We will allocate each business a unique identification number.

We will independently collect the following:

  • Contact details: this includes your full name, email address and contact telephone number.
  • Marketing and communications data: this includes your preferences in receiving marketing from us and our third parties and your communication preferences.
  • Usage information: this includes which webpages you visit, what you click on, when you perform those actions, what language preference you have, and so on. All usage data is anonymous and will never contain your contact details.
  • Device and browser data: we collect information from the device and application you use to access our website. Device data mainly means your IP address, operating system version, device type, system and performance information, and browser type. If you are on a mobile device we also collect the UUID for that device. All data relating to your device and browser is anonymous and will never contain your contact details.
  • Log files: our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, device type and timestamps. All log data is anonymous and will never contain your contact details.
  • Information from page tags: we use third-party tracking services that employ cookies and page tags to collect data about visitors to our websites. This data includes usage and user statistics. Emails sent by us or by users through our services include page tags that allow the sender to collect information about who opened those emails and clicked on links in them.
  • Information from third parties and integration partners: our website connects directly with third-party websites so that we can better understand the use of our website, and to show you relevant content, including ads.


We must have a legal basis for processing your personal information. We consider that we have a legal basis where:

  • you have given us your consent for the specific purposes we have told you about;
  • we are pursuing our legitimate interests;
  • it is necessary for us to do so to enable us to provide you with the services you have requested from us (e.g. to participate in the Project); and/or
  • the law otherwise permits or requires it.

Category of personal data

Purpose for processing

Relevant Controller

Legal basis under the DPA 2018

Contact details

We use your contact details:

·     to contact you to tell you whether or not you have been accepted onto the Project; for analytical and statistical purposes; and

·     where you have consented to direct marketing to you about other services Enterprise Nation provides.

Enterprise Nation

Legitimate Interests



Business information

We use your business information to determine whether or not to accept you onto the Project and we use the unique business identification number to ensure that we do not receive duplicate applications.

Enterprise Nation and Brunel


Usage information


We collect information about the types of content you engage with so we can direct you to other relevant features and services we offer.

Enterprise Nation

Legitimate interests

Device and browser data

We use device and browser data to troubleshoot problems with our website and to make improvements to it, or to customise the interface for that device. We also infer your geographic location based on your IP address for abuse and tax purposes.

Enterprise Nation

Legitimate interests

Legal requirement

Log data

We use log data for many different business purposes, including:

·     monitoring abuse and troubleshooting;

·     tracking behaviour at the aggregate/ anonymous level to identify and understand trends in the various interactions with our website; and

·     fixing bugs and troubleshooting functionality.

Enterprise Nation

Legitimate interests

Information from page tags

We collect information from page tags to enable us to:

·     understand our users’ behaviour; and

·     determine the success of our advertising campaigns.

Enterprise Nation

Legitimate interests

Third parties and integrations

We collect and use information from third parties and integration partners to:

·     ensure you can sign-up to the Project from a third-party integration; and

·     ensure you can use our website in conjunction with other services.

Enterprise Nation

Legitimate interests


Our website uses cookies. Cookies are pieces of code that allow small amounts of information to be passed from your internet browser to our web server. We use third-party cookies, serving several purposes. All data passed by cookies will only ever contain your IP address (if accessing the site on a computer) or UUID (if accessing the site on a mobile device) and will never contain your contact details.

They enable us to:

  • estimate our audience size and usage pattern;
  • speed up your searches;
  • recognise you when you return to our site; and
  • send you targeted advertising.

If you do not want to accept cookies, you can change your browser settings so that cookies are not accepted. If you do this, please be aware that you may lose some functionality of the website. For further information about cookies and how to disable them please go to: or

Managing Advertising Cookies

Please note that if you want to opt out from receiving targeted advertising, this does not mean that you will receive less advertising as you browse the web. This just means that the advertising you see will not be customised for you.

You can opt out of third-party advertising cookies by visiting the Interactive Advertising Bureau's website:


We may share your personal information with trusted third-parties who help us provide certain aspects of our services. In particular, we engage third-parties to:

  • facilitate the sending of any email;
  • help us track website conversion success metrics;
  • manage our customer support services to you; and
  • log any errors and issues with our website.

We also have to share information or data in order to:

  • meet any applicable law, regulation, legal process or enforceable governmental request;
  • enforce applicable policies, including investigation of potential violations;
  • detect, prevent, or otherwise address fraud, security or technical issues; and/or
  • protect against harm to the rights, property or safety of our users, the public or to us and/or as required or permitted by law.

We will not transfer your personal data outside of the European Economic Area or to any organisation (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.

If you would like further information about who we share your personal information with, please contact us.


We will keep your personal information for no longer than is necessary for the purposes for which it was obtained. The criteria for determining the duration for which we will retain your personal information is as follows:

  1. We will retain your personal information in a form that permits identification only for as long as:
  2. we maintain an ongoing relationship with you; or
  3. your personal information is necessary in connection with the lawful purposes set out in this privacy policy for which we have a valid legal basis;
  4. The duration of:
  5. any applicable limitation period under applicable law (i.e. any period during which any person could bring a legal claim against us in connection with your personal information, or to which your personal data may be relevant); or
  6. an additional reasonable period following the end of such applicable limitation period;
  7. If any relevant legal claims are brought, we may continue to process your personal data for such additional periods as are necessary in connection with that claim.

During the periods specified in paragraphs 2a and 2b above, we will restrict our processing of your personal information to the storage of, and maintaining the security of, that data, except to the extent that data needs to be reviewed in connection with any legal claim or obligation under applicable law.

After this period your personal information will be anonymised so that you are no longer identified or identifiable from such information, or securely deleted/destroyed.

We may retain personal information about you for statistical purposes. Where data is retained for statistical purposes it will always be anonymised, meaning that you will not be identifiable from that data.


We have strict internal guidelines as well as advanced technology and security features to safeguard your personal information from unauthorised access or improper use.

We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit Get Safe Online is supported by HM Government and leading businesses.


This section explains how we will ensure that you only receive communications that you wish to receive.

Marketing communications:

We can only use your personal information to send you marketing messages if we have either your consent or it is a ‘legitimate interest’. A ‘legitimate interest’ is when we have a business or commercial reason to use your information. It must not unfairly go against what is right and best for you.

The personal information we have for you is made up of what you tell us, and the data we collect about you when you use our services, or data provided to us from third parties we work with. We study this to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

We want to ensure that you are informed and aware of the best products, services, promotions and events that we can offer you. By consenting to receive additional communications (by post, telephone, or email) from us and any named third parties that feature at the point of obtaining consent in respect of such information, we will process your personal data in accordance with this privacy policy. 

If you have provided your consent to receive marketing communications from us and you change your mind, you can change your preferences and unsubscribe at any time by unsubscribing from the relevant communication channel or by contacting us at [email protected]. If you choose not to receive this information, we will be unable to keep you informed of new products, services and promotions that may interest you.

Whatever you choose, you'll still receive confirmations relating to the Project and other important information, for example venue details for Training.

Service communications:

We may send you communications such as those which relate to any service updates (e.g. appointment confirmations) or provide customer satisfaction surveys. We consider that we can lawfully send these communications to you as we have a legitimate interest to do so, namely to effectively provide you with the best service we can and to grow our business.


Under the Data Protection Act 2018, you have a number of important rights available to you for free. In summary, those include rights to:

  • be informed about how your personal information is being used (hopefully this privacy policy explains this);
  • access the personal information we hold about you;
  • request that we port elements of your data to another service provider;
  • request us to correct any mistakes in your information which we hold;
  • request the erasure of personal information concerning you in certain situations;
  • receive the personal information concerning you which you have provided to us, in a structured format;
  • stop any direct marketing which you can do through your account or the unsubscribe link at the bottom of emails; and
  • object to decisions being taken by automated means concerning you or that significantly affect you.

For further information on each of these rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the Data Protection Act 2018.

If you would like to exercise any of these rights, please:

  • email us at [email protected];
  • let us have information to identify you;
  • let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill); and
  • let us know the information to which your request relates.


We hope that we can resolve any query or concern you raise about our use of your information. If you are not happy with how we manage your personal data, you have the right to lodge a complaint with a supervisory authority. The supervisory authority in the UK is the Information Commissioner who may be contacted at


This privacy policy was published on 18/03/19 and last updated on 18/03/19.

Any changes we make to this notice will be posted on this page. You will be notified of any material changes.


Please contact us if you have any questions about this privacy policy or the information we hold about you.

If you wish to contact us please send an email to [email protected].





If you meet the applicable eligibility criteria set out in our Terms and Conditions, you may be accepted to participate in the Project. Once you have been accepted, you will be required to register for an account through using your contact information. You will also be required to provide information relating to the business you work for. We will use your personal information to enrol you onto the Project and provide Training to you. This page sets out how we acting jointly with Brunel, process your personal information once you have been enrolled.


We must have a legal basis for processing your personal information. We consider that we have a legal basis where:

  • you have given us your consent for the specific purposes we have told you about;
  • we are pursuing our legitimate interests;
  • it is necessary for us to do so to enable us to provide you with the services you have requested from us (e.g. to participate in the Project); and/or
  • the law otherwise permits or requires it.

Category of personal data

Purpose for processing

Relevant Controller

Legal basis under the DPA 2018

Contact details

We use your contact details:

·     to provide you with information relating to the Training that you will be participating in;

·     to ask you for feedback on each Training session that you attend;

·     for analytical and statistical purposes;

·     to ask you to complete two surveys (one when you create your account and another after completion of the Training and/or the Project);

·     where you have consented, to direct market to you about other services Enterprise Nation provides; and

·     To contact you for additional feedback about your participation in the Project.

Enterprise Nation

Legitimate Interests

Fulfilment of a contract



Business identification number

We use your business identification number so that we can analyse the participation data.

Enterprise Nation and Brunel

Legitimate interests



Once you have been accepted as a participant, as well as the third parties mentioned above, we will also share your personal information with contractors we engage to provide the Training.

As part of the Project, we will also share your information with the Innovation Growth Lab and the Government department for Business, Energy and Industrial Strategy who provide support and help us to ensure the highest possible methodological robustness.


Automated decision-making is the process of making a decision by automated means without any human involvement. We use automated decision-making to decide which group to place participants in (either face-to-face training or online learning) for the purposes of conducting the Project. We rely on the exception in Article 22(1) GDPR as the decision-making is necessary for the performance of the contract between us and it is the least privacy intrusive way to reasonably achieve our objective of organising businesses into two different groups at random. You may object to our use of automated decision-making by contacting us at [email protected] but please note that you will no longer be able to participate in the Project.