Privacy Policy

TBPI CIC (trading as The Black Policy Institute), a Community Interest Company registered in England and Wales (Company No. 16768346), is the data controller for the personal data collected through this website (theblackpolicyinstitute.org) and our related services.

We are committed to protecting your privacy and handling your personal data transparently, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our registered office is 61 Bridge Street, Kington, HR5 3DJ, United Kingdom. For any data-protection queries, please contact us at info@theblackpolicyinstitute.org.

We may collect and process the following categories of data:

2.1 Information you provide directly

• Contact form submissions — name, email address, organisation, enquiry type and message content.
• Newsletter sign-ups — email address.
• Programme applications — name, contact details, and any information you include in your application (e.g. for YPAG, FGLP, or Pioneers of Change).
• Event registrations — name, email address and organisational affiliation.

2.2 Information collected automatically

• Analytics data — page views, referral source, device type, browser type, approximate geographic location and session duration, collected via Vercel Analytics.
• Performance data — page-load metrics collected via Vercel Speed Insights.
• Cookie consent preference — stored locally in your browser (localStorage).

We process your personal data under the following legal bases:

• Consent (Article 6(1)(a)) — when you sign up for our newsletter, accept analytics cookies, or submit a contact form.
• Legitimate interests (Article 6(1)(f)) — to improve our website, analyse aggregate usage trends, and further our community-interest objectives.
• Contractual necessity (Article 6(1)(b)) — to process programme applications and event registrations where you are entering into an arrangement with us.

You may withdraw consent at any time by contacting us or using the unsubscribe link in our emails. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

• To respond to your enquiries and provide requested services.
• To send you our newsletter and policy updates (where you have opted in).
• To administer programme applications (YPAG, FGLP, Pioneers of Change).
• To manage event registrations and communicate event details.
• To analyse website traffic and improve user experience.
• To monitor site performance and diagnose technical issues.
• To comply with legal obligations.

Our website uses a small number of cookies and local-storage items:

When you first visit our site, a cookie banner gives you the option to accept or decline analytics cookies. If you decline, analytics data will not be collected.

You can also control cookies through your browser settings at any time.

We do not sell your personal data to any third party. We may share data with the following categories of service providers, who act as data processors on our behalf:

• Vercel Inc. — website hosting, analytics and performance monitoring.
• Email service providers — for newsletter delivery and transactional emails.

All processors are bound by data-processing agreements that require them to handle your data securely and only for the purposes we specify. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses or an adequacy decision).

We may also disclose personal data where required by law or to protect our legal rights.

• Contact form data — retained for up to 24 months after your last interaction, then securely deleted.
• Newsletter subscribers — retained until you unsubscribe.
• Programme applications — retained for the duration of the programme cycle plus 12 months, unless a longer period is required for reporting or legal purposes.
• Analytics data — aggregated and anonymised; not linked to identifiable individuals.

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your personal data (“right to be forgotten”).
• Restriction — ask us to limit how we process your data.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting prior processing.

To exercise any of these rights, email us at info@theblackpolicyinstitute.org. We will respond within one month in accordance with UK GDPR requirements.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include:

• HTTPS encryption across the entire website.
• Access controls limiting who within our organisation can view personal data.
• Regular review of data-processing practices and security measures.

Our website is not directed at children under 13. Where our programmes involve young people (e.g. YPAG), we obtain appropriate parental or guardian consent and apply enhanced safeguarding measures. Please contact us if you believe we have collected data from a child without appropriate consent.

We may update this Privacy Policy from time to time. Material changes will be highlighted on our website. We encourage you to review this page periodically. The “Last updated” date at the top of this policy indicates when it was last revised.

If you have any questions about this Privacy Policy or our data-protection practices, please contact us:

• Email: info@theblackpolicyinstitute.org
• Post: TBPI CIC, 61 Bridge Street, Kington, HR5 3DJ, United Kingdom