Privacy Policy

1. Introduction

Your personal data is important to us and we aim to look after your personal data carefully in line with the latest data protection and privacy laws.

In this privacy policy (the “Policy”), we have set out more detail on those laws and on what personal data we collect about you and how we use that personal data.

Please do read this Policy so you know what we are doing with your personal data.

We may update this Policy from time to time and we will post any changes on our platform at www.zerogravity.co.uk and/or app.zerogravity.co.uk (the “Platform”). This Policy was last updated on 31 March 2022.

The rights of individuals are protected by the “UK GDPR” (being the UK’s implementation of the General Data Protection Regulation (Regulation EU) 2016/679) (the “GDPR”)), and any amendments to it. These impose restrictions and controls over the way that Zero Gravity collects and uses personal data.

For the purpose of this Policy and the applicable data protection legislation, the controller of your personal data is Zero Gravity Tech Ltd (company number: 12091675), a private limited company incorporated in England with its registered office: 6th Floor One London Wall, London, England, EC2Y 5EB (“Zero Gravity”, “we”, “us” or “our”).

This Policy should be read in conjunction with our Safeguarding Policy and Terms and Conditions.

2. Who we are, our aims and objectives

Zero Gravity supports students from low-income backgrounds into top universities and careers. Our mission is to democratise access to opportunity so that talented students can reach their potential, no matter their background.

We provide these services free to our users because we believe that cost should never be a barrier to our community. Our ongoing commitment to our social mission means that we only share your personal data with third parties when required to deliver the Services (as defined below) and when compelled to do so by law.

For the purposes of this Policy, the term “Zero Gravity” refers to both Zero Gravity Tech Ltd and Zero Gravity Fund, charity number 1188177.

3. What is personal data?

“Personal data” is information relating to a living individual where the individual can be identified from the data, or the individual can be identified from that data combined with other information held by us (or likely to come into our possession).

This might include a name, address, telephone number, email address or photograph. It could also include identifiers such as an identification number or a pseudonym. It does not include anonymised data, where the identity has been permanently removed and cannot be matched back to an individual through other data held so that it is no longer possible to identify an individual.

4. What are special categories of data?

“Special categories of personal data” is data that includes more sensitive information about an individual. This might include information relating to an individual’s racial or ethnic origin, physical or mental health, religion, or criminal offences.

5. What services does this Policy cover?

Our services include (without limitation) provision of our Platform, mentoring services, provision of information about Zero Gravity, connecting members with universities, prospective employers and employment-based opportunities, provision of audiovisual content, text, photographs, advertising and other services which we may offer at or via the Platform (the “Services”). This Policy covers all of the Services and any reference to “you” or “your”, means you as a user of our Services (e.g. visitors to our Platform, mentors, students, job applicants, etc.). This Policy applies to the collection and use of your personal data by us and parties that we use to deliver the Services (such as our processors, suppliers and sub-contractors).

6. What personal data does Zero Gravity collect?

What personal data we process about you depends on which of our Services you are using or providing. The personal data that we process includes:

• your full name, salutation, title, address, postcode, email address, telephone number and profile picture;

• information about your school(s) attended, examination grades, work experience, extra-curricular activities, date of birth/age, gender, nationality and/or ethnicity;

• information about your socio-economic background, e.g. whether you have lived in care, have been a young carer, have refugee/asylum seeker status, would be or are the first in your family to go to university and/or have received free school meals;

• records of your expertise, professional history, practising details and qualification details, information about your experience, participation in meetings, seminars, advisory boards and conferences, information about your professional relationship with other individuals or institutions, language abilities and other professional skills;

• records of any consents you have given, together with the date and time, means of consent and any related information (e.g. the subject matter of the consent);

• information about your use of or delivery of Services, including details of the content you viewed on our Platform, how long you stayed and on which pages, and your engagement with features on the Platform;

• records of your interactions with our online advertising and content, records of advertising and content displayed on pages or application screens displayed to you, and any interaction you may have had with such content or advertising (e.g. mouse hover, mouse clicks, any forms you complete in whole or in part) and any touchscreen interactions;

• IP address, cookie information, the type of device used to access the Platform, dates and times of your interactions with the Platform and Platform correspondence (some of which may constitute personal data);

• your username, password and security login details;

• where you interact with us in your capacity as an employee of a third party, the name, address, telephone number and email address of your employer, to the extent relevant;

• feedback from your Zero Gravity mentor/mentee, reviewing your session together, collected by surveys after each mentoring session;

• any views and opinions that you choose to send to us, or publicly post about us on social media platforms;

• in the event of a safeguarding issue, recordings of video mentoring sessions between relevant users; and

• other personal data to ensure and check compliance with the Terms & Conditions and/or otherwise as required by law.

7. When and how do Zero Gravity collect information?

We (or our authorised third parties) collect personal data about you:

• when you register to receive Services as a mentee or to deliver Services as a mentor, when you complete a written form stating that you would like further information about the Services, when you register on our Platform and/or when you request support from a mentor or deliver support as a mentor via our Platform;

• when you contact us with an enquiry or other feedback;

• when you provide personal data to us in person;

• in monitoring your use of the Services including (without limitation) communications sent by you via the Services;

• when we are checking compliance with the Terms & Conditions and/or otherwise as required by law;

• when you visit our Platform, including through the use of “cookies” and/or other devices. For full details, see our Cookie Notice;

• when you disclose your personal data to us in any other way or otherwise through the Services at any other point (e.g. where you contact us via email or telephone, or by any other means);

• in the ordinary course of our relationship with you; or

• from third party suppliers who have confirmed to us that they are authorised to pass your personal data to us in accordance with your legal rights (e.g. schools, universities, local authorities, etc.).

We may also combine personal data that you provide on one part of the Services with personal data collected from other parts of the Services and/or with publicly available information or personal data that we receive from other reputable and lawful sources. All personal data will be stored and used in accordance with this Policy.

8. Special categories of personal data

Where it becomes necessary to process your special categories of personal data for any reason, we rely on one of the following legal bases:

• Consent: We may process your special categories of personal data where we have, in accordance with applicable law, obtained your express consent prior to processing your special categories of personal data (this legal basis is only used in relation to processing that is entirely voluntary – it is not used for processing that is necessary or obligatory in any way);

• Compliance with applicable law: We may process your special categories of personal data where the processing is required or permitted by applicable law (e.g. to comply with our diversity reporting obligations);

• Detection and prevention of crime: We may process your special categories of personal data where the processing is necessary for the detection or prevention of crime (e.g. the prevention of fraud); or

• Establishment, exercise or defence of legal claims: We may process your special categories of personal data where the processing is necessary for the establishment, exercise or defence of legal claims.

If you provide special categories of personal data to us, you must ensure that it is lawful for you to disclose such data to us, and you must ensure a valid legal basis applies to the processing of those special categories of personal data.

9. Purpose of processing and legal bases for processing

10. Do we disclose your personal data to third parties?

We disclose your personal data for legitimate business purposes and the operation of our Platform or provision of our Services, in accordance with applicable law, including:

• where appropriate, to your appointed representatives authorised by us and acting on our behalf, such as our employees, contractors, suppliers and/or agents, including without limitation our customer care teams to administer the Services provided to you by us now or in the future, subject to the requirements noted below in this Section 10;

• to accountants, auditors, consultants, lawyers and other outside professional advisors to Zero Gravity, subject to binding contractual obligations of confidentiality;

• where we have your consent to do so, for marketing communications, such as potential careers opportunities – where we share your personal data with prospective employers, we may be remunerated for this;

• as part of general, statistical information about the Services’ user base, traffic volumes and related matters. These details will not include information personally identifying you;

• as part of general, statistical information about those that access our Services. These details will not include information personally identifying you;

• with our partners and prospective employees on an aggregated and anonymised basis for impact reporting;

• to relevant Higher Education providers, where you have expressed an interest in the provider. Providers may store your data on the Higher Education Access Tracker (HEAT), and once you leave school/college, your data will be sent to the Higher Education Statistics Agency (HESA). Your data will be stored on HEAT until you are aged 30, and if you enter university within this time, your data will be kept for an additional 15 years after you graduate;

• to any relevant third party provider, where our Platform uses third party advertising, plugins or content. If you choose to interact with any such advertising, plugins or content, your personal data may be shared with the relevant third-party provider. We recommend that you review that third party’s privacy policy before interacting with its advertising, plugins or content;

• to any relevant third party acquirer(s) or successor(s) in title, in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganisation, dissolution or liquidation); and

• to the police, regulatory bodies or legal advisers in connection with any alleged or suspected criminal offence, unlawful activity or suspected breach of the Terms & Conditions and/or Safeguarding Policy or otherwise where required by law or where we suspect harm or potential harm to others. On request, we will co-operate with any law enforcement authorities, regulatory body, governmental authority or court for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. We shall not be obliged to give you any further notice of this.

If we engage a third party processor to process your personal data, the processor will be subject to binding contractual obligations to: (i) only process the personal data in accordance with our prior written instructions; and (ii) use measures to protect the confidentiality and security of the personal data; together with any additional requirements under applicable law.

For the avoidance of doubt, contact details will not be shared between mentors and mentees to ensure that neither party is personally identifiable through the Platform.

11. International transfers of personal data

We may transfer personal data to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which you are located.

If an exemption or derogation applies (e.g. where a transfer is necessary to establish, exercise or defend a legal claim) we may rely on that exemption or derogation, as appropriate. Where no exemption or derogation applies, and we transfer your personal data from the UK to recipients who are not located in jurisdictions that have been formally designated by the UK Government as providing an adequate level of protection for personal data, we do so on the basis of Standard Contractual Clauses. You are entitled to request a copy of our Standard Contractual Clauses using the contact details provided below.

For the purposes of this Section 11, “Standard Contractual Clauses” means template transfer clauses adopted by the European Commission or adopted by a Data Protection Authority and approved by the European Commission or the UK Government.

12. Will I be sent marketing messages?

We will only send you information about our Services if you indicate that you wish to receive such messages (e.g. by “opting-in” by ticking a tick box). Where we have your consent or are otherwise permitted to do so, we may send you information by email, telephone (including SMS and MMS), mail or other methods of communication.

To stop receiving marketing communications from us, you can use the ‘unsubscribe’, ‘stop’ or similar facility contained in any such communication or you can email us at data@zerogravity.co.uk stating that you do not wish to receive further communications from us.

We do not pass or sell your personal information to third parties for any other purpose than as set out in this Policy. Unless you have given us your consent to pass your details to a third party, any marketing referred to in this section is conducted by us on our own behalf through authorised third parties assisting in the delivery of the Services.

13. How long will Zero Gravity store my personal data?

We take every reasonable step to ensure that your personal data is only processed for the minimum period necessary for the purposes set out in this Policy. Unless you request that we delete your personal data, we will retain your personal data in a form that permits identification only for as long as:

• subject to safeguarding obligations, we maintain an ongoing relationship with you (e.g. where you are a user of our Services, are acting as a mentor, etc.); or

• your personal data is necessary in connection with the lawful purposes set out in this Policy, for which we have a valid legal basis (e.g. where your personal data is included in a contract between us and your employer, and we have a legitimate interest in processing that data for the purposes of operating our business and fulfilling our obligations under that contract; or where we have a legal obligation to retain your personal data),

Plus the duration of:

• any applicable limitation period under applicable law (i.e. any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data is relevant); and

• an additional two (2) month period following the end of such applicable limitation period (so that, if a person brings a claim at the end of the limitation period, we are still afforded a reasonable amount of time in which to identify any personal data that is relevant to that claim),

If you are a mentee, and you have consented to Zero Gravity sending you direct marketing communications, we will generally retain your personal data for a period of 6 years, to cover the period we expect that you may be in higher education and entering work, after which we will delete it, unless you consent to us retaining it.

14. Cookies & similar devices

In addition, in common with many other online services, and subject always to obtaining your consent, where required in accordance with applicable law, we and our authorised third parties may use “cookies” and/or other tools to store and sometimes track information about you in accordance with the Cookie Notice.

15. Are my details safe?

We endeavour to take all reasonable steps to protect your personal data. We are careful to choose storage facilities that we have had assessed and which we are confident are suitably secure to store your information.

Please always think carefully before disclosing personal data to other users of the Platform or otherwise making your information publicly available. It is important that you are aware that any information you disclose to another user of the Platform may then be disclosed by that user. We have no responsibility or control over the contents of communications made between users of our Services.

16. What are my rights?

Any personal information you supply will be treated in accordance with the GDPR.

We are committed to delivering the rights that individuals are entitled to under data protection laws in the UK. These are:

• the right to request access to, or a copy of, the personal data we hold about you, together with information regarding the nature, processing and disclosure of that personal data (this includes access to video recordings taken for safeguarding purposes);

• the right to object to your personal information being used for direct marketing. We will give you the ability to object to this, and where required, we will ensure we obtain your consent before undertaking marketing;

• the right to rectification. You may request that we rectify any inaccurate and/or complete any incomplete personal data;

• the right to withdraw consent. You may, as permitted by applicable law, withdraw your consent to the processing of your personal data at any time. Such withdrawal will not affect the lawfulness of processing based on your previous consent. Please note that if you withdraw your consent, you may not be able to benefit from certain service features for which the processing of your personal data is essential;

• the right of erasure. You may request that we erase your personal data and we will comply, unless there is a lawful reason for not doing so. For example, there may be an overriding legitimate ground for keeping your personal data, such as, a legal obligation that we have to comply with, including but not limited to safeguarding mentees;

• the right to request, on legitimate grounds, the restriction of processing of your personal data;

• the right to data portability. In certain circumstances, you may request that we provide your personal data to you in a structured, commonly used and machine-readable format and have it transferred to another provider of the same or similar services to us. Where this right is applicable, we will comply with such transfer as far as it is technically feasible; and

• the right to lodge a complaint with the supervisory authority. We suggest that you contact us with any questions or if you have a complaint in relation to how we process your personal data. However, you do have the right to contact the relevant supervisory authority directly. To contact the Information Commissioner’s Office in the United Kingdom, please visit the ICO website for instructions.

This does not affect your statutory rights.

To exercise one or more of these rights, or to ask a question about these rights or any other provision of this Policy, or about our processing of your personal data, please use the contact details provided below. Please note that:

• in some cases it will be necessary to provide evidence of your identity before we can give effect to these rights; and

• where your request requires the establishment of additional facts (e.g. a determination of whether any processing is non-compliant with applicable law) we will investigate your request reasonably promptly, before deciding what action to take.

17. How do I lodge a complaint?

If you are concerned about our use of your personal data, please contact us at data@zerogravity.co.uk and we will be happy to provide explanations or information as needed.

If you find our response unsatisfactory, or you do not believe we are processing your personal data in accordance with the law, you can make a complaint directly to the Information Commissioner’s Office. The Information Commissioner's Office can be contacted in writing at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Zero Gravity’s registration number with the Information Commissioner’s Office is ZB000749.

18. How can I change my details?

Where you register your details for certain Services and open a user account with us, you can then use that to access and log on to use those Services. You may change or update some of your details at any time via your account. If you are not registered for these Services but wish to update your details then please contact us at data@zerogravity.co.uk. You should please make sure that you update your details as soon as possible with all relevant changes.

19. Contact details

If you would like to discuss any aspect of this Policy or the way Zero Gravity processes your information, please contact our Data Protection Officer.

Role: Data Protection Officer

Name: Elliot Little

Email: data@zerogravity.co.uk