Privacy Policy

Northbridge Analytics Ltd is a data analytics consultancy registered in England and Wales. We provide dashboard build, insight reporting, and data analysis services to schools and multi-academy trusts across England. We are registered with the Information Commissioner's Office (ICO) as a data controller and processor. ICO Registration No. ZB00013758598. Contact: hello@northbridgeanalytics.com

We collect and process two categories of personal data: Website visitors — If you submit our contact form, we collect your name, email address, school or organisation name, and the content of your message. We do not use tracking cookies, advertising networks, or behavioural analytics on this website. Client data — As a data processor acting on behalf of client schools and MATs, we process pupil-level and staff-level data provided to us under a formal Data Processing Agreement. This data is used solely to deliver the contracted services (dashboard build, insight reports, and quarterly presentations). We never use client data for any other purpose.

Website enquiries — We process your contact details on the basis of legitimate interests (responding to your enquiry) and, where a contract follows, on the basis of contractual necessity. Client data — We process pupil and staff data on behalf of client schools under Article 28 of UK GDPR, as a data processor acting on the documented instructions of the data controller (the school or MAT). Our lawful basis as processor is contractual necessity. All processing is governed by a signed Data Processing Agreement.

Contact enquiries — We use the information you submit to respond to your enquiry and, if relevant, to send you information about our services. We do not add you to mailing lists without your explicit consent. Client data — Pupil and staff data is used exclusively to build dashboards, produce insight reports, and present findings. Data is never sold, shared with third parties, used for profiling, or retained beyond the agreed retention period set out in the Data Processing Agreement.

All data is stored within the United Kingdom or the European Economic Area. We do not transfer personal data outside the UK or EEA. Our security practices are aligned with the National Cyber Security Centre (NCSC) 10 Steps to Cyber Security framework. Client data is encrypted in transit and at rest. Access is restricted to team members who require it to deliver the contracted service. Full technical and organisational security measures are documented in our Data Processing Agreement, available on request.

Contact enquiries — We retain enquiry data for 24 months, after which it is securely deleted unless a client relationship has been established. Client data — Retention periods are defined in each client's Data Processing Agreement and agreed prior to onboarding. At the end of the engagement, all client data is securely deleted or returned within 30 days, and we provide written confirmation of deletion on request.

You have the following rights in relation to your personal data: • Right of access — request a copy of the data we hold about you • Right to rectification — ask us to correct inaccurate data • Right to erasure — ask us to delete your data, where we have no legal obligation to retain it • Right to restrict processing — ask us to pause processing in certain circumstances • Right to data portability — receive your data in a structured, machine-readable format • Right to object — object to processing based on legitimate interests To exercise any of these rights, email hello@northbridgeanalytics.com. We will respond within 30 days.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. We would always appreciate the opportunity to address any concern directly — please contact us at hello@northbridgeanalytics.com before escalating to the ICO.

We may update this privacy policy from time to time. The current version is always available at northbridgeanalytics.co.uk/privacy. Material changes will be communicated to active clients directly. Last updated: April 2026.