Privacy notice
Bridge Generation · Privacy Notice
Version dated 17 September 2026
English version
1. Controller and scope
The data controller is BRIDGE GENERATION LTD, a private company limited by shares registered in England and Wales, company number 17461388. Registered office: 4 Sutton Park Road, Sutton, SM1 2GB, United Kingdom. Privacy enquiries and complaints: hello@bridgegeneration.co.uk.
This notice covers website visits, adult enquiries, records of interest in our activities and optional email subscriptions. The website takes no payments and makes no trip bookings. We provide additional privacy information before beginning a new service that involves additional processing.
2. Information we receive
When you contact us through WhatsApp, Telegram or email, we receive your message and the contact information available to us, such as your name, phone number, username or email address. You may share the programme of interest and a child’s approximate age where relevant to our reply. Enquiries are intended for parents and other adults aged 18 or over. Do not send passport or health information, payment-card details or identity documents in ordinary correspondence.
We also record the date of your enquiry and any separate consent you provide. Technical providers process connection information, such as an IP address, page request and browser information, to deliver and protect the website.
There is no contact-data collection form on the website. Contact links open your chosen messenger or email application. You must send a message through that service for us to receive an enquiry. Clicking a link does not send us your correspondence or subscribe you to marketing.
3. Purposes and lawful bases
Enquiries and related records: we use your contact, question and interests to answer, clarify and manage your enquiry. Our lawful basis is legitimate interests under UK GDPR Article 6(1)(f): responding to people who contact the project and organising that correspondence. We assess necessity against your expectations and rights, with particular care where children are involved. This does not authorise regular advertising.
Email news and offers: with a separate voluntary opt-in, we use your name, email and stated interests for Bridge Generation emails about educational opportunities, trips, events and resources. Our basis is consent under Article 6(1)(a), together with applicable PECR requirements. An enquiry or prospective contract alone is not treated as a subscription.
Security, essential records and legal rights: necessary technical information and limited enquiry records help prevent abuse, secure the site and resolve disputes. We rely on those legitimate interests. Article 6(1)(c) applies where processing is necessary for a specific legal obligation, such as responding to a lawful data-rights request.
We do not sell contact lists, provide them to partners for their own marketing or make solely automated decisions with legal or similarly significant effects. Stated interests may help select a relevant response or email topic; they are not used for hidden assessments of children.
4. Recipients
Authorised BRIDGE GENERATION LTD staff and contractors access information only as necessary. Our business mailbox, hello@bridgegeneration.co.uk, uses Microsoft 365 (Outlook) supplied through GoDaddy. The website does not automatically submit enquiries to our CRM. An authorised operator may manually record an enquiry received by email, telephone or messenger in our European Bigin (Zoho) account to manage the response and next action. A separate marketing choice is recorded when the enquiry is received; making an enquiry is not a subscription.
The current website is hosted through ChatGPT Sites using Cloudflare infrastructure. Hosting providers process technical information to deliver pages and protect the service. PDF guides are downloaded directly from this website without a form or subscription. Telegram, WhatsApp and Instagram links open independent services. Independent services apply their own privacy terms.
Professional advisers or legally entitled authorities may receive information where necessary. An enquiry does not authorise sharing your contact with a school or programme organiser for their own advertising. We provide appropriate information before a new use of your data.
The video featuring Poya’s animated avatar is hosted with the website and starts when you select play. It does not load YouTube, Meta or another external video player. Hosting services receive the technical file request. Video-view and button-click statistics are not currently sent to external analytics services.
5. International processing
Email services, Bigin, hosting and external services you choose may involve processing outside the UK, including support access. A European account does not by itself mean that every operation is restricted to Europe. A restricted transfer requires a relevant adequacy decision or appropriate safeguards and any required assessment. Contact hello@bridgegeneration.co.uk for information about the specific email product, recipients and applicable safeguards. An ordinary enquiry is not consent to a risky international transfer.
6. Retention
Ordinary enquiries and related correspondence are kept for up to 12 months after the last meaningful contact, then deleted or anonymised unless further retention is necessary. For continuing discussions, the period runs from the last meaningful contact.
Email subscription information is used until consent is withdrawn. Inactive subscriptions are reviewed no later than 24 months after the last confirmed interaction and removed from active marketing unless continued retention is justified. Email delivery alone does not establish continued interest.
After an opt-out we may retain a minimal suppression record, such as email, date and opt-out status, to prevent accidental re-enrolment. It is not used for marketing. Consent evidence and necessary complaint records may be retained separately for as long as justified by compliance or a specific dispute, with restricted access and review.
The retention periods above apply to Bigin enquiry records and received emails. The website does not maintain a separate database of enquiry content. Backups are removed from normal use and expire through providers' backup cycles; previous deletion requests are respected when data is restored. A specific legal preservation duty or continuing dispute may require longer restricted retention of relevant records.
7. Your choices and rights
You can object to direct marketing at any time. Use the unsubscribe link in a marketing email or ask us by email. Withdrawing consent is free and needs no explanation. It stops further marketing without affecting earlier lawful processing or your ability to receive an ordinary enquiry response.
Where the law provides, you can request access and a copy, correction, deletion, restriction and data portability. You may object to legitimate-interest processing because of your circumstances. The marketing objection is absolute; other rights are subject to applicable conditions.
Contact us using section 1. We respond without undue delay, normally within one month, and explain any legally permitted extension in time. We may seek proportionate identity confirmation if there is reasonable doubt; do not send a passport unless specifically requested through an agreed secure method. Requests are generally free, except in cases expressly permitted by law.
8. Children, external services and security
We address our invitation to contact us to adults and do not invite children to subscribe directly to marketing. If a child sends information, they or an adult can contact us. We consider their age, understanding and rights and remove unnecessary information. Unexpected sensitive information is not used for advertising and is handled only as necessary to address the situation appropriately.
Sending a photograph, review or message is not permission to use it publicly in advertising. That use requires separate agreement. Telegram, Instagram, WhatsApp and partner websites have their own rules; information posted in groups may be visible to other members.
Proportionate access restrictions, secure transmission and management of working accounts help protect information. No internet service guarantees that incidents cannot occur. We assess incidents and comply with applicable duties to notify the regulator and affected people.
9. Cookies, complaints and updates
The Cookie Policy explains browser technologies and choices about future analytics. Email subscription and optional-cookie consent are separate.
Send a privacy complaint using section 1, explaining what happened and the outcome sought. We acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome. This does not replace the separate deadline for a data-rights request.
You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We appreciate an opportunity to resolve the issue first, without limiting your legal rights.
We provide updated information before materially changing processing purposes or scope and seek new consent where needed. The version date appears above. Russian and English versions are intended to have the same meaning; translation and updates do not remove mandatory rights.