1. Purpose

Nuffield Technologies Ltd, trading as Nuffield Technologies and Rugged Draw ( “the Company”, “we”, “us” or “our” ), is committed to protecting your Personal Information when you use our website, products and services. We recognise that when you choose to provide us with information about yourself, you trust us to treat it in a responsible manner. 

The purpose of this Website Privacy Policy is to inform you about how the Company may use your Personal Information. 

In order to optimise the provision of our services to you and to facilitate some of our marketing efforts, we collect certain specific information about you. 

This Website Privacy Policy explains the following: 

• what information we may collect about you; 
• how we will use information we collect about you; 
• whether the Company will disclose your details to anyone else; 
• where we might send your information; 
• the use of cookies on the Company’s websites; and 
• how you can reject cookies. 

The Company uses all Personal Information that you provide to us or that we collect from you in accordance with Data Protection Law. 

2. Definitions

In this privacy policy, the following definitions are used:

UK GDPR or GDPR: Regulation (EU) 2016/679, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended from time to time. Unless expressly stated otherwise, references in this policy to the “GDPR” mean the UK GDPR. 

Data Protection Law: all laws and regulations in force from time to time that apply to our processing of Personal Data or to privacy in electronic communications, including: 

• the UK GDPR; 
• the Data Protection Act 2018; 
• the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) (“PECR”); and the applicable provisions of the Data (Use and Access) Act 2025, 

in each case as amended, supplemented, consolidated, re-enacted or replaced from time to time. 

Encryption and Encrypted Data: Encryption means the use of cryptographic techniques to convert data into a coded form that cannot be understood without the appropriate cryptographic key or other authorised means of decryption. Encrypted Data means data protected in this way. Encryption is a security measure and does not, by itself, remove Personal Data from the scope of Data Protection Law. 

ICO: the Information Commissioner’s Office, the UK’s independent regulator for data protection and information rights, or any successor supervisory authority. 

Personal Data: any information relating to an identified or identifiable living individual. An identifiable individual is someone who can be identified, directly or indirectly, including by reference to a name, identification number, location data, online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. Pseudonymised information remains Personal Data where the individual can be identified using additional information. The terms “Personal Data” and “Personal Information” are used interchangeably in this policy. 

Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or the unauthorised disclosure of or access to, Personal Data transmitted, stored or otherwise processed. 

Special Categories of Personal Data: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data processed for the purpose of uniquely identifying an individual; data concerning health; or data concerning an individual’s sex life or sexual orientation. 

3. Website Privacy Policy scope

This Website Privacy Policy applies to the actions of the Company and to the use of the public-facing Nuffield Technologies and Rugged Data websites, including public pages relating to Rugged Draw. 

It does not apply to Personal Information processed when you use the Rugged Data service, which is covered by our separate Rugged Data App Privacy Policy at https://ruggeddata.co.uk/app-privacy-policy/. The terms on which Rugged Data and Rugged Draw are provided are set out in the Rugged Data SaaS Terms & Conditions at https://ruggeddata.co.uk/terms-and-conditions/.

Rugged Draw is a product made available by Rugged Data and is not a separate legal entity. Where the Company processes Personal Information entered into Rugged Data or Rugged Draw solely on a customer’s instructions, the customer is the controller and the Company acts as its processor. This Website Privacy Policy does not apply to that customer-controlled processing; the customer’s privacy notice applies. The website may contain hyperlinks to websites owned and operated by third parties. These third party websites have their own privacy policies, and are also likely to use cookies. We recommend that you review these policies which will govern the use of Personal Information which you submit when visiting these websites and which may also be collected by cookies. We do not accept any liability for such third party websites and your use of such websites is at your own risk. 

4. The collection and use of data

4.1. How do we collect information

This Policy relates to the Company’s use of any Personal Information collected from you when you interact with us, such as by the following ways: 

• Visiting and using the Nuffield Technologies or Rugged Data websites, including public pages relating to Rugged Draw (e.g. filling out an online form or downloading one of our resources); 
• Via social media; 
• Via messaging services; 
• Contacting us via email or telephone; 
• When you use our products and services 
• If you supply services to the Company 
• If you sign up for marketing 
• If you apply for a position to work for the Company 

The Company also processes Personal Information of employees for the purposes of employment and meeting legal obligations. This Privacy Policy does not cover employee data – this is covered in a separate privacy policy that is available from the HR team and available via Adoptech. 

4.2. What information do we collect and process

When you use our website

When we collect personal data via our website, we will be upfront about it and it will be clear to you that you’re providing personal data and how we will be using it. By using our website we may collect the following Personal Information about you: 

• Information regarding our use of cookies and similar technologies(see below) 
• IP address (numbers that can uniquely identify a specific computer or other network device on the internet) and other generic information provided by your browser or device 
• Your name and contact details if you sign up for our newsletter or download content and resources from our websites Your name, contact details and content of your conversations with us, when you use our online forms (e.g. the “Get in touch” form on our website), live chats or message boards 

Depending on your use of our site, we will use your personal information for a number of purposes including:To provide our services, activities or online content, or communicating information about them (e.g. relating to upcoming promotions or new product launches) or dealing with your requests and enquiries.

• To provide our services, activities or online content, or communicating information about them (e.g. relating to upcoming promotions or new product launches) or dealing with your requests and enquiries. 
• To provide you with better ways of accessing information from our websites. 
• For service administration, which means that we may contact you for reasons related to the service, activity or online content you have signed up for. 
• To contact you about any submission you have made. 
• To use IP addresses and device identifiers to identify the approximate location of users, block disruptive use, establish the number of visits from different countries, tailor the content of our sites, apps or other services based on browsing behaviour, and determine the country from which you access the services. 
• For analysis and research so that we may improve the services we offer. 

When you use our services

When you participate in, access or sign up to any of the Company’s services, we may receive the following Personal Information about you: 

• your name 
• email address 
• job title 
• employer 
• postal address 
• telephone or mobile number 
• information about your account and use of the Company’s services, including support tickets and service-administration information. Personal Data entered into Rugged Data or Rugged Draw on behalf of a customer is addressed in section 3. 

We will use this information for the purposes of delivering our services to you, billing you for the use of our services and keeping you updated about any changes with our services. 

Information provided by you in relation to submitting a job application to us

In some situations (e.g. recruitment), as well as collecting your Personal Information, such as your name, contact details, CV and application information, etc., the Company may also collect Special Categories of Personal Data, such as the information you provide in a pre-start health and medical questionnaire. We may also collect information from you for the purposes of confirming your identity and vetting you as an appropriate person to work in the Company and with the Company’s clients. 

This information will be used to assess your suitability for a position at the Company and if you are successful in your application, most of the information you provide will form part of your personnel file and used for the purposes of employing you, in accordance with our Staff Privacy Policy. 

When you contact us

Whenever you contact us we may keep a record of your contact details, your enquiry and any other information pertinent to the contact. 

If you fill out an online form it is sent to us as an email, which means as well as being stored in our website database, it will be stored with our email service supplier and accessible by the appropriate person within the Company to deal with your enquiry and may be downloaded to a local device. Likewise any emails we receive will be processed in a similar way. 

If we speak to you on the phone, we may store copies of your name, contact details and the nature of your enquiry, for future reference or as part of an ongoing discussion with yourself. 

If you interact with us using social media

If you contact us via any of our social media channels we will only collect and store information that is relevant to the reason for contacting us. All discussions will be stored within our social media service providers. 

Supplier or contractor data

If you are one of our suppliers we will collect the minimal information about you and your services as required to make use of your services and deal with invoices and payments for your services. Such information will be stored within our accounting package for the purposes of our accounts and will be retained accordingly, and is likely to include your name, your company name and contact details. 

Individual employees within the Company may also retain your contact details within their email application or via business cards that you may provide to them. 

Lawful bases for processing 

We will only use your Personal Information where we have a lawful basis under Data Protection Law. Depending on the purpose, we may rely on: 

• performance of a contract with you, or taking steps at your request before entering into one, where you are personally a party to the contract; 
• compliance with a legal obligation; 
• our legitimate interests in operating, securing and improving our websites, products and services, responding to enquiries, managing customer and supplier relationships, preventing fraud, administering our business and carrying out proportionate business-to-business marketing, provided that those interests are not overridden by your rights; or 
• your consent, where consent is required, including for non-essential cookies and certain electronic marketing. 

Where we process Special Categories of Personal Data, we also rely on an applicable condition under Data Protection Law. You may contact us for further information about the lawful basis that applies to a particular use of your Personal Information. 

4.3. Sharing information with third parties

We use a number of third-party cloud-based services for the purposes of effectively running our business and providing our services to you. We also use a number of third-party companies, e.g. accountants, IT support, etc. 

Where we use a third-party service or company, we provide only the minimum Personal Information reasonably necessary for it to provide the relevant service and meet our requirements. 

We carry out proportionate due diligence on our third-party suppliers. Where a supplier processes Personal Information on our behalf, we put in place a written contract containing the data protection terms required by Data Protection Law. Some recipients, such as professional advisers and public authorities, may process Personal Information as independent controllers under their own legal responsibilities. 

We may disclose personal information to third parties when we reasonably believe we are required by law, and in order to investigate, prevent, or take action regarding suspected or actual unlawful or otherwise prohibited activities, including, but not limited to, fraud. 

4.4. Where may your information be stored

The Company may be required to transfer personal data to a country/countries around the world including ( Europe , US ), for the purposes of running our business and delivering our services. Where this occurs, we rely on an adequacy regulation or put in place an appropriate safeguard permitted by Data Protection Law and take steps to ensure that the information remains protected. You may contact us for further information about the countries involved and the safeguard applicable to a particular transfer, or to request a copy of the relevant safeguard.

5. Cookies

We may use information obtained from cookies or similar technology.

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity. For further information visit www.aboutcookies.org. You can set your browser not to accept cookies and the above website tells you how to remove cookies from your browser. However, if you do so in a few cases some of our website features may not function as a result.

During the course of any visit to our website, the pages you see, along with a cookie, are downloaded to your device. Many websites do this, because cookies enable website publishers to do useful things like find out whether the device (and probably its user) has visited the website before. This is done on a repeat visit by checking to see, and finding, the cookie left there on the last visit. If you continue without changing your settings, we’ll assume that you are happy to receive all cookies on our website. However, you can change your cookie settings at any time.

5.1. What do we use cookies for?

This website uses cookies that fall into one or more of all the categories below: 

• Strictly necessary cookies – these enable services you have specifically asked for. These cookies are essential to enable you to move around our website and use its features, such as accessing secure areas of the website. Without these cookies certain services you have asked for cannot be provided 
• Performance cookies – these collect information about how users use a website, for instance which pages users visit most often and whether they receive error messages. Depending on the technology used, this information may include online identifiers. We use it to understand and improve website performance. Where consent is required, these cookies are not used unless consent has been given. 
• Functionality cookies – these remember choices you make to improve your experience. These cookies allow the website to remember choices you make and provide enhanced, more personal features. They may be used to help provide services you have asked for such as watching a video. The information these cookies collect may be anonymised and they cannot track your browsing activity to other websites. 

6. Keeping Data Secure

6.1. Third Party Websites

Our website links to third party sites which we do not operate or endorse. These websites may use cookies and collect your personal information in accordance with their own privacy policies. This privacy policy does not apply to third party websites and we are not responsible for third party websites. 

6.2. How do we protect your information?

We take appropriate measures to ensure that any personal information which you disclose to us is kept secure, accurate and up to date and kept only for so long as is necessary for the purposes for which it is used. The security measures taken may include, but are not limited to, data encryption.

6.3 Retention of your personal information

Unless stated elsewhere in this document or in our terms of service, we keep Personal Information only for as long as reasonably necessary for the purposes for which it was collected, including providing our services and meeting legal, accounting, reporting, contractual and dispute-resolution requirements. When deciding how long to keep Personal Information, we consider its nature and sensitivity, the risk of harm from unauthorised use or disclosure, the purposes for which we use it and applicable legal requirements. Further information about the retention period applicable to particular Personal Information is available by contacting us.

7. What are your rights?

Under Data Protection Law, you have the following rights, which the Company will always work to uphold. Not all rights apply in every circumstance: 

• Right to access – for a copy of the Personal Information we hold about you, and details about how we are processing your Personal Information. If we provide you with access to the information we hold about you, we will not charge you for this, unless your request is “manifestly unfounded or excessive”. Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why. 
• Right to correct – to have any inaccuracies in your Personal Information corrected or to have your information updated. Right to erase – to have your Personal Information erased, if we do not have any lawful reason to continue processing it. Right to restrict use – to ask us to restrict the way in which we use your Personal Information in certain circumstances. Right to data portability – if we are processing your Personal Information by automated means, you can ask for us to provide your personal information to you in a structured, commonly-used and machine-readable format. You can also ask us to provide it directly to a third party where this is technically feasible. 
• Right to object – the right to object to our use of your data including where we use it for our legitimate interests.
• Right to withdraw consent – where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.

7.1. Right to opt out

You have the right to object at any time to the use of your Personal Information for direct marketing. You can request that we stop sending you marketing materials at any time. Electronic communications typically include an unsubscribe link that allows you to manage your communication preferences, including the ability to unsubscribe from future marketing. If this is not successful, please contact us using the details below.

7.2. How to contact us

This Website Privacy Policy should tell you everything you need to know, but you can contact us to ask questions, exercise any of your rights in relation to your Personal Information or make a data protection complaint, using the contact information below: 

Email address: [email protected] 

Postal address: 4 Acorn Business Park, Ling Road, Poole, Dorset. BH12 4NZ. 

These contact details apply to privacy enquiries relating to Nuffield Technologies and Rugged Data, including enquiries relating to Rugged Draw. 

If you are unhappy with how we have collected or used your Personal Information, you may make a data protection complaint to us using the contact details above. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed of progress and tell you the outcome without undue delay. You also have the right to make a complaint to the ICO.

8. More information

For more information about your data rights and privacy or data protection in general visit the Information Commissioner’s Office website: https://ico.org.uk

9. Changes to our privacy notice

We may change or update elements of this privacy notice from time to time or as required by law. The most current version is available on the Nuffield Technologies website at https://nuffieldtechnologies.com/privacy-policy and on the Rugged Data website at https://ruggeddata.co.uk/privacy-policy/.

10. Policy Governance

Responsibility for the Website Privacy Policy rests with Helen Craig. Duties include, but are not limited to: 

• Ensuring that all staff in scope and appropriate external parties have read and confirmed their acceptance of the latest version of this policy 
• Monitoring for legal, regulatory or industry best practice developments in relation to this policy 
• Coordinate with senior management, IT, and legal counsel to communicate and review issues related to this policy Review and update this policy at least every 12 months, in order that it remains fit for purpose 

Exceptions to this policy shall be allowed only if previously approved by Helen Craig. 

This policy has been approved by senior management.