Privacy Policy

This website belongs to Nesta. It is being operated and managed for the purpose of the Legal Access Challenge (the “Challenge”). The Challenge is being run by Nesta’s Challenge Prize Centre in partnership with the Solicitors Regulation Authority. The Challenge has been made possible by a grant from the £10m Regulators’ Pioneer Fund launched by The Department for Business, Energy and Industrial Strategy (BEIS) and administered by Innovate UK. You can find full details below.

This privacy policy explains how your personal information collected via this site will be used by Nesta. Nesta is committed to protecting your privacy and we take all reasonable precautions to safeguard personal information.  This website contains links to other websites. We encourage you to read the privacy statements on the other websites you visit.

1. What kind of information do we collect?

Sign-up details: If you register or sign up for events, newsletters or publications on the site, we will ask you for personal information such as your name, email address, occupation and other contact details such as a contact phone number.

Application details: If you apply to enter the Challenge, you will be asked for more detailed information which will be used to process your application, including details of your team if relevant, and you will be asked to agree to specific terms and conditions at the time of application.

Feedback and surveys: We may also ask you for feedback about Nesta or the Challenge or to complete surveys.

Research: If you agree to participate in any research we are conducting we will ask you for further information about you and your organization as may be relevant to the research you are participating in.

Online activity: When you use our website, we obtain information about the device from which you accessed it, your visits and use of the website including your IP address, location, browser type and version, referrer and activity. We record your activity and preferences when visiting the sites through the use of cookies (see “Cookies”, below).

Your posts and communications: If you post content or communicate via the site, we may also ask for your name, occupation and the organization you may work for. We also store and monitor your content and communications.

2.  What do we do with information we collect and what is our legal basis for this?

Third party processors: As is indicated below, we may use third party platforms and processors to deliver newsletters, process applications, event registrations, process surveys. In using these third parties we are pursuing our legitimate interest to use third party technology to achieve greater efficiency within our organization. To balance our interests against yours, we have taken steps to ensure these third parties maintain appropriate technical and organizational measures to keep your personal information secure.

Sign-up details: If you sign-up for us to send you newsletters, publications and other information about Nesta, our partners and activities (see “Marketing” section below), we will use your personal information to send these to you. Our legal basis for doing this is your consent.

You have the right to withdraw this consent at any time, as explained in the “Marketing” section below. If you are given the opportunity to sign-up, register for an event, or program, or to create a personal profile via Facebook or Twitter, Facebook and Twitter will make your email address registered to your Facebook or Twitter account available to Nesta, and Nesta will use the email address to enable you to log in to the particular platform. Our legitimate interest in doing this is the use of third party platforms for business efficiency and ease of registration for users.

Events: If you register to attend one of our events your personal information will be used to process your application to attend the event, for the administration and management of the event and to send you any updates or information regarding the event. Our legal basis for doing so is to fulfil the agreement with you for your attendance.  We use Splash and Eventbrite as registration systems for many of our events and their servers are based in the United States (U.S.) and may store and process your information outside the European Economic Area (EEA).

Both Splash and Eventbrite comply with the EU-US Privacy Shield Framework. If you wish to know more please see:

Splash Privacy Policy

Eventbrite Privacy Policy

We remain the controller of your personal information in this arrangement – the third party is only permitted to process your personal information in line with our instructions. If you buy a ticket for an event, or make a purchase via the website, we will use third party payment processing organizations to take your payment. These organizations will be the data controller of your information for the purpose of processing the transaction and may involve your
information being processed outside of the EEA. Please read the terms and conditions before completing your payment.

Application details: If you a make an application to the Challenge, your personal information will be used to process that application. We undertake this processing because it is necessary to fully assess your application, and if successful, to take steps for you to enter into an agreement with you (this is our legal basis for the processing). If the application process requires you to submit personal information relating to your team, the information you have provided may be displayed publicly on the website for other users and applicants to see.

If you make an application to the Challenge, you will be redirected to a third party platform Submittable Inc, to process that application. Submittable Inc are based in the United States and so your information may be stored and processed outside the UK and/or the EEA. Please see the Submittable Inc. Privacy Policy for more information. Please also ensure you read the terms and conditions of the Submittable platform as you will be agreeing to these when you submit an application.

We remain the controller of your personal information in this arrangement – the third party is only permitted to process your personal information in line with our instructions.

Feedback and surveys: If you agree to give feedback or complete a survey, we will use Surveygizmo and SurveyMonkey to process surveys, and they only process your information on our instructions. Both Surveygizmo and SurveyMonkey operate in the US and comply with the EU-US Privacy Shield Framework. For more information please see:

Surveygizmo Privacy Policy

Survey Monkey Privacy Policy

If you agree to participate in any survey that will form part of any research project, we will tell you at the time you take part how your information will be used for the particular research project or program, and how long it will be kept for.

Research: If you agree to take part in research we will use your information for the purpose of that research project or program. Full details of how your personal information will be used will be given to you at the time you agree to participate; this could include to inform the development of a new prize, project, program or other initiative, being incorporated into reports or other research outcomes, and may include being publicly displayed on web pages relating to the research project or program.

Online activity: The information that we obtain about your device helps us to monitor the website and keep it secure and prevent fraud. The cookies we use tell us how you use the site and what pages you have visited. In pursuing these activities, we use our legitimate interest of monitoring and improving the performance of the site and its security, and to help us understand more about our customer’s interests and preferences, and to inform our marketing strategy.

Some of these cookies are used for remarketing purposes and, if you agree, will be used to send you tailored advertisements. For more information, see “Cookies” below.

Posts and Communications: If you post any comments on the website, any personal information you agree to provide will be displayed publicly on the website along with your comments.

For all kinds of information collected: Please make sure that any personal details you provide are accurate and up to date and let us know about any changes. Please get consent first before giving us anyone else’s information.

We will not share your information with any other organization unless we have your permission, or we have a legitimate interest to do so (see Section 5 below).

We may also use your information to carry out analysis and research to improve our publications, events and activities, customize our website and its content to your particular preferences, notify you of any changes to our website or to our activities that may affect you, to prevent and detect fraud and abuse, and to protect other users.

However you choose to engage with or support the Challenge or Nesta, we may retain your information for our own legitimate business interests for statistical analysis purposes, in order to review, develop and improve our business activities.  In this situation, we will only keep any personal information if it is necessary to do so, and will always put in place appropriate safeguards, including where possible anonymizing or minimizing the data retained.

We use a third party to provide cloud based data security, storage and disaster recovery service to backup data that we hold, we currently use Barracuda Networks lnc. Barracuda is a company based in the U.S. and so may store your personal data outside the UK and/or the EEA.

Barracuda complies with the EU-U.S. Privacy Shield Framework. Please see the Barracuda Privacy Policy for more information.

3. How long will we keep your information for?

General principle: We will only keep any personal information that you provide to us for as long as is necessary to fulfill the purpose for which you gave it to us, and we will securely delete the information when it is no longer needed for that purpose (as explained in more detail below).

Events: If you register to attend one of our events, your information will be used for the purposes of the event. We will retain any personal information collected for the purposes of events for 3 years for evaluation and business development purposes to help us understand our audience and reach, and to improve future events.

Consent: We keep records of consent, and any withdrawal of consent, on our files for as long as your personal information is being used in-line with that consent and for a period of 6 years after the consent is withdrawn (unless otherwise requested by you).

Other application details: If you apply for the Challenge and you are successful, then you will enter into a contract with Nesta for any awarded prize. We will keep your information for 6 years after that contract has come to an end, or for 12 years after that contract has come to an end if the contract was executed as a deed. If the project or initiative has any external funding or support, we may need to retain your information for a longer period to fulfil our obligations under those agreements, in which case we will tell you that at the time of application. If you are unsuccessful in your application, once the process has ended we will retain your information for 3 years for evaluation and business development purposes, and to provide you with future opportunities to apply for similar programs, or prizes in the future. If you do not wish us to contact you about future opportunities, please let us know by writing to us or emailing us using the contact details set out below.

Research: If you agree to take part in any research your personal information will be kept for as long as it is of value to Nesta and the wider research community, and for as long as may be specified by any external research funder, patent law, legislative and other regulatory requirements. Research data shall be reviewed at least every 5 years to consider its continued value to Nesta, and personal data anonymized or pseudonymized where possible, unless to do so would affect the integrity of the research data and/or its outcomes, or its future value.

To the extent that Personal Data arising from any research is embodied within a research report or other research outcome, it will be retained in perpetuity as part of the published materials.

Research that supports the development of a prize, project, program, publication or other research outcome, shall be kept for at least 5 years beyond publication or any other research outcome has been completed. If the research is funded or the subject of any other contract, your personal data may be kept for 6 years after the end of the contract or longer if the contract or funding agreement specifies, which could be up to 12 years after the contract ends.

Posts and communications: any information that you post on the website shall only be kept and displayed for such time as the subject matter to which it relates is publicly displayed.

Processing for statistical analysis purposes: This type of processing will only be undertaken whilst we retain your personal information in line with the principles explained above.

4. Marketing

If you sign up to our mailing list we will use your details to keep you informed about latest news, blogs, program updates, research, publications, event details, jobs and funding opportunities, and may request feedback, including our annual audience survey.

We use third party providers, Mailchimp and Salesforce to deliver our e-newsletters. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our e-newsletter. Please note that Mailchimp and Salesforce use servers hosted in the USA and comply with the EU-U.S. Privacy Shield. If you want to know more about how your information will be stored and processed see:

Salesforce Privacy Policy

Mailchimp Privacy Policy

If we use any other providers we will let you know when you subscribe.

If you no longer want to receive marketing communications from us, you can unsubscribe from our mailing list at any time by clicking the unsubscribe link at the bottom of our emails, or by emailing detailing your name and email address. If you are given the opportunity to update your contact preferences in any email from us, this will link to a Surveygizmo form. If this function is not made available, please email us at the above address with your preference updates.

We use third party remarketing services to tailor advertising to you based upon your browsing history on this website, for more information see “Cookies” below.

5. Who else has access to your information?

We may need to share your information with other partners or companies or individuals who may help us operate the prize.

If you register to attend an event or indicate interest in any other activity detailed on the site, we may share your details with the companies/organizations who help us to fund and organize the events or other activities.

Our legal basis for sharing your information with our partners, judges and others who help us run the Challenge is to pursue our legitimate interest of being able to work collaboratively with other organizations and individuals to operate and administer the Challenge and any associated events or activities. Some of these organizations may process your information in countries outside the EEA, such as the United States, where data protection laws are not the same as in the EEA. Where transfers are necessary to countries where data protection has not yet been declared to be adequate, we rely on GDPR Article 49(1)(c) for these transfers. Rest assured that we will always ensure any transfer is subject to appropriate security measures to safeguard your personal data. Full details of these organizations, confirmation of where they would process your personal information, and details of the steps we have taken to safeguard your personal data will be provided as part of the online data collection process.

We may share your information within the Nesta group of companies, for the purposes of managing the event, grant or activity. Nesta currently provides all support and services for its subsidiary companies, therefore, our legal basis for sharing your information is to pursue the legitimate interests of shared resources and management reporting between the companies within the group. Our group companies will not process your data outside the EEA unless we notify you otherwise. Details of our group companies can be found here.

Comments, blogs and other information which you post on the site are displayed publicly and can be viewed by other users. Please be careful when disclosing personal information which may identify you or anyone else. We are not responsible for the protection or security of information which you post in public areas.

We may disclose your personal information to law enforcement agencies if required by law (in which case our legal basis for doing this is for compliance with a legal obligation), or to protect or defend ourselves or others against illegal or harmful activities (in which case, our legal basis for doing this is the pursuit of these legitimate interests).

6. Cookies

This site contains cookies. Cookies are small text files that are placed on your computer by websites you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to site owners. Most web browsers allow some control of most cookies through browser settings.

This site uses cookies that are strictly necessary to enable you to move around the site or to provide certain basic features, such as logging into secure areas.

The site also uses performance cookies which collect information about how you use the site, such as how you are referred to it and how long you stay on certain pages. This information is aggregated and therefore anonymous and is used to improve the performance of the site. If you want, you can block cookies by changing the settings on your browser.  Please note that some of the features of the site may not work if you choose to block cookies.

We also use third party tracking cookies for marketing. These third parties help us to send you tailored advertisements, that we think may be of interest to you, based on what parts of the website you have viewed. The advertisements will be shown to you on other search results pages, or on sites within Google’s or any other third-party display network. We do not collect any identifiable information through the use these third-party marketing services.

If you do not wish to receive such advertisements, then you must deactivate these cookies from your account. For more information and links to manage your setting see the Cookie Policy.

7. Security

We take steps to protect your personal information and follow procedures designed to minimize unauthorized access or disclosure of your information. If you have a password for an account on this site, please keep this safe and do not share it with anyone else. You are responsible for all activity on your account and must contact us immediately if you are aware of any unauthorized use of your password or other security breach.

8. Contacting us, exercising your rights and complaints

You are legally entitled to know what personal information we hold about you and how that information is processed, which includes the right to:

  • know what information we hold about you
  • ask us to correct any mistakes in your information which we hold
  • ask us to delete your personal information
  • ask us to stop using your personal information or restrict how we can use it, for example if you feel it is inaccurate or no longer needs to be used by Nesta
  • to object to us using of your personal information
  • to object to any automated decision making that we may do using your personal

If you wish to know what information Nesta holds about you, or wish to exercise any of your other rights as detailed above, or have any complaint about how we are using your personal information, then please email us using or write to us at 58 Victoria Embankment London EC4Y 0DS UK and provide enough information to identify yourself (e.g. name and address or any registration details).

If our information is incorrect or out of date, please provide us with information to update it. If you want us to delete, restrict or stop using any information we hold about you, please explain the reasons why you are asking this. If you are unhappy with how we are using your information, again please explain to us the reasons and we will investigate the matter. You can also write to the same address if you have a complaint about this policy.

If you are unhappy with how any data rights request or complaint has dealt with you have the right to complain to the Information Commissioner at Wycliff House, Water Lane, Wilmslow, Cheshire SK9 5AF or the following link. or helpline: 0303 123 1113.

9. Changes to the privacy policy

We may change this privacy policy from time to time.  We will notify you of any changes that relate to information we already hold about you, where practicable. You should check this policy occasionally to ensure you are aware of the most recent version that will apply each time you access this website.

Nesta is a registered charity in England and Wales 1144091 and Scotland SC042833.
Registered office: 58 Victoria Embankment, London, EC4Y.