Privacy Policy
Last updated 19 September 2026
1. About this Privacy Policy
The INCLUDE Framework respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and protect personal information when you:
- visit www.includeframework.co.uk;
- download an INCLUDE resource;
- subscribe to email updates;
- purchase a digital product;
- enrol on a course or programme;
- participate in a webinar, community, coaching programme or event;
- contact us with an enquiry; or
- engage The INCLUDE Framework for training, coaching or consultancy services.
This policy also explains your rights under applicable data protection law.
For the purposes of UK data protection law, The INCLUDE Framework, is the data controller for personal information collected through this website and our direct services, except where we are acting as a data processor on behalf of a school, trust or other organisation under a separate agreement.
2. Data protection laws
We process personal information in accordance with applicable data protection and privacy legislation, including:
- the UK General Data Protection Regulation (UK GDPR);
- the Data Protection Act 2018;
- the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR);
- the Data (Use and Access) Act 2025 and related amendments to UK data protection law; and
- where applicable, the EU General Data Protection Regulation (EU GDPR).
Where the EU GDPR applies to our activities, additional requirements concerning EU/EEA users may also apply.
3. Personal information we may collect
Depending on how you interact with us, we may collect the following categories of information.
Identity and contact information may include your name, email address, telephone number, job title, school, trust or organisation.
Account information may include your username, account identifiers, enrolment status and login activity where you create an account through our learning platform.
Purchase and transaction information may include products or services purchased, order details, billing information, invoices, payment status and transaction records. Full payment card information is normally processed by our payment service providers rather than stored directly by The INCLUDE Framework.
Learning and participation information may include courses enrolled in, course progress, assessment or quiz results, webinar participation, comments, community posts or other information you choose to provide through our learning environment.
Communication information may include enquiries, emails, support requests, feedback, survey responses and other correspondence with us.
Marketing information may include your marketing preferences, when and how you subscribed and whether you have opened, interacted with or unsubscribed from communications where such tracking is lawfully enabled.
Technical and usage information may include your IP address, browser type, device type, operating system, referring website, pages viewed, dates and times of visits and information collected through cookies and similar technologies.
Professional and consultancy information may include information you or your organisation provide in connection with coaching, training, audits or consultancy projects.
4. How we collect your information
We may collect personal information:
- directly from you when you complete a website form, download a resource, create an account, purchase a product, register for training, subscribe to communications or contact us;
- from your school, trust or employer where they purchase or arrange a service on your behalf;
- through our website and learning platform using cookies and similar technologies;
- from payment, learning, email, event or technology providers used to deliver our services; and
- where appropriate and lawful, from publicly available professional or business information.
Where information is obtained from another source, we will use it only where we have an appropriate lawful basis for doing so.
5. Why we use your information and our lawful bases
We will only process personal information where we have a lawful basis.
6. Free resources and email marketing
You can download resources such as The INCLUDE Checklist without being required to agree to ongoing marketing.
Where we ask whether you would like to receive updates, learning content, products or offers from The INCLUDE Framework, marketing consent is separate from the provision of the resource.
If you consent to email marketing, you can withdraw your consent at any time by:
- using the unsubscribe link in our emails; or
- contacting us at [email protected].
Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Where we rely on the PECR products and services “soft opt-in” for an existing customer, we will only use it where the legal requirements are satisfied and will provide a clear method of opting out.
We will not sell your personal information to third parties for their own marketing purposes.
7. Cookies and similar technologies
Our website may use cookies and similar technologies to:
- enable essential website and account functionality;
- maintain website security;
- remember preferences;
- understand how visitors use the website;
- measure website performance; and
- support marketing or analytics where you have consented.
Cookies that are strictly necessary for providing a service you request may be used without consent.
Non-essential cookies, including analytics, advertising and tracking technologies, will only be used where the required consent has been obtained.
You can change or withdraw your cookie preferences through our cookie controls where available.
Further information about individual cookies, providers, purposes and durations should be provided in our Cookie Policy.
8. Thinkific and our digital learning platform
The INCLUDE Framework uses Thinkific to provide aspects of its website, digital products, learning environment, accounts, courses and related services.
Where you register, purchase, download or participate through the platform, personal information may therefore be processed by Thinkific and its approved service providers on our behalf.
Thinkific Labs Inc. is based in Canada and uses service providers and infrastructure in other countries, including the United States. Thinkific’s data processing terms contain provisions governing international transfers, including Standard Contractual Clauses and the UK International Data Transfer Addendum where required.
Some services provided directly by Thinkific may also be governed by Thinkific’s own privacy information.
9. Payment providers
Where you purchase a product, course, coaching service or other paid service, payments may be processed by a specialist payment provider.
Payment providers may receive information necessary to process your transaction, prevent fraud and comply with financial regulations.
The INCLUDE Framework does not normally need to receive or store your complete payment card number.
Payment providers may act as independent controllers for some aspects of their processing and may provide their own privacy notices.
10. Schools, pupils and sensitive information
The INCLUDE Framework primarily provides resources, training, courses, coaching and consultancy services to education professionals and organisations.
Our general website and downloadable products are not intended as systems for storing identifiable pupil records or safeguarding information.
Please do not submit identifiable pupil information, medical information, SEND records, safeguarding information or other sensitive personal information through general website forms, marketing forms or ordinary email unless we have specifically agreed an appropriate and secure process with your organisation.
Where consultancy, coaching or training work involves access to personal information relating to pupils, parents, staff or other individuals, responsibilities will be agreed with the relevant school, trust or organisation.
In these circumstances:
- the school or organisation may remain the data controller;
- The INCLUDE Framework may act as its data processor;
- appropriate data processing terms may be entered into;
- personal information should be minimised or pseudonymised wherever practicable; and
- additional safeguards will apply to special category information.
We will not intentionally process special category information unless it is necessary, lawful and appropriately protected.
11. Children
The INCLUDE Framework website, professional resources, training and courses are primarily intended for adults working in education, rather than children using the service independently.
We do not knowingly invite children to subscribe to our marketing communications or purchase professional products independently.
If we become aware that personal information about a child has been submitted to us unnecessarily through a general website function, we may delete or restrict that information.
Where information about children is processed as part of an agreed school consultancy engagement, the relevant contractual and data protection arrangements with the school or organisation will apply.
12. Who we share personal information with
We may share personal information where necessary with carefully selected service providers such as:
- Thinkific and its approved sub-processors;
- website and cloud hosting providers;
- payment processors;
- email and communication providers;
- webinar or video conferencing services;
- analytics providers where consent has been obtained;
- accountants, insurers, professional advisers and legal advisers;
- contractors supporting the operation of The INCLUDE Framework; and
- regulators, courts, HMRC, law enforcement or other public authorities where disclosure is legally required.
Service providers processing personal information on our behalf are required to protect that information and use it only in accordance with our instructions and applicable law.
We do not sell personal information.
13. International transfers
Some of the technology services we use may process or store personal information outside the United Kingdom.
Where a restricted international transfer occurs, we take steps designed to ensure an appropriate level of protection.
Depending on the destination and provider, this may include:
- UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to the European Commission Standard Contractual Clauses;
- EU Standard Contractual Clauses where the EU GDPR applies; or
- another lawful transfer mechanism recognised by applicable data protection law.
The UK has also retained mechanisms allowing transfers to countries or organisations formally recognised as providing an adequate level of protection.
You may contact us if you would like further information about safeguards used for a particular transfer.
14. How long we keep personal information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, accounting, contractual and regulatory requirements.
The period will depend on the type of information and our relationship with you.
For example:
- enquiry information is retained for a reasonable period after the enquiry is closed;
- customer and transaction records may be retained for the period required under accounting and tax law;
- account and course information may be retained while your account or course access remains active and for an appropriate period afterwards;
- consultancy records are retained according to our contractual and professional requirements;
- marketing information is retained until you unsubscribe, withdraw consent or we determine it is no longer appropriate to retain it; and
- we may retain a minimal suppression record after an unsubscribe so that we know not to send further marketing to that address.
We periodically review the information we hold and securely delete or anonymise information that is no longer required.
15. Security
We use appropriate technical and organisational measures designed to protect personal information against accidental loss, misuse, unauthorised access, alteration or disclosure.
Measures may include access controls, secure technology platforms, authentication controls, staff awareness, appropriate contracts with processors and procedures for responding to suspected personal data breaches.
No internet-based system can be guaranteed to be completely secure, but we take proportionate steps to protect the information entrusted to us.
16. Your data protection rights
Depending on the circumstances, you may have the right to:
- be informed about how we use your personal information;
- request access to your personal information;
- request correction of inaccurate or incomplete information;
- request deletion of your personal information;
- request that processing is restricted;
- receive certain information in a portable format;
- object to certain processing;
- object at any time to the use of your personal information for direct marketing;
- withdraw consent where processing is based on consent; and
- raise concerns about automated decision-making where applicable.
These rights are not absolute and some depend on the lawful basis and circumstances of the processing.
To exercise your rights, contact: [email protected]
We may need to confirm your identity before responding to a request.
17. Automated decision-making
We do not currently use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
If this changes, we will update this Privacy Policy and provide the information required by applicable law.
18. EU and EEA visitors
The INCLUDE Framework is based in the United Kingdom.
The EU GDPR may apply where we intentionally offer goods or services to individuals in the European Economic Area or monitor their behaviour within the EEA.
Where EU GDPR Article 27 requires us to appoint an EEA representative, details of that representative will be published here:
EEA representative: Include Framework
If our activities do not meet the relevant EU GDPR territorial criteria, an EEA representative may not be required.
19. Third-party websites
Our website may contain links to websites, platforms or services operated by other organisations.
We do not control those organisations’ privacy practices. We recommend reviewing their privacy information before providing them with personal information.
20. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology, suppliers or legal obligations.
The latest version will be published on our website and the date at the top of this policy will show when it was most recently updated.
Where a change materially affects how we use personal information, we will take appropriate steps to notify affected individuals where required.
21. Complaints
If you have concerns about how we use your personal information, please contact us first so that we have the opportunity to investigate and respond.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.
Information Commissioner’s Office: https://ico.org.uk/
If the EU GDPR applies to the processing of your personal information, you may also have the right to complain to the relevant data protection supervisory authority in the EU or EEA country concerned.
The INCLUDE Framework | www.includeframework.co.uk
22. Contact us
Questions concerning this policy should be directed to:
The INCLUDE Framework
Website: www.includeframework.co.uk
Email: [email protected]