Privacy Policy

We take the care of your personal data seriously. This privacy notice is here to explain how the personal data you supply to us is collected and used.

We ensure that we use your information in accordance with all applicable laws concerning the protection of personal information. In this document we will explain:

If you have any questions at any time about data privacy please contact us at or write to: The Data Protection Officer, STEM Learning, University of York, York, YO10 5DD.


1. Who are we

STEM Learning is the largest provider of education and careers support in science, technology, engineering and mathematics (STEM). We work with schools, colleges and others working with young people across the UK.

Supported by a unique partnership of Government, charitable trusts and employers, we are dedicated to raising young people’s engagement and achievement in STEM subjects and careers

Where the course is delivered as part of the National Centre for Computing Education, please note the Department for Education is the data controller and the Teach Computing privacy notice applies.

2. What information we collect about you

We aim to collect only the information that we think is required for the purpose for which we collect it.

We collect and process personal data about you when you interact with us and our products or participate in any of our programmes. The personal data we process may include:

  • name;
  • work/home address, email address and/or phone number;
  • job title/areas of interest;
  • payment and invoicing details, including information required to support application
  • dietary requirements
  • your image and audio
  • technical information as described below

STEM Ambassadors only:

As a STEM Ambassador we need to collect additional information to enable you to take part in the programme. The data you give to us will be used for general programme coordination, safeguarding, reporting and monitoring. Please click the link below to find out more specific ways we use your data.

Find out more about what data we collect and why we need it.

 Nuffield Research Placements only:

When you sign up to participate in Nuffield Research Placements we need to collect additional information to enable you to take part n the programme. The data you give to us will be used for general programme coordination, eligibility, safeguarding, reporting and monitoring. More information  relating to this will be provided during sign up process to the online registration system.


When you visit our website, we may collect technical information relating to your use of our website, including your browser type or the Internet Protocol (IP) address used to connect your computer to the internet. For more on this, see section 10, “Information about cookies”.

As the information we collect about you will be stored on our IT infrastructures, it may also be shared with our data processors who provide email, relationship management, anonymous analytics and storage services.


3. When we collect that information

We collect your information when you:

  • sign up to participate in any of our programmes 
  • sign up to view or download our resources
  • register for activities, events or services
  • visit our website
  • participate in surveys or research 
  • sign up to receive our marketing emails
  • have made a request for information from us
  • apply for a job
  • are providing a service to us
  • engage with our STEM Community

4. How we collect and store that information

We take appropriate technical and organisational measures to ensure that the information disclosed to us is kept secure, accurate, and up to date, and that it is kept only for as long as is necessary for the purposes for which it is used.

You should be aware that the use of the internet is not entirely secure, and although we will do our best to protect your personal data, we cannot guarantee the security or integrity of any personal information that is transferred from you or to you via the internet. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features such as encryption to try to prevent unauthorised access.


5. What we use your information for

We collect your data on the occasions listed in section 3, “When we collect that Information”.

We use the information we have collected:

  • To deliver activities, information, events or services connected with STEM Learning
  • Administer any user accounts you have with us
  • Send you information about our services and other related activities which may be of interest to you via marketing emails you subscribe to
  • Where we have asked for your consent, we may use your image or quotes in our marketing materials. Please note that where information has been used in printed material, it will not be possible for this to be withdrawn
  • To carry out surveys/researchfor example to measure our impact, and to evaluate/report on outcomes
  • Where you have agreed, we may provide your information to our trusted partners for research purposes
  • Ensure that content from our site is presented in the most effective manner for you

  • Where you are providing a service to us we will use your information for administrative, reporting and management purposes

  • To carry out the recruitment process and related employment matters

  • Process a request that you have made for information from us

  • Safeguarding purposes - keeping young people and vulnerable adults safe

6. On what lawful basis we use your information

We have a lawful basis for collecting your data as set out in section 3, “Why we collect that Information”, and for using the data for the purposes described in section 5, “What we use your information for”.

Lawful basis may include:

  • Where we have your consent.
  • Where processing is necessary for the performance of a contract to which you are a party. If you fail to provide this information, we may be unable to perform the contract.
  • Where it is within legitimate interests to process your information. We know that under this basis of processing, we have a heightened responsibility to keep your interests central and to make sure that your rights as a data subject override our legitimate interest.
  • Where we need to comply with a legal obligation.

STEM Ambassador only – Lawful basis for processing special category data

The lawful basis we rely on to process any information you provide as part of your application which is special category data, is article 9(2)(g) of the GDPR. This relates to processing for reasons of substantial public interest and the safeguarding of your fundamental rights. In addition Schedule 1 part 2(8) of the DPA2018 which relates to processing for equality of opportunity or treatment purposes.

STEM Ambassador only –Lawful basis for processing criminal conviction data

We process information about your DBS status. The lawful basis we rely to process this data are Article 6(1)(e) processing is necessary for the performance of a task carried out in the public interest. In addition we rely on the processing condition at Schedule 1 part 2 paragraph 18(1), of the DPA2018 which relates to safeguarding of children and of individuals at risk.


7. Who we share your information with

We never exchange or sell your information to any third party.

We may share your information with:

  - third party processors 

 -  organisations where we are providing a service on their behalf

 -  organisations to whom you have agreed for us to share your information.

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct.

Where we share with another controller, they themselves must let you know if they intend to use your information in any other way. 

The third-party processors / organisations we share with fall into a number of categories which are listed below. We do change these from time to time and will do what we can to update this table regularly.


Third party 



For what purpose

Activity venues - STEM Ambassadors only

  • If you are delivering an activity we will share only the information necessary to complete your CPD activity

Placement providers - Nuffield Research Placements only

  • If you are successfully matched to a placement we will share only the information necessary for placement adminstration and support

Service providers 

  • Suppliers and consultants we use to help us to deliver our services to you, for example:  IT service providers, research organisations, marketing support providers, Credly who issue digital badges as part of our certificate programme, etc.

Email system – Adestra

  • To send marketing emails

Trusted partners undertaking research

  • Research - where you have agreed to share your information with trusted partners on your account.

STEM Ambassador Hubs - STEM Ambassadors only

  • Matching activities / opportunities with STEM Ambassadors
  • Programme administration
  • Safeguarding, e,g ensuring STEM Ambassadors are DBS checked / certificate is up to date prior to them taking part in activities
  • Providing support to STEM Ambassadors
Regional Network Partners      
  • Programme administration
  • Providing support
  • Local marketing and reporting


  • We will provide your information to our funders for research and evaluation purposes.
  • We will supply engagement data to funders, potential funders and partners that will not include any details that could be used to identify you

CPD/training venues and deliverers including online courses

  • If you are booking a CPD activity we will share only the information necessary to complete your CPD activity 

CPD sponsor

  • If it is clear on the CPD activity that there is a professional development sponsor then the professional development sponsor may hold and process your information, and you may be contacted by them regarding their relevant products and services


  • When completing certification your information will be passed to external assessors for processing

Employer / Professional Institution / Scheme – for STEM Ambassadors only

  • Where you have agreed to share your information with your employer,  a scheme or a professional institution*, we may share information about you and your STEM Ambassador activities with these organisations that you have entered on your account profile. 
  • They will use the information to promote, administer and manage the STEM Ambassador Programme within their organisation. 
  • We do not share any details relating to your DBS check with your employer or professonal institution.

*Please note – where you have provided a Public Photo or Public Biography, this can be viewed by anyone with a STEM Learning account, including your employer, professional institution or scheme.

Disclosure and Barring
Service online checking service – Atlantic Data – for STEM Ambassadors only

  • Where you have requested to become a STEM Ambassador you may be asked to provide information directly onto STEM Learning’s Online Disclosure System provided under licence by Atlantic Data Ltd in order to complete a DBS check. We will share with them basic contact details so they can send you the link to enter your information.

Atlantic Data’s Privacy Statement

Public Profile  – for STEM Ambassadors only      
  • Where you have provided a Public Photo or Public Biography, this can be seen by anyone with a STEM Learning account, e.g. activity organisers, teachers or your employer.


We may share your information with other relevant organisations if you are asked and you agree that your information can be shared in that way, or we have a legal obligation to do so.

As part of the services offered to you by STEM Learning, the information you provide may be transferred to countries outside the United Kingdom. These countries may not have similar data protection laws to the UK. By submitting your personal data, you’re agreeing to this transfer, storing or processing. When transferring your information outside of the EU in this way, we take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected.


8. How long we keep your information for

We keep your information for no longer than is necessary for our purposes, or for any period required by law, for example for compliance with HMRC requirements, if this is longer. What is necessary will depend on the reason for which the information was collected.

Maximum retention periods

6 months – short term business use e.g unsuccessful applications, requests for information

2 years after the last activity– engagements such as surveys, website users who have not signed in, STEM Ambassadors who have not done activities.


8 years after the end of the activity – e.g. CPD bookings, STEM Ambassador activities, placement participation information, impact data

Regulatory lifetime - Data assets, normally related to finance or HR, which are required to be held to comply with other legislation or regulatory requirements.

If you have any questions about how long we keep your information, contact us at


9. Your rights

Right of access — you have a right to ask us to confirm whether we are processing information about you, and to request access to this information.

Right to rectification — it is your responsibility to see that the information held on the website is up to date. We may also update some information if we identify it is out of date, for example a school closes and reopens with a different name. You may ask us to rectify information you think is inaccurate, and you may also ask us to remove information which is inaccurate or incomplete. If you inform us that your personal data is inaccurate, we will inform relevant third parties with whom we have shared your data so that they may update their own records.

In order to ensure we do not hold any out of date information for individuals we regularly remove registered users for whom we do not have a valid email address; this includes those accounts to which the email address has been reported as undeliverable.

Right of portability — you have a right to obtain your personal data from us and reuse it for your own purposes.

Right to be forgotten —You have a right to seek the erasure of your data, for example where it is no longer necessary for us to continue holding or processing your personal data. This right is not absolute, as we may need to continue processing this information to comply with a legal obligation.

If at any time you decide that you wish to have your account deleted from the website you can do so by emailing stating your email address and quoting ‘Delete my account' in the subject line. If you are engaged in an active CPD booking then your account will not be deleted until this has finished.

Right to restriction — you have a right to ask us to restrict our processing of your information if:

  • You contest its accuracy and we need to verify whether it is accurate.
  • You ask us to restrict use of it instead of deleting it.
  • We no longer need the information for the purpose of processing, but you need it to establish or defend legal claims.
  • You have objected to processing of your information being necessary for the purposes of our legitimate interests. The restriction would apply while we carry out a balancing act between your rights and our legitimate interests. If you exercise your right to restrict processing, we would still need to process your information for the purpose of exercising or defending legal claims, for the purpose of protecting the rights of another person, or for public interest reasons.

You can always unsubscribe from any marketing emails, there is a link at the bottom of each email.

Accessing your personal information — you can find out if we hold any personal information by making a ‘subject access request’. If we do hold information about you we will:

  • give you a description of it
  • tell you why we are holding it
  • tell you who it could be disclosed to
  • let you have a copy of the information in an intelligible form

To make a request for any personal information we may hold or exercise any of your rights, you need to put the request in writing addressing, it to: The Data Protection Officer, STEM Learning, University of York, York, YO10 5DD, or email

We may ask for your help in locating specific information and confirming your identity. We will act in accordance with your instructions as soon as reasonably possible, and there will be no charge.

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

Our use of your data processed in the UK is regulated by the Information Commissioner. You have a right to report any of your concerns about our use of your data to the Information Commissioner’s Office.


10. Information about how cookies are used on this website

This website, like most websites, puts small files (known as ‘cookies’) onto your computer to collect information about how you browse the site. Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site.

For more information about the cookies we use STEM Learning cookie policy

Find out more about how to manage cookies.


Measuring website usage (Google Analytics)

We use Google Analytics software (Universal Analytics) to collect information about how you use this website. We do this to help make sure the site is meeting the needs of its users and to help us make improvements.

Google Analytics stores information about:

  • the pages you visit on this site
  • how long you spend on each page on this site
  • how you got to the site
  • what you click on while you’re visiting the site

These cookies do not collect or store your personal information (for example your name or email address) so this information can’t be used to identify who you are. We do not allow Google to use or share our analytics data. Google Analytics sets the following cookies.

You can opt out of Google Analytics cookies.


11. About changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted here and, where appropriate, sent to you by email. Please check the website regularly to see any updates or changes to our privacy policy. By continuing to use our website, you will be deemed to have accepted such changes.


12. How to contact us about your data

Data rights are human rights and we are determined to fairly and fully honour yours. You can unsubscribe at any time or just get in touch with any questions, comments, or instructions regarding your information by emailing or writing to: The Data Protection Officer, STEM Learning, University of York, York, YO10 5DD.


Page last updated:  10 February 2022