SNS Ltd. Privacy Policy

About this policy
This Privacy Policy explains how Super North Star collects, uses, stores and shares personal data when you visit our website, contact us, use our services, enrol on a course, use our learning platform, or otherwise interact with us. Super North Star is the controller of the personal data described in this policy unless we tell you otherwise. This means we decide why and how your personal data is used. If the legal entity name, registered address, company number or contact details differ from the trading name above, those details should be inserted below before this policy is published.

Contact details
For privacy queries or requests about your personal data, please contact:
• Organisation: Super North Star Limited
• Address: C/O Bennett Brooks & Co Ltd, St George’s Court, Winnington Avenue, Northwich, Cheshire, CW8 4EE
• Email: zenler@compassforlife.co.uk
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. We would appreciate the opportunity to deal with your concerns first, so please contact us in the first instance where possible.

Personal data we collect
We may collect and use the following types of personal data:
• Identity and contact details, such as your name, job title, organisation, email address, telephone number and postal address.
• Account and course information, such as course enrolments, learning platform account details, course progress, attendance, certificates, messages, uploaded content and support requests.
• Business and transaction information, such as enquiries, bookings, invoices, payment status, correspondence and records of services provided.
• Technical and usage information, such as IP address, browser type, device information, pages visited, approximate location derived from technical data, cookie identifiers and website analytics information.
• Communications information, such as emails, messages, form submissions, meeting notes, feedback and survey responses.
• Marketing preferences, such as whether you have opted in or out of receiving marketing communications.

Data Protection Policy - Super North Star
We do not normally seek to collect special category personal data, such as health information, racial or ethnic origin, religious beliefs, political opinions or trade union membership. If you voluntarily provide such information, we will only use it where necessary and lawful.

How we collect personal data
We collect personal data when:
• you contact us by email, telephone, web form or other communication method;
• you request information, book a course, enrol on training, or use our learning platform;
• you subscribe to updates or agree to receive marketing communications;
• you visit our website or interact with our online content;
• you correspond with us through Microsoft 365 services such as email or file sharing;
• you use services delivered through Zenler or other approved service providers.

How we use personal data and our lawful basis
We only use personal data where we have a lawful basis to do so.
The table below summarises the main ways we use personal data.
Purpose Personal data used Lawful basis Responding to enquiries and communicating with you Identity, contact and communications information Legitimate interests; steps before entering into a contract Providing courses, learning platform access and related support Identity, contact, account, course, progress and communications information Contract; legitimate interests Managing customer relationships, records, invoices and administration Identity, contact, business, transaction and communications information Contract; legal obligation; legitimate interests Operating and securing our website, systems and services Technical, usage, account and security information Legitimate interests; legal obligation Using Google Analytics to understand website usage and improve our website Technical and usage information, cookie identifiers and analytics data Consent where required for analytics cookies; legitimate interests for aggregated analysis where lawful Sending marketing communications or updates Identity, contact and marketing preference information Consent or legitimate interests, depending on the context and applicable rules Complying with legal, regulatory, tax, accounting and dispute obligations Relevant records, correspondence, transactions and identity information Legal obligation; legitimate interests Data Protection Policy - Super North Star

Systems and service providers we use
We use carefully selected systems and service providers to operate our organisation and deliver our services.
The main systems currently used are:
• Microsoft 365 / Office 365 - used for email, calendar, file storage, file sharing, collaboration and administration.
• Zenler - used as our learning platform for course delivery, course accounts, learning content, communications and related training administration.
• Google Analytics - used to understand how visitors use our website and to improve website content and performance.

These providers may process personal data on our behalf.
We remain responsible for deciding why personal data is used and we take reasonable steps to ensure that service providers are suitable for the type of data and processing involved.
We may also use professional advisers, accountants, payment providers, hosting providers, IT support providers and other suppliers where necessary for our business operations.

Google Analytics and cookies
We use Google Analytics to collect information about how visitors use our website. This helps us understand website traffic, which pages are useful, and how we can improve the website. Google Analytics may use first-party cookies and collect technical and usage information such as device and browser information, on-site activity and approximate location derived from technical data. Google states that Google Analytics does not log or store IP addresses in Google Analytics 4. Where required by law, we will ask for your consent before setting non-essential analytics cookies. You can usually control cookies through your browser settings and, where available, through our cookie banner or cookie settings tool. We do not intentionally send names, email addresses, payment information or other directly identifying information to Google Analytics.

Sharing personal data
We may share personal data where necessary with:
• service providers who host, operate or support our systems and services;
• Zenler, where needed to deliver learning platform services;
• Microsoft, where personal data is stored or communicated using Microsoft 365 / Office 365;
• Google, where Google Analytics is used on our website;
• professional advisers, insurers, accountants and legal advisers; Data Protection Policy - Super North Star
• public authorities, regulators, law enforcement or courts where required by law or where necessary to protect our rights or the rights of others.
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes unless we have your consent or another lawful basis to do so.

International transfers
Some of our service providers and their sub-processors may process personal data outside the United Kingdom or the European Economic Area. Where this happens, we will take reasonable steps to ensure that appropriate safeguards are in place, such as adequacy regulations, approved contractual safeguards, data processing terms, or other lawful transfer mechanisms.

How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to provide services, maintain business records, comply with legal, tax and accounting obligations, resolve disputes and enforce agreements.
Typical retention periods include:
• general enquiries: normally up to 24 months after the last contact, unless the enquiry becomes a customer or course record;
• customer, course and learning platform records: normally for the duration of the relationship and then for a reasonable period afterwards;
• accounting, tax and invoice records: normally 6 years from the end of the relevant financial year or as otherwise required by law;
• marketing preferences: until you unsubscribe or ask us to update your preferences, with suppression records retained as needed to respect your opt-out;
• website analytics data: retained according to our Google Analytics settings and reviewed periodically.

Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures may include access controls, authentication, encryption, secure configuration, backups, staff awareness, supplier review and incident response procedures. No system can be guaranteed to be completely secure. If we become aware of a personal data breach, we will take appropriate action and notify affected individuals and/or the ICO where legally required.

Your rights
Depending on the circumstances, you may have rights under data protection law including the right to:
• request access to your personal data; Data Protection Policy - Super North Star
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data;
• object to certain processing;
• request restriction of processing;
• request transfer of your personal data;
• withdraw consent where we rely on consent.

These rights are not absolute and may depend on the legal basis and circumstances of the processing. To exercise your rights, please contact us using the details above. We may need to verify your identity before responding to a request.

Marketing
We may send marketing communications where you have consented to receive them or where we are otherwise permitted to do so by law. You can opt out of marketing communications at any time by using the unsubscribe link in our messages or by contacting us. We will not sell your personal data to third parties for marketing purposes.

Links to other websites and platforms
Our website, emails or learning platform may contain links to other websites, platforms or resources. We are not responsible for the privacy practices of third-party websites or services. You should review their privacy notices before providing personal data to them.

Changes to this policy
We may update this Privacy Policy from time to time. The latest version will be published on our website or otherwise made available to you. Where changes are significant, we will take reasonable steps to bring them to your attention.