Decrypthut Limited
Effective: September 2026
Decrypthut Limited (“Decrypthut”, “we”, “us” or “our”) provides technology education, training, workshops, courses, roadshows, mentoring, workforce development and related learning and innovation activities.
Decrypthut Limited is a company registered in England and Wales under company number 13085156.
Registered office:
71–75 Shelton Street
London
WC2H 9JQ
United Kingdom
For the purposes of UK data protection law, Decrypthut Limited is the controller of personal information covered by this Privacy Policy unless another organisation is expressly identified as the controller.
Questions about privacy or requests concerning your personal information can be sent to:
This Privacy Policy explains how we collect and use personal information when you:
Where a school, local authority, employer or other organisation provides information to us or commissions a programme, that organisation may also be a controller of your information. Its own privacy notice may therefore also apply.
Depending on your relationship with us, we may collect:
This may include:
This may include:
Where necessary, we may receive information concerning:
Some of this information constitutes special-category personal data and receives additional protection under data protection law.
Where a safeguarding or welfare concern arises, we may process information concerning a child or adult, the concern raised, actions taken, relevant communications and information required for safeguarding purposes.
Where appropriate, Decrypthut may take or receive photographs, video or audio from programmes and events.
Our approach to photographs and recordings is explained in section 10.
When working with schools, councils, employers, suppliers, universities, community organisations and corporate partners, we may process professional contact information and correspondence.
When you use our website, certain technical information may be collected, including:
We may receive information:
We may use personal information to:
We do not sell personal information.
We only use personal information where we have a lawful basis.
Depending on the circumstances, this may be:
Where processing is necessary to provide a service, administer a booking or fulfil an agreement with you.
Where processing is reasonably necessary for the operation, administration, security, development or improvement of Decrypthut and those interests are not overridden by your rights.
Where you have freely chosen to give permission for a particular use, including certain marketing activities and photography or promotional media.
Where we rely on consent, you may withdraw it.
Where we must process information to comply with a legal requirement.
In exceptional circumstances where processing is necessary to protect someone’s life.
Information about health, disability and certain other sensitive matters may constitute special-category personal data.
Where we process special-category information, we identify both an appropriate lawful basis and an additional condition permitted by UK data protection law.
Depending on the circumstances, this may include explicit consent, substantial public interest grounds provided for by law, safeguarding-related conditions, or other applicable conditions.
We seek to collect only the information genuinely necessary for the relevant purpose and restrict access appropriately.
Children and young people are an important part of Decrypthut’s work.
We take particular care when collecting and using their personal information.
Information should be presented in a way appropriate to the age and understanding of the child where appropriate.
Depending on the programme, information may be provided by a parent, guardian, school, council or commissioning organisation.
We aim to collect only information reasonably necessary to:
A child’s information will not be used for an unrelated purpose merely because we already hold it.
Decrypthut uses Sertifier, a third-party digital credential platform, to issue, manage, host and verify Decrypthut digital badges and certificates.
Where you earn a Decrypthut digital credential, we may provide Sertifier with the information reasonably necessary to create and administer that credential. This may include:
Sertifier may provide learners with access to a digital credential page, wallet or verification function and may enable learners to download or share their credential.
Learners are not required to publish or share their credential publicly simply because it has been awarded.
Decrypthut determines the credential awarded, the criteria associated with it and the achievement it represents. Sertifier provides the technology used to issue and verify the credential.
We only share information with Sertifier that is reasonably necessary for the administration and verification of Decrypthut credentials.
Sertifier processes personal information in accordance with its own privacy arrangements and applicable contractual and data protection requirements.
Personal information associated with Decrypthut digital badges is otherwise handled in accordance with this Privacy Policy.
We use real programme imagery because it helps demonstrate Decrypthut’s work and impact. We also recognise that learners must have meaningful control over how identifiable images of them are used.
Photographs, video or audio may be taken during Decrypthut programmes, workshops or events for purposes including:
Where consent is the appropriate basis for identifiable promotional photography or recording, we will obtain appropriate permission.
For children, this will normally involve permission from a parent or guardian where appropriate, while also respecting the wishes of the child.
A learner who does not wish to be photographed or recorded will not be excluded from the educational programme merely for refusing promotional photography consent.
Where practical, photographers and programme staff will be informed of individuals who should not appear in identifiable promotional images.
Consent to the future use of an identifiable photograph or recording may be withdrawn at any time by contacting:
Please provide enough information for us to identify the relevant image or recording.
Where consent is withdrawn, Decrypthut will stop new uses of the relevant identifiable image and, where reasonably practicable, remove it from websites, social-media accounts and other digital channels under Decrypthut’s control.
Withdrawal does not make previous lawful use of an image unlawful.
It may not always be possible to retrieve:
However, we will take reasonable steps within our control in response to a valid removal request.
We will not normally publish a child’s full name alongside an identifiable image unless there is a clear reason and appropriate permission.
Safeguarding information may need to be used or disclosed where necessary to protect a child or another person.
Depending on the circumstances, information may be shared with:
Where there is a safeguarding risk, we may share relevant information without consent where the law permits or requires this.
Our safeguarding arrangements are set out in our Safeguarding and Child Protection Policy.
Where necessary and lawful, information may be shared with:
We require service providers handling information on our behalf to protect it appropriately.
Some technology providers may process information outside the United Kingdom.
Where personal information is transferred internationally, we take appropriate steps required by UK data protection law, which may include reliance on UK adequacy regulations or approved contractual safeguards.
We may send information about Decrypthut programmes, opportunities or services where permitted by law.
Where consent is required, we will obtain it.
You may opt out of direct marketing at any time by using an unsubscribe facility where provided or contacting:
We may retain limited information necessary to record and respect an opt-out request.
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, contractual, safeguarding, insurance and dispute-resolution requirements.
Safeguarding records may need to be retained for longer periods because concerns can remain relevant after programme participation ends.
When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.
We use appropriate technical and organisational measures designed to protect personal information from:
Access to personal and safeguarding information is restricted according to role and need.
Depending on the circumstances, you may have the right to:
These rights are not absolute and legal exceptions may apply.
To exercise a right, contact:
We may need to verify your identity before responding.
If you have concerns about how Decrypthut uses your personal information, please contact us first at:
You also have the right to complain to the UK Information Commissioner’s Office.
Our website uses cookies and similar technologies as described in our Cookie Policy.
We may update this Privacy Policy to reflect changes to our services, technology, business or legal requirements.
The current version will be published on our website.
Decrypthut Limited
Company number: 13085156
71–75 Shelton Street, London, WC2H 9JQ
info@decrypthut.com
