Privacy Policy
Effective date: 20 August 2026. This Privacy Policy explains how GWIH LIMITED (“we”, “us”, “our”), operating the website gwih.work from 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom, collects, uses, stores, shares and protects personal data in connection with Educational Technology Services and related professional services in the United Kingdom.
Controller contact: GWIH LIMITED, 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom. Email: dev.team@gwih.work. Telephone: +44 7312 987654. Website: https://gwih.work.
1. Scope and governing law
This Policy applies to personal data processed when you visit our website, submit a batch request or contact form, communicate with us by email or telephone, engage us for computer systems design, custom computer programming, learning management systems, e-learning software, virtual classroom platforms, student management systems, mobile learning applications, cloud education solutions, digital learning services or education technology consulting, or otherwise interact with our staff in the United Kingdom.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) as amended, and other applicable UK laws. Where a client engages us as a processor, a separate data processing agreement will govern that processing; this Policy describes our controller activities and general practices.
2. Categories of personal data
Depending on your interaction, we may process identity and contact data such as name, job title, organisation, email address, telephone number and postal address; communication content including messages, attachments and meeting notes; technical data such as IP address, browser type, device type, referring URL, pages viewed, timestamps and approximate location derived from IP; transaction and contract data including proposals, statements of work, invoices and payment references; and professional preference data relating to project interests in educational technology programmes.
We do not seek special category data through the public website. Please do not submit health data, pupil records containing special category information, or other sensitive learner data via the public contact form. If a project requires processing of learner or staff special category data, that processing will be scoped in contract with appropriate safeguards.
3. Sources of data
We obtain data directly from you when you complete forms or communicate with us; automatically through cookies and similar technologies as described in our Cookie Policy; from your organisation when it names you as a contact; and occasionally from publicly available professional sources such as company websites or professional directories where relevant to legitimate business development in Educational Technology Services.
4. Purposes and lawful bases
We process personal data to operate and secure the website; respond to enquiries and provide quotations; negotiate and perform contracts; manage client relationships; improve services and website usability; comply with legal obligations including accounting and tax; establish, exercise or defend legal claims; and, where permitted, send relevant professional updates. Lawful bases include Article 6(1)(b) contract, Article 6(1)(c) legal obligation, Article 6(1)(f) legitimate interests, and Article 6(1)(a) consent where required, for example for non-essential cookies or certain electronic marketing.
Our legitimate interests include operating a professional Educational Technology Services business, securing systems, understanding aggregated website usage, and communicating with organisational contacts about services that may reasonably interest them. We balance these interests against your rights and expectations.
5. Cookies and similar technologies
We use cookies and similar technologies as described in our Cookie Policy. Essential cookies support security and basic functionality. Analytics or preference cookies, if used, will be subject to consent where required by PECR and UK GDPR.
6. Sharing and international transfers
We may share personal data with service providers who host websites, email, cloud infrastructure, analytics, accounting or professional advisors under confidentiality and data processing terms; with regulators or law enforcement when legally required; and with counterparties in corporate transactions under appropriate safeguards. We do not sell personal data.
If personal data is transferred outside the United Kingdom, we implement appropriate safeguards such as the UK International Data Transfer Agreement, Addendum to the EU Standard Contractual Clauses, or adequacy regulations as applicable.
7. Retention
We retain personal data only as long as necessary for the purposes described. Enquiry data is typically retained for up to twenty-four months unless a relationship continues. Contract records are retained for the life of the engagement and thereafter for statutory limitation and accounting periods, commonly six to seven years in the United Kingdom. Server logs may be retained for shorter security windows. Retention may be extended where needed for disputes or legal holds.
8. Security
We apply organisational and technical measures appropriate to risk, including access controls, encryption in transit where applicable, staff confidentiality expectations, vendor due diligence and incident response procedures. No method of transmission or storage is perfectly secure; we work to reduce risk proportionate to Educational Technology Services contexts.
9. Your rights
Under UK GDPR you may have rights to access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests or direct marketing, and withdrawal of consent where processing relies on consent. You may complain to the Information Commissioner’s Office (ICO). To exercise rights, contact us at the details above. We may need to verify identity before fulfilling requests.
10. Children
Our public website is directed to organisational buyers and professionals, not to children. We do not knowingly collect personal data from children through the public site. Client projects involving learners will address age-appropriate design and safeguarding in contractual documentation.
11. Automated decision-making
We do not use solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning website visitors.
12. Third-party links
Our website may link to third-party sites such as mapping providers. Their privacy practices are governed by their own policies. We encourage you to review those policies.
13. Changes
We may update this Privacy Policy to reflect legal, technical or business changes. The effective date will be revised and, where appropriate, we will provide additional notice. Continued use of the website after changes constitutes awareness of the updated Policy, without limiting mandatory notice rights.
14. Contact
Questions about this Privacy Policy or our data practices should be directed to dev.team@gwih.work or by post to GWIH LIMITED, 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom, United Kingdom.
Additional operational provisions set 1
In further detail regarding purpose 1, GWIH LIMITED documents the necessity of processing personal data to deliver Educational Technology Services, including coordination of learning management systems programmes and related consulting, while minimising data fields to those required for the stated purpose.
For enquiry 2, message content may include organisational context about online education platforms or e-learning software development; such content is used only to assess fit, prepare responses and, if instructed, open a formal engagement.
Security measure set 3 may include unique credentials for staff, least-privilege access to client folders, and review of vendor assurances for hosting providers supporting https://gwih.work.
Retention schedule note 4: draft proposals that do not convert may be archived or deleted after the enquiry retention window unless longer retention is required for legitimate interests such as defending claims.
Legitimate interests assessment point 5: contacting a business email about digital learning services after a prior professional interaction is evaluated against expectations of a UK B2B Educational Technology Services provider.
Processor instruction example 6: where GWIH LIMITED hosts or develops student management systems under client instruction, the client remains controller of learner data and GWIH LIMITED processes only on documented instructions.
Transfer assessment 7: if a subprocessors’ infrastructure stores backups outside the UK, GWIH LIMITED reviews transfer tools and supplementary measures before personal data is placed in that environment.
Rights fulfilment step 8: access requests are logged, identity checked where proportionate, and responded to within UK GDPR timescales unless complexity justifies an extension with notice.
Marketing governance 9: where electronic marketing requires consent, records of consent language, timestamp and method are retained; opt-out requests are honoured promptly.
Incident readiness 10: suspected personal data breaches are assessed for risk to individuals and reported to the ICO and affected individuals when legally required, with remediation tracked.
Website telemetry note 11: aggregated statistics about page popularity assist improvement of information architecture for services pages describing EdTech Solutions without identifying individuals where possible.
Vendor due diligence item 12: contracts with email and hosting providers include confidentiality, security and deletion assistance clauses aligned with UK GDPR Article 28 principles.
Cross-functional training point 13: staff handling contact forms are instructed not to request special category learner data through public channels and to redirect such needs into secured project channels.
Records of processing entry 14: categories of data subjects include prospective clients, clients, suppliers and website visitors interacting with gwih.work.
Accountability artefact 15: this Privacy Policy, Cookie Policy and internal procedures together demonstrate GWIH LIMITED’s commitment to transparent processing for Professional Scientific and Technical Services contexts.
Hatfield operations note 16: physical correspondence to 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom is handled by authorised personnel and stored according to the retention schedule applicable to the document type.
Telephone handling 17: calls to +44 7312 987654 may generate notes of organisational requirements; callers are informed where recording is used, if ever introduced.
Form validation 18: technical validation of email format reduces misdirected communications and helps protect integrity of enquiry records associated with dev.team@gwih.work.
Contract lifecycle 19: during Statements of Work for Custom Computer Programming Services, personal data of named stakeholders is used for delivery coordination and escalation paths.
End-of-engagement 20: upon project closure, access credentials are revoked and personal data held as controller is reviewed for return, deletion or continued retention under a lawful basis.
Additional operational provisions set 2
In further detail regarding purpose 21, GWIH LIMITED documents the necessity of processing personal data to deliver Educational Technology Services, including coordination of learning management systems programmes and related consulting, while minimising data fields to those required for the stated purpose.
For enquiry 22, message content may include organisational context about online education platforms or e-learning software development; such content is used only to assess fit, prepare responses and, if instructed, open a formal engagement.
Security measure set 23 may include unique credentials for staff, least-privilege access to client folders, and review of vendor assurances for hosting providers supporting https://gwih.work.
Retention schedule note 24: draft proposals that do not convert may be archived or deleted after the enquiry retention window unless longer retention is required for legitimate interests such as defending claims.
Legitimate interests assessment point 25: contacting a business email about digital learning services after a prior professional interaction is evaluated against expectations of a UK B2B Educational Technology Services provider.
Processor instruction example 26: where GWIH LIMITED hosts or develops student management systems under client instruction, the client remains controller of learner data and GWIH LIMITED processes only on documented instructions.
Transfer assessment 27: if a subprocessors’ infrastructure stores backups outside the UK, GWIH LIMITED reviews transfer tools and supplementary measures before personal data is placed in that environment.
Rights fulfilment step 28: access requests are logged, identity checked where proportionate, and responded to within UK GDPR timescales unless complexity justifies an extension with notice.
Marketing governance 29: where electronic marketing requires consent, records of consent language, timestamp and method are retained; opt-out requests are honoured promptly.
Incident readiness 30: suspected personal data breaches are assessed for risk to individuals and reported to the ICO and affected individuals when legally required, with remediation tracked.
Website telemetry note 31: aggregated statistics about page popularity assist improvement of information architecture for services pages describing EdTech Solutions without identifying individuals where possible.
Vendor due diligence item 32: contracts with email and hosting providers include confidentiality, security and deletion assistance clauses aligned with UK GDPR Article 28 principles.
Cross-functional training point 33: staff handling contact forms are instructed not to request special category learner data through public channels and to redirect such needs into secured project channels.
Records of processing entry 34: categories of data subjects include prospective clients, clients, suppliers and website visitors interacting with gwih.work.
Accountability artefact 35: this Privacy Policy, Cookie Policy and internal procedures together demonstrate GWIH LIMITED’s commitment to transparent processing for Professional Scientific and Technical Services contexts.
Hatfield operations note 36: physical correspondence to 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom is handled by authorised personnel and stored according to the retention schedule applicable to the document type.
Telephone handling 37: calls to +44 7312 987654 may generate notes of organisational requirements; callers are informed where recording is used, if ever introduced.
Form validation 38: technical validation of email format reduces misdirected communications and helps protect integrity of enquiry records associated with dev.team@gwih.work.
Contract lifecycle 39: during Statements of Work for Custom Computer Programming Services, personal data of named stakeholders is used for delivery coordination and escalation paths.
End-of-engagement 40: upon project closure, access credentials are revoked and personal data held as controller is reviewed for return, deletion or continued retention under a lawful basis.
Additional operational provisions set 3
In further detail regarding purpose 41, GWIH LIMITED documents the necessity of processing personal data to deliver Educational Technology Services, including coordination of learning management systems programmes and related consulting, while minimising data fields to those required for the stated purpose.
For enquiry 42, message content may include organisational context about online education platforms or e-learning software development; such content is used only to assess fit, prepare responses and, if instructed, open a formal engagement.
Security measure set 43 may include unique credentials for staff, least-privilege access to client folders, and review of vendor assurances for hosting providers supporting https://gwih.work.
Retention schedule note 44: draft proposals that do not convert may be archived or deleted after the enquiry retention window unless longer retention is required for legitimate interests such as defending claims.
Legitimate interests assessment point 45: contacting a business email about digital learning services after a prior professional interaction is evaluated against expectations of a UK B2B Educational Technology Services provider.
Processor instruction example 46: where GWIH LIMITED hosts or develops student management systems under client instruction, the client remains controller of learner data and GWIH LIMITED processes only on documented instructions.
Transfer assessment 47: if a subprocessors’ infrastructure stores backups outside the UK, GWIH LIMITED reviews transfer tools and supplementary measures before personal data is placed in that environment.
Rights fulfilment step 48: access requests are logged, identity checked where proportionate, and responded to within UK GDPR timescales unless complexity justifies an extension with notice.
Marketing governance 49: where electronic marketing requires consent, records of consent language, timestamp and method are retained; opt-out requests are honoured promptly.
Incident readiness 50: suspected personal data breaches are assessed for risk to individuals and reported to the ICO and affected individuals when legally required, with remediation tracked.
Website telemetry note 51: aggregated statistics about page popularity assist improvement of information architecture for services pages describing EdTech Solutions without identifying individuals where possible.
Vendor due diligence item 52: contracts with email and hosting providers include confidentiality, security and deletion assistance clauses aligned with UK GDPR Article 28 principles.
Cross-functional training point 53: staff handling contact forms are instructed not to request special category learner data through public channels and to redirect such needs into secured project channels.
Records of processing entry 54: categories of data subjects include prospective clients, clients, suppliers and website visitors interacting with gwih.work.
Accountability artefact 55: this Privacy Policy, Cookie Policy and internal procedures together demonstrate GWIH LIMITED’s commitment to transparent processing for Professional Scientific and Technical Services contexts.
Hatfield operations note 56: physical correspondence to 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom is handled by authorised personnel and stored according to the retention schedule applicable to the document type.
Telephone handling 57: calls to +44 7312 987654 may generate notes of organisational requirements; callers are informed where recording is used, if ever introduced.
Form validation 58: technical validation of email format reduces misdirected communications and helps protect integrity of enquiry records associated with dev.team@gwih.work.
Contract lifecycle 59: during Statements of Work for Custom Computer Programming Services, personal data of named stakeholders is used for delivery coordination and escalation paths.
End-of-engagement 60: upon project closure, access credentials are revoked and personal data held as controller is reviewed for return, deletion or continued retention under a lawful basis.
Additional operational provisions set 4
In further detail regarding purpose 61, GWIH LIMITED documents the necessity of processing personal data to deliver Educational Technology Services, including coordination of learning management systems programmes and related consulting, while minimising data fields to those required for the stated purpose.
For enquiry 62, message content may include organisational context about online education platforms or e-learning software development; such content is used only to assess fit, prepare responses and, if instructed, open a formal engagement.
Security measure set 63 may include unique credentials for staff, least-privilege access to client folders, and review of vendor assurances for hosting providers supporting https://gwih.work.
Retention schedule note 64: draft proposals that do not convert may be archived or deleted after the enquiry retention window unless longer retention is required for legitimate interests such as defending claims.
Legitimate interests assessment point 65: contacting a business email about digital learning services after a prior professional interaction is evaluated against expectations of a UK B2B Educational Technology Services provider.
Processor instruction example 66: where GWIH LIMITED hosts or develops student management systems under client instruction, the client remains controller of learner data and GWIH LIMITED processes only on documented instructions.
Transfer assessment 67: if a subprocessors’ infrastructure stores backups outside the UK, GWIH LIMITED reviews transfer tools and supplementary measures before personal data is placed in that environment.
Rights fulfilment step 68: access requests are logged, identity checked where proportionate, and responded to within UK GDPR timescales unless complexity justifies an extension with notice.
Marketing governance 69: where electronic marketing requires consent, records of consent language, timestamp and method are retained; opt-out requests are honoured promptly.
Incident readiness 70: suspected personal data breaches are assessed for risk to individuals and reported to the ICO and affected individuals when legally required, with remediation tracked.
Website telemetry note 71: aggregated statistics about page popularity assist improvement of information architecture for services pages describing EdTech Solutions without identifying individuals where possible.
Vendor due diligence item 72: contracts with email and hosting providers include confidentiality, security and deletion assistance clauses aligned with UK GDPR Article 28 principles.
Cross-functional training point 73: staff handling contact forms are instructed not to request special category learner data through public channels and to redirect such needs into secured project channels.
Records of processing entry 74: categories of data subjects include prospective clients, clients, suppliers and website visitors interacting with gwih.work.
Accountability artefact 75: this Privacy Policy, Cookie Policy and internal procedures together demonstrate GWIH LIMITED’s commitment to transparent processing for Professional Scientific and Technical Services contexts.
Hatfield operations note 76: physical correspondence to 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom is handled by authorised personnel and stored according to the retention schedule applicable to the document type.
Telephone handling 77: calls to +44 7312 987654 may generate notes of organisational requirements; callers are informed where recording is used, if ever introduced.
Form validation 78: technical validation of email format reduces misdirected communications and helps protect integrity of enquiry records associated with dev.team@gwih.work.
Contract lifecycle 79: during Statements of Work for Custom Computer Programming Services, personal data of named stakeholders is used for delivery coordination and escalation paths.
End-of-engagement 80: upon project closure, access credentials are revoked and personal data held as controller is reviewed for return, deletion or continued retention under a lawful basis.
Additional operational provisions set 5
In further detail regarding purpose 81, GWIH LIMITED documents the necessity of processing personal data to deliver Educational Technology Services, including coordination of learning management systems programmes and related consulting, while minimising data fields to those required for the stated purpose.
For enquiry 82, message content may include organisational context about online education platforms or e-learning software development; such content is used only to assess fit, prepare responses and, if instructed, open a formal engagement.
Security measure set 83 may include unique credentials for staff, least-privilege access to client folders, and review of vendor assurances for hosting providers supporting https://gwih.work.
Retention schedule note 84: draft proposals that do not convert may be archived or deleted after the enquiry retention window unless longer retention is required for legitimate interests such as defending claims.
Legitimate interests assessment point 85: contacting a business email about digital learning services after a prior professional interaction is evaluated against expectations of a UK B2B Educational Technology Services provider.
Processor instruction example 86: where GWIH LIMITED hosts or develops student management systems under client instruction, the client remains controller of learner data and GWIH LIMITED processes only on documented instructions.
Transfer assessment 87: if a subprocessors’ infrastructure stores backups outside the UK, GWIH LIMITED reviews transfer tools and supplementary measures before personal data is placed in that environment.
Rights fulfilment step 88: access requests are logged, identity checked where proportionate, and responded to within UK GDPR timescales unless complexity justifies an extension with notice.
Marketing governance 89: where electronic marketing requires consent, records of consent language, timestamp and method are retained; opt-out requests are honoured promptly.
Incident readiness 90: suspected personal data breaches are assessed for risk to individuals and reported to the ICO and affected individuals when legally required, with remediation tracked.
Website telemetry note 91: aggregated statistics about page popularity assist improvement of information architecture for services pages describing EdTech Solutions without identifying individuals where possible.
Vendor due diligence item 92: contracts with email and hosting providers include confidentiality, security and deletion assistance clauses aligned with UK GDPR Article 28 principles.
Cross-functional training point 93: staff handling contact forms are instructed not to request special category learner data through public channels and to redirect such needs into secured project channels.
Records of processing entry 94: categories of data subjects include prospective clients, clients, suppliers and website visitors interacting with gwih.work.
Accountability artefact 95: this Privacy Policy, Cookie Policy and internal procedures together demonstrate GWIH LIMITED’s commitment to transparent processing for Professional Scientific and Technical Services contexts.
Hatfield operations note 96: physical correspondence to 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom is handled by authorised personnel and stored according to the retention schedule applicable to the document type.
Telephone handling 97: calls to +44 7312 987654 may generate notes of organisational requirements; callers are informed where recording is used, if ever introduced.
Form validation 98: technical validation of email format reduces misdirected communications and helps protect integrity of enquiry records associated with dev.team@gwih.work.
Contract lifecycle 99: during Statements of Work for Custom Computer Programming Services, personal data of named stakeholders is used for delivery coordination and escalation paths.
End-of-engagement 100: upon project closure, access credentials are revoked and personal data held as controller is reviewed for return, deletion or continued retention under a lawful basis.
Additional operational provisions set 6
In further detail regarding purpose 101, GWIH LIMITED documents the necessity of processing personal data to deliver Educational Technology Services, including coordination of learning management systems programmes and related consulting, while minimising data fields to those required for the stated purpose.
For enquiry 102, message content may include organisational context about online education platforms or e-learning software development; such content is used only to assess fit, prepare responses and, if instructed, open a formal engagement.
Security measure set 103 may include unique credentials for staff, least-privilege access to client folders, and review of vendor assurances for hosting providers supporting https://gwih.work.
Retention schedule note 104: draft proposals that do not convert may be archived or deleted after the enquiry retention window unless longer retention is required for legitimate interests such as defending claims.
Legitimate interests assessment point 105: contacting a business email about digital learning services after a prior professional interaction is evaluated against expectations of a UK B2B Educational Technology Services provider.
Processor instruction example 106: where GWIH LIMITED hosts or develops student management systems under client instruction, the client remains controller of learner data and GWIH LIMITED processes only on documented instructions.
Transfer assessment 107: if a subprocessors’ infrastructure stores backups outside the UK, GWIH LIMITED reviews transfer tools and supplementary measures before personal data is placed in that environment.
Rights fulfilment step 108: access requests are logged, identity checked where proportionate, and responded to within UK GDPR timescales unless complexity justifies an extension with notice.
Marketing governance 109: where electronic marketing requires consent, records of consent language, timestamp and method are retained; opt-out requests are honoured promptly.
Incident readiness 110: suspected personal data breaches are assessed for risk to individuals and reported to the ICO and affected individuals when legally required, with remediation tracked.
Website telemetry note 111: aggregated statistics about page popularity assist improvement of information architecture for services pages describing EdTech Solutions without identifying individuals where possible.
Vendor due diligence item 112: contracts with email and hosting providers include confidentiality, security and deletion assistance clauses aligned with UK GDPR Article 28 principles.
Cross-functional training point 113: staff handling contact forms are instructed not to request special category learner data through public channels and to redirect such needs into secured project channels.
Records of processing entry 114: categories of data subjects include prospective clients, clients, suppliers and website visitors interacting with gwih.work.
Accountability artefact 115: this Privacy Policy, Cookie Policy and internal procedures together demonstrate GWIH LIMITED’s commitment to transparent processing for Professional Scientific and Technical Services contexts.
Hatfield operations note 116: physical correspondence to 84 Parkhouse Court, HATFIELD, AL10 9QZ United Kingdom is handled by authorised personnel and stored according to the retention schedule applicable to the document type.
Telephone handling 117: calls to +44 7312 987654 may generate notes of organisational requirements; callers are informed where recording is used, if ever introduced.
Form validation 118: technical validation of email format reduces misdirected communications and helps protect integrity of enquiry records associated with dev.team@gwih.work.
Contract lifecycle 119: during Statements of Work for Custom Computer Programming Services, personal data of named stakeholders is used for delivery coordination and escalation paths.
End-of-engagement 120: upon project closure, access credentials are revoked and personal data held as controller is reviewed for return, deletion or continued retention under a lawful basis.
Additional operational provisions set 7
In further detail regarding purpose 121, GWIH LIMITED documents the necessity of processing personal data to deliver Educational Technology Services, including coordination of learning management systems programmes and related consulting, while minimising data fields to those required for the stated purpose.
For enquiry 122, message content may include organisational context about online education platforms or e-learning software development; such content is used only to assess fit, prepare responses and, if instructed, open a formal engagement.
Security measure set 123 may include unique credentials for staff, least-privilege access to client folders, and review of vendor assurances for hosting providers supporting https://gwih.work.
Retention schedule note 124: draft proposals that do not convert may be archived or deleted after the enquiry retention window unless longer retention is required for legitimate interests such as defending claims.
Legitimate interests assessment point 125: contacting a business email about digital learning services after a prior professional interaction is evaluated against expectations of a UK B2B Educational Technology Services provider.