Privacy Policy

We collect the following categories of personal information to ensure a smooth application process and deliver the best programme experience:

• Identifiers: Name, email address, date of birth, and contact information.
• Educational Information: School name, grade, academic history (e.g., scores, test results).
• Programme-Related Information: Essays, motivation statements, and projects submitted as part of the application process or programme activities.
• Attachments: Documents such as recommendation letters, résumés, and evidence of academic performance.
• Sensitive Information: Proof of family income, if applying for a need-based scholarship. This information is deleted or anonymised once eligibility is determined, unless required by law.
• Commercial Information: Billing and transaction details to process payments securely through our third-party provider, Stripe. Sensitive payment data, such as credit card numbers, is handled directly by Stripe in compliance with their security standards.
• Internet or Usage Data: Information on how you interact with our website, including pages visited, time spent on the site, navigation patterns, and engagement with our content. This data is collected through cookies and similar technologies, including optional tools like Google Analytics, Google Ads, Meta Pixel, and Reddit Pixel, which track user interaction for analytics and marketing purposes when consent is provided.
• Club Information: When students join a Hinksey Club (see Appendix A - Hinksey Clubs in our Terms of Service), we collect membership details (e.g., name, email, school or host venue, graduation year or age band, role in the Club), event registrations and attendance records, and any updates, photos or materials students or Club Leaders choose to share.

We process your personal data under the following legal bases:

• Contractual Necessity: To evaluate your application, enrol you in the programme, and provide services you request. This also includes registering you as a Club member and managing your participation in Club events.
• Legitimate Interests: To improve our programme, communicate updates related to the services you've signed up for, support Club Leaders, recognise Club achievements and maintain the security of our website and events.
• Consent: For optional data like proof of income for scholarships, sending marketing communications, or tracking user behaviour through non-essential cookies. For visitors from the United States, non-essential cookies instead operate on a notice-and-opt-out basis rather than prior consent, as described in the same section below. You can withdraw consent, or opt out, at any time by contacting us at team@hinkseylabs.com, using the "unsubscribe" link in our marketing emails, or where relevant changing your cookie preferences through the methods described in the Cookies and Tracking Technologies section of this policy.
• Legal Obligations: To comply with applicable laws and regulations.

We use the information you share with us to:

• Evaluate your application and help you join the programme.
• Customise your learning experience and provide support.
• Communicate updates about the programme, events, and opportunities.
• Improve the programme and ensure compliance with legal obligations.
• Facilitate secure payment processing through our third-party provider, Stripe, without storing sensitive payment details like credit card numbers on our servers.
• Analyse website usage and optimise content delivery using cookies and tracking tools.
• If you apply for a scholarship, we use optional data (like proof of income) only to determine eligibility.
• For Clubs, monitor member lists and event attendance, provide support to Club Leaders, verify eligibility for stipends or recognition, and, where consent is given, spotlight achievements.

• If you are under 18, we require consent from a parent or guardian to collect and process your personal data.
• If you are under 14, unfortunately you cannot use or join our programme, Clubs or website.

(A) We do not sell your personal information - ever. However, we may share it with:

• Service Providers: Companies that process data on our behalf, such as payment processors, hosting services, and email platforms, including MailerLite (newsletter and marketing communications) and Resend (application confirmations and other transactional emails).
• Programme Partners: Academic and industry experts involved in evaluating applications, delivering programme content, or assessing research-based project outputs.
• Marketing Communications: Trusted service providers, such as email marketing platforms (MailerLite), to send updates about our programmes, Clubs, events, or other opportunities. We will only send you these communications if you have explicitly opted in to receive them. You can withdraw your consent at any time by clicking the "unsubscribe" link in our emails or contacting us at team@hinkseylabs.com.
• Cookies and Tracking Tools Providers: We may share data collected through cookies and similar tracking technologies with trusted third-party providers, such as analytics and advertising platforms (e.g., Google Analytics, Google Ads, Meta Pixel, Reddit Pixel), to improve user experience, measure the performance of our advertising, and provide tailored content. Where you have consented to marketing cookies, form submissions may also be reported to these advertising platforms from our own server (for example via Meta's Conversions API), using securely hashed identifiers only. For further information, please refer to the Cookies and Tracking Technologies section of this policy.
• Legal Reasons: If required by law, we may share data with regulatory authorities or comply with legal obligations.
• Business Reasons: In the event of a merger, acquisition, or sale of our business, your data may be transferred to the acquiring organisation as part of the transaction.

Your personal information may be stored or processed in countries outside your jurisdiction, such as Europe, the United States, or other countries where our service providers operate. While these countries may have different data protection laws, we ensure your information is protected through:

• Standard Contractual Clauses (SCCs): Legal agreements approved under GDPR to ensure your data receives the same level of protection as in the European Economic Area (EEA).
• Additional Measures: Technical safeguards, such as encryption and pseudonymisation, to enhance data security during transfers.

• We will not include personal information (such as names or contact details) in any promotional materials without explicit consent from you or your parent/guardian.
• If you or your parent/guardian prefer that we do not use your photos, videos, or materials, you may notify us at any time by contacting us at team@hinkseylabs.com and we will ensure your preference is respected.

• Personal Information: We retain your personal information only for as long as necessary to stay in touch about future opportunities and improve our services. You can ask us to delete or anonymise your data at any time by emailing team@hinkseylabs.com. Upon receiving your request, we will securely delete or anonymise your data unless we are required to retain it to comply with legal obligations.
• Cookies and Tracking Data: Please refer to the Cookies and Tracking Technologies section of this policy.

We take your data security very seriously and use industry-standard tools and practices to protect your personal information from unauthorised access, loss, or misuse. Here's how we keep your data safe:

• Secure Storage: Data is stored in systems with encryption, access controls, and regular security updates.
• Limited Access: Only authorised personnel can access your information, and they are trained on data privacy practices.
• Regular Monitoring: We monitor for potential security threats and update our processes to address emerging risks.

We believe you should have control over your personal information. Here's how you can manage your data and stay in charge:

• See Your Data: Want to know what information we have about you or have its copy? Just ask, and we'll share it.
• Fix It: If something's not right or needs updating, let us know, and we'll correct it.
• Delete It: You can request that we delete your personal data, unless we need to keep it for legal reasons.
• Opt-Out: Don't want emails from us about future programmes or opportunities? You can unsubscribe at any time.

(A) Why Do We Use Cookies?

Cookies are small text files placed on your device (such as your computer, tablet, or smartphone) when you visit a website. We use cookies to:

• Ensure the Website Works Properly: Some cookies are essential for the website to function (e.g., enabling navigation and access to secure areas).
• Enhance Your Experience: Cookies save your preferences and make the site easier to use.
• Provide Analytics: To understand how visitors interact with our website, such as which pages are visited most often.
• Customise Content: Cookies help us show content that is more relevant to you.
• Support Marketing: Cookies may be used to display ads tailored to your interests, and to measure how well those ads perform, utilising third-party services such as Google Ads, Meta Pixel, and Reddit Pixel.

(B) Types of Cookies We Use:

• Strictly Necessary Cookies: Ensure the website functions properly.
• Performance Cookies: Analyse user behaviour to improve the website.
• Functional Cookies: Remember preferences to enhance your experience.
• Targeting/Advertising Cookies: Deliver tailored content or advertisements.

(C) Third-Party Cookies:

Some cookies are provided by third-party services, such as Google Analytics, Google Ads, Meta Pixel, or Reddit Pixel, which we load through Google Tag Manager. These services may set cookies to track user interaction or preferences as described below. Whether these tags are enabled by default depends on your region, which we determine from your IP address: for visitors in the United States they are enabled by default and you may opt out at any time, while for visitors elsewhere they are disabled by default and load only after you have given the corresponding consent.

• Google Tag Manager: Manages which of the tags below are loaded on the site, and applies your cookie choices to them. Google Tag Manager does not itself set cookies or collect personal information.
• Google Analytics: Collects data on how often users visit the site, which pages they visit, and how they arrive at the site.
• Google Ads: Measures which adverts led to enquiries, newsletter sign-ups, and applications, and may be used to show you our adverts elsewhere. Where you have consented to marketing cookies, a securely hashed (irreversibly scrambled) version of your email address may be sent to Google to match a sign-up or application to an advert click. Your email address is never transmitted in a readable form for this purpose.
• Meta Pixel: Tracks user behaviour to deliver targeted ads and measure ad performance across platforms. This includes interactions like clicks, conversions, and other engagement metrics. Where you have consented to marketing cookies, when you submit a form we may additionally report that conversion to Meta from our own server (Meta's "Conversions API"), including a securely hashed (irreversibly scrambled) version of your email address and name, so that conversions are measured reliably. Your details are never transmitted in a readable form for this purpose, and no server-side reporting occurs without your consent.
• Reddit Pixel: Measures the performance of adverts we run on Reddit and may be used to show you our adverts on that platform. It records interactions such as page views, sign-ups, and applications.

(D) Cookie Duration:

• Session Cookies: Deleted when you close your browser.
• Persistent Cookies: Remain on your device until deleted manually or automatically after a set duration.

(E) Managing Cookies:

When you first visit our website, you'll see a cookie banner. If you are visiting from the United States, the banner is a notice: non-essential cookies are active by default and the "Customise" option lets you switch any of them off (opt-out). If you are visiting from anywhere else, non-essential cookies stay off until you accept them through the banner (opt-in). Some browsers allow users to send a "Do Not Track" (DNT) signal to websites, indicating a preference not to be tracked. Currently, no standard has been adopted to govern how websites respond to DNT signals. Therefore, we do not change our practices in response to DNT signals at this time. However, you can control your cookies and change your consent at any time through the methods below.

• Browser Settings: Manage or delete cookies via browser settings.
• Withdrawing Consent: Adjust settings via the "Manage Cookies" option, located in the footer of our website, or at the top of this page.