Privacy Policy
Last updated: 29 April 2026
Introduction
The Website is offered from the United Kingdom by Norhi Ltd (referred to in this Notice as “our”, “us”, “Norhi” and “we”), a company registered in England and Wales.
We are committed to protecting and respecting your privacy. This Privacy Notice (together with any other documents referred to herein) sets out the basis on which the personal data collected from you, or that you provide to Us, will be processed by Us in connection with Our website and general enquiries processes. Please read the following carefully to understand Our views and practices regarding your personal data and how We will treat it.
For the purposes of UK data protection law, Norhi Ltd acts as Data Controller in respect of personal data collected directly through this website and general enquiries. Where a school transfers pupil or staff data to us for the delivery of a Norhi programme, the school is the Data Controller and Norhi acts as Data Processor on the school’s behalf, processing data only on the school’s documented instructions. Where Norhi acts as Data Processor, the processing will be governed by a Data Processing Agreement between Norhi and the school. We are in the process of putting formal Data Processing Agreements in place with all school partners; in the interim, Norhi commits to processing pupil data only for the purposes described in this notice and in accordance with UK GDPR. Schools may request a copy of our standard Data Processing Agreement by contacting enquiries@norhi.io.
Please note: where you apply for a job opening posted by Us, these Privacy Notice provisions will apply to Our processing of your personal information.
Your Personal Information
Information We collect from You
We collect and process some or all of the following types of information from you:
Pupil and teacher account data is transferred to us from schools via our Wonde MIS integration, which each school must separately authorise. The data fields received are: first name, surname, school email address, and current school year group. No additional data fields are received from Wonde. Pupils and teachers authenticate on our platform using Google Single Sign-On (SSO); in doing so, Google processes authentication credentials on our behalf as a data processor. We do not receive or store passwords.
Information that you provide when you submit an enquiry via our website. This includes information provided through our enquiry form, via email, or by any other method. In particular, We process personal details such as name, email address, role, and the organisation you work for, together with any other details included in your enquiry.
If you contact Us, We may keep a record of that correspondence.
Details of all actions that you carry out through the use of the Services.
Details of your visits to Norhi's Website including, but not limited to, traffic data, location data, weblogs and other communication data, the site that referred you to Norhi Website and the resources that you access.
Information We Collect From Other Sources
Where we receive personal data about you from a school or other third party in connection with our programmes, we will only process that data as described in this Privacy Notice and in any Data Processing Agreement in place with that school.
Uses Made Of Your Information
Lawful basis for processing
We rely on the following lawful bases under UK GDPR Article 6, depending on the nature of the data and the purpose of processing: (a) contractual necessity – where processing is necessary to deliver a programme commissioned by a school; (b) legitimate interests – for website analytics and improving our services, where we have assessed that our interests are not overridden by your rights; and (c) legitimate interests – where we send a one-time programme progress report to a parent or guardian email address voluntarily provided by the pupil within the app. We have assessed that our interest in keeping parents informed of their child’s programme progress is not overridden by the parent’s privacy interests, given the single, expected, and non-marketing nature of that communication. Parents may opt out at any time by contacting enquiries@norhi.io. Given that our programmes are used by children, we apply the highest standard of care to all processing of children’s personal data and do not rely on legitimate interests as a basis for processing children’s data on the platform itself.
Purposes of processing
We use information held about you in the following ways:
On the basis that there is a contract between Us and you. We process your data in order to fulfil this contract.
Pupil and teacher data received via Wonde is used to provision accounts on our platform. Users authenticate via Google SSO. This enables teachers to facilitate the programme, monitor engagement, and award virtual currency. It enables pupils to participate in programme activities and track their own progress. Parents may receive a one-time progress report at the end of the programme where a parent email address has been voluntarily provided by the pupil.
To communicate with you in response to enquiries.
To retain pupil records so that a pupil may participate in future Norhi programmes (for example, a pupil completing a primary school programme may later enrol in a secondary school programme). Data is retained for up to 8 years from the date of last programme participation, after which it is securely deleted.
To help improve the usefulness and effectiveness of our website, using aggregated and anonymised analytics data only.
To communicate with schools and prospective school partners in response to enquiries about our programmes.
Processing payments. All payments are processed by stripe.com.
How We Store Your Personal Data
Security
We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where We are legally required to do so.
Unfortunately, the transmission of information via the internet is not completely secure. Although We will do Our best to protect your personal data, We cannot guarantee the security of your data transmitted through any online means, therefore any transmission remains at your own risk.
Where We store your personal data
Where We store your personal data in on the cloud, within the European Economic Area (“EEA”).
If you would like further information please contact Us via enquiries@norhi.io. We will not otherwise transfer your personal data outside of the EEA or to any organisation (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.
How long we keep your personal data
We will hold pupil programme records for a period of up to 8 years from the date of last programme participation. This period reflects the possibility that a pupil completing a primary school programme may subsequently enrol in a secondary school programme. After this period, data is securely deleted. Parent or guardian email addresses provided voluntarily by pupils for the purpose of the progress report are retained for no longer than 30 days following dispatch of the report, after which they are securely deleted. Website enquiry data is retained for up to 6 years in line with the Limitation Act 1980.
Your rights
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have a number of important rights, which you may exercise free of charge. In summary, those include rights to:
access to your personal data and to certain other supplementary information that this Privacy Notice is already designed to address
require Us to correct any mistakes in your information which We hold
require the erasure of personal data concerning you in certain situations
receive the personal data concerning you which you have provided to Us, in a structured, commonly used and machine-readable format
object at any time to processing of personal data concerning you for direct marketing
object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you
object in certain other situations to our continued processing of your personal data otherwise restrict our processing of your personal data in certain circumstances
claim compensation for damages caused by our breach of any data protection laws.
Further information
If you have any questions, comments or complaints about this Notice or wish to: (i) exercise any of the rights described above; (ii) make any other type of request in relation to the processing of your Data; or (iii) report a concern or complaint related to the processing of your Data; you should contact: enquiries@norhi.io
We hope that we will be able to address any of your requests. However, you have the right to make a complaint about the processing of your personal data to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.