Privacy policy

This website is translated using a plugin. There may be errors or inconsistencies.

If in doubt or have questions, please refer to the Entrant Handbook for the correct information:

Entrant Handbook (English) |  Entrant Handbook (French)  |  Entrant Handbook (Indonesian)  |  Entrant Handbook (Portuguese)  |  Entrant Handbook (Spanish)

For translated versions of this policy, please click on the below links:

• French translation
• Indonesian translation
• Portuguese translation
• Spanish translation

Please note this website is translated using a plugin. If you are viewing a translated version of this website and there are inconsistencies between the website and the translations above, please refer to the downloaded versions above for the correct information.

Any translated content (being content that is provided in a language other than English) published via this website, including any terms and conditions, policies or any other documents, is provided for informational purposes only. We exclude all representations or warranties as to accuracy and completeness of the translations and we shall not be liable for any inconsistencies, mistakes or mistranslation arising in connection with the translations. Please note that the English language versions of any such content and documents shall prevail. Any translations are not legally binding on us. In particular, we note that the translations of in-website text have been provided via an automatic plug-in tool and as a result there may be some inconsistencies between such content and the information included in the Terms and Conditions, the Privacy Policy and the Entrant Handbook which have been translated separately via an external service.

Privacy policy

• Introduction

We are running the Good Start Challenge which aims to accelerate the innovation of accessible, cost-effective solutions that promote the wellbeing of parents and caregivers of children aged 0-6 years (the “Programme”). You can find out more about the Programme on our website.

This privacy notice sets out how we collect and use your personal data if you are an applicant or participant in this Programme.

The Programme is being conducted in collaboration with the Bernard Van Leer Foundation, FEMSA Foundation, the Fundação Maria Cecilia Souto Vidigal (FMCSV) and the LEGO Foundation. 

• Contact details

Nesta (trading as Challenge Works) is the data controller and is responsible for your personal data collected in connection with this Programme. This means that we will be responsible for keeping your information safe and only using it for the purposes set out in this notice.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights in relation to your personal data, please contact the DPO and provide enough information to identify yourself (e.g. your name and address):

Email: dpo@nesta.org.uk

Post: 58 Victoria Embankment London UK EC4Y 0DS 

If you are unhappy about how we use your personal data or have a complaint, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please do contact us in the first instance.

• What personal data will we collect? 

We will collect directly from you the following personal data: 

• Sign-up details: If you register or sign up for events, newsletters or publications on the site, we will ask you for personal information such as your name, email address, occupation and other contact details such as a contact telephone number.
• Other application details (e.g. for services or funding): If you submit a tender to provide any services, apply for funding or support from Nesta, or enter the Prize, or register to attend one of our events, we may ask for more detailed information which we will use to process your application and you will be asked to agree to specific terms and conditions at the time of making the application.
• Feedback: We may also ask you for feedback about Nesta or to complete surveys. As a responsible organisation, we are committed to attracting and funding a diverse group of applicants to the Prize and want to improve how we do this. In order to allow us to do this better, we would like to collect some diversity monitoring information from those organisations we work with. The information you share will be anonymised and used to help inform the evaluation of the Prize. For the avoidance of doubt, any survey relating to demographic information will be confidential and none of the questions are mandatory. The information collected as part of the survey will have no impact on your application. 
• Online activity: We record your activity and preferences when visiting the sites through the use of cookies (see ‘Cookies’, below).
• Your posts and communications: If you post content or communicate via the site, we will also store and monitor your content and communications.

• What do we do with information we collect and what is our legal basis for this?

The purpose for which we are processing your personal data is to process your application and to administer and deliver the Programme. In addition we may use your data for the following purposes:

• Third party processors: We may use third party platforms and processors to deliver newsletters, process applications, event registrations, process payments, and process surveys. In using these third parties we are pursuing our legitimate interest to use third party technology to achieve greater efficiency within our organisation.  To balance our interests against yours, we have taken steps to ensure these third parties maintain appropriate technical and organisational measures to keep your personal information secure.
• Sign-up details: If you sign-up for us to send you newsletters, publications and other information about Nesta, our partners and activities (see ‘Marketing’ section below), we will use your personal information to send these to you. Our legal basis for doing this is your consent.  You have the right to withdraw this consent at any time, as explained in the ‘Marketing’ section below.
• Events: If you register to attend one of our events we will use your personal information to process your application to attend the event, take payment, if any, for our administration and management of the event and to send you any updates or information regarding the event. Our legal basis for doing so is to fulfil the agreement with you for your attendance.
  • We use Eventbrite as registration systems for many of our events and their servers are based in the United States (U.S.) and may store and process your information outside the United Kingdom (UK). See the Eventbrite privacy policy.
• Other application details: We will use your personal information to process applications you make via the site. We undertake this processing because it is necessary to fully assess your application, and if successful, to take steps to enter into an agreement with you (this is our legal basis for the processing). If you apply for funding or enter the Prize, you may be directed to another platform to process these applications. Some of these platforms may be managed by third parties other than us, and further details will be given to you when you start the application. Please ensure you always read the terms and conditions of those platforms when making any such applications, as when you submit an application you will be agreeing to the terms and conditions of those platforms. However, we remain the controller of your personal information in this arrangement – these third parties only process your personal information in line with our instructions.
• Feedback and surveys: If you agree to give us feedback or complete a survey, we will use the information to improve our work and activities. We usually use Alchemer (formerly Surveygizmo) to process surveys, and they only process your information on our instructions. Alchemer operates in the US and complies with relevant local data privacy requirements. Please see their privacy policy. If you agree to participate in any survey that will form part of any research project, we will tell you at the time you take part how your information will be used for the particular research project or programme, and how long it will be kept for. 
• Posts and Communications: If you post any comments on the website, any personal information you provide will be displayed publicly on the website along with your comments. You accept full responsibility for those postings.

For all kinds of information collected: Please make sure that any personal details you provide are accurate and up to date and let us know about any changes. Please get consent first before giving us anyone else’s information.

The nature of Nesta’s work means we often work in partnership with other organisations, however, we will not share your information with any other organisation without having your permission first, unless we have a legitimate interest to do so (see the ‘Who else has access to your information?’ section).

We may also use your information to carry out analysis and research to improve our publications, events and activities, customise our website and its content to your particular preferences, notify you of any changes to our website or to our activities that may affect you, to prevent and detect fraud and abuse, and to protect other users.

However you choose to engage with or support Nesta, we may retain your information for our own legitimate business interests for statistical analysis purposes, in order to review, develop and improve our business activities.  In this situation, we will only keep personal information if it is necessary to do so, and will always put in place appropriate safeguards, including where possible anonymising or minimising the data retained.

Legal basis

Data protection law requires us to have a specific legal basis for processing your personal data. For this Programme, our lawful basis will be:

• Legitimate business interest: We have a legitimate business interest in using your personal data to process your application to the Programme and administer and deliver the Programme. The Programme fulfils our organisation’s aims including undertaking innovative work that will deliver social impact.

As part of this Programme, we may collect special categories of personal data including ethnicity, but we will only do this in a way that will not identify you (i.e. it will be anonymised). We collect this information in order to be able to assess our performance against our equality, diversity and inclusion goals.  

• Who has access to your information?

Your information will be accessed by a limited number of staff in our Programme team working on this Programme.

We may share your personal data with the following organisations that we are collaborating with as part of this Programme: 

• The Van Leer Foundation, the primary funder of the Good Start Challenge, will also have access to personal details for all entrants such as your name, email address, and other contact details such as a contact telephone number as well as some application details to allow for approval for entering into agreements with you, if successful. Some feedback and demographic details may be provided to contribute to the Challenge evaluation; however, all data will be anonymised. Please see their privacy notice for more information.
• The LEGO Foundation, the funder of the Good Start Challenge in East Africa, will also have access to information for entrants only to the Uganda, Ethiopia and Kenya strands. This will include personal details such as your name, email address, and other contact details such as a contact telephone number as well as application details to allow for approval for entering into agreements with you, if successful. Some feedback and demographic details may be provided to contribute to the Challenge evaluation; however, all data will be anonymised. Please see their privacy notice for more information.
• Fundação Maria Cecilia Souto Vidigal, the funder of the Good Start Challenge in Brazil, will also have access to information for entrants only in Brazil. This will include personal details such as your name, email address, and other contact details such as a contact telephone number as well as application details to allow for approval for entering into agreements with you, if successful. Some feedback and demographic details may be provided to contribute to the Challenge evaluation; however, all data will be anonymised. It is hereby informed that the Foundation has internal governance processes for the protection of this data, through appropriate measures to guarantee data security, in accordance with Brazilian data processing legislation – Law No. 13,709/2018 – LGPD. Please see their privacy notice for more information.
• FEMSA Foundation, the funder of the Good Start Challenge in Mexico and Colombia, will also have access to information for entrants only to Mexico and Colombia strands. This will include personal details such as your name, email address, and other contact details such as a contact telephone number as well as application details to allow for approval for entering into agreements with you, if successful. Some feedback and demographic details may be provided to contribute to the Challenge evaluation; however, all data will be anonymised. FEMSA Foundation shall only use and access your personal information in a manner consistent with this privacy notice and otherwise in accordance with our instructions. 

We note that we are exploring the possibility of engaging additional funding partners for Indonesia and the Philippines. In the event a new funder is engaged in relation to the Challenge, that funder will have access to information for entrants to Indonesia and the Philippines consistent with the details shared in respect of the Van Leer Foundation above. We will publicly announce any new funders. 

In addition, we may disclose your information to third parties in connection with the purposes of processing your personal data set out in this notice.  These third parties may include:

• other companies in our group;
• regulators, law enforcement bodies and the courts, in order to comply with applicable laws and regulations, assist with regulatory enquiries, and cooperate with court mandated processes, including the conduct of litigation;
• suppliers, research assistants and sub-contractors who may process information on our behalf e.g. cloud services to store data, application and survey platforms. These third parties are known as data processors and when we use them we have contractual terms and policies and procedures in place to ensure that your personal data is protected. This does not always mean that they will have access to information that will directly identify you as we will share anonymised or pseudonymised data only wherever possible. We remain responsible for your personal information as the controller; and
• any third party to whom we are proposing to sell or transfer some or all of our business or assets.

We may also disclose your personal information if required by law, or to protect or defend ourselves or others against illegal or harmful activities, or as part of a reorganisation or restructuring of our organisations.

• International Transfers

As we (and many of the partners named in this notice) are based in the UK, we are subject to the UK GDPR and regulated by the Information Commissioner’s Office (our registration number is: Z307295X). Accordingly, your data will be transferred to the UK and we shall process your data in accordance with the UK GDPR and otherwise in keeping with the practices set out in this notice. 

Our global presence means that your personal data may also be transferred out of the UK and European Economic Area (“EEA“) where data protection laws may not be equivalent – for any of the purposes described in this notice.  Whenever we make restricted international transfers of personal data, we take steps to ensure that your personal data receives an adequate level of protection (by putting in place appropriate safeguards, such as contractual clauses), or to ensure that we are able to rely on an appropriate derogation under data protection laws.  You have a right to request access to any safeguard which we use to transfer your personal information outside of the UK and the EEA (although we may need to redact data transfer agreements for reasons of commercial confidentiality).

• Security

We take reasonable steps to protect your personal information and follow procedures designed to minimise unauthorised access, alteration, loss or disclosure of your information. 

1. Data Retention

General principle: We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When it is no longer necessary to retain your personal data, it will be securely deleted.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Taking the above factors into consideration, our anticipated date of deletion for your personal data is:

• For unsuccessful applicants: Three years after the end of the application process
• For successful applicants: Six years after the award contract has come to an end, or if the contract was executed as a deed, for 12 years.

During this time, we may contact you to provide you with opportunities to apply for similar programmes, funding or support in the future. If you do not wish to receive these you can opt out by following the link provided in our communication or by contacting the Data Protection Officer using the details set out at 2 above.  

In some circumstances, we will retain an anonymised dataset (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

In some circumstances, we will retain an anonymised dataset (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

• Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including rights to:

• Request access to your personal data: this enables you to receive a copy of the personal data we hold about you and to check we are lawfully processing it.
• Request correction of your personal data: this enables you to have any incomplete or inaccurate data we hold about you corrected.
• Request erasure of your personal data: this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
• Object to processing of your personal data: for example, you can object where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.
• Request restriction of processing your personal data: This enables you to ask us to suspend the processing of your personal data.
• Data portability: Where the processing takes place on the basis of your consent or contract, and is carried out by automated means, you have the right to request that we provide your personal data to you in a machine-readable format, or transmit it to a third party data controller, where technically feasible.
• Right to withdraw consent to the processing of your personal data: This applies where we have relied on consent to process personal data. Please note that withdrawal of consent will not affect the lawfulness of any processing carried out before withdrawing your consent.

If you wish to exercise any of the rights set out above, please send your specific request to the Data Protection Officer using the contact details provided at section 2

It is important to understand that the extent to which these rights apply to research will vary and that in some circumstances your rights may be restricted. Please also note that we can only comply with a request to exercise your rights during the period for which we hold personal information that identifies you. If personal data has been irreversibly anonymised and has become part of the research data set, it will not be possible for us to comply. 

• Changes to this Notice

We may change this Privacy Notice from time to time.  If we make any significant changes in the way we treat your personal information we will contact you directly.