Who we are
NEDness Ltd is a company incorporated in Jersey under the Companies (Jersey) Law 1991, with registered number 165842 and registered office at 2nd Floor, 3 Commercial Street, St Helier, Jersey. We operate the website nedness.com and provide a governance ecosystem for non-executive directors.
NEDness Ltd is the data controller for the personal information we collect through our website and services. This means we decide how and why your personal information is used.
Email: privacy@nedness.com
What this policy covers
This policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and your rights in relation to it. It applies to everyone who visits our website or registers with NEDness.
We are registered with the Jersey Office of the Information Commissioner (JOIC) as required under the Data Protection Authority (Jersey) Law 2018.
The law that applies
NEDness is based in Jersey and processes personal data under the Data Protection (Jersey) Law 2018 (DPJL). The DPJL is closely aligned with the European General Data Protection Regulation (GDPR), and the European Commission has confirmed that Jersey provides an adequate level of protection for personal data.
Where we process the personal data of individuals in the European Economic Area or the United Kingdom, the GDPR and UK GDPR also apply. We treat all personal data to the standard required by these laws, regardless of where the individual is located.
What personal information we collect
Information you give us
When you register with NEDness, we collect:
- your name
- your email address
In future, we may invite you to provide additional information for an enhanced profile, such as your professional background, sector experience, and areas of governance interest. We will update this policy before collecting any additional categories of personal information.
Information collected automatically
When you visit our website, our hosting provider (Ghost Pro) processes limited technical data to deliver the website to your browser. This includes your IP address, which is logged by the web server as a standard part of delivering any web page. These server logs are managed by Ghost Pro as our data processor.
Website analytics: We use Ghost’s built-in analytics, which are first-party and do not use cookies. Ghost counts unique visitors within 24-hour windows without using any form of persistent browser storage. No individual browsing profiles are created. When you are signed in, Ghost records which posts you view to help us understand what content is most relevant. This data is not shared with any third party.
Analytics data storage: For sites hosted on Ghost Pro, all analytics data is stored in EU regions.
We do not use Google Analytics or any other third-party analytics or tracking service.
Information we do not collect
We do not collect payment information, financial data, health information, biometric data, or any special category data (such as information about race, religion, political opinions, or sexual orientation).
Why we collect your information and our legal basis
The DPJL requires us to have a lawful basis for processing your personal data. The bases we rely on are:
|
Purpose |
Legal basis |
|
To provide you with access to registered content and send you communications about NEDness content and activities |
Legitimate interests — it is in our legitimate interest to communicate with people who have registered with NEDness, and in their interest to receive the content they registered for |
|
To understand how our website is used so we can improve it |
Legitimate interests — anonymous, aggregated analytics help us publish better content and improve the experience for the community |
|
To deliver the website to your browser (server logs, including IP addresses) |
Legitimate interests — this is a technical necessity for operating any website |
|
To respond to enquiries you send us |
Legitimate interests — to respond to people who contact us |
|
To comply with legal obligations |
Legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and we have concluded that they are not. You have the right to object to processing based on legitimate interests at any time (see Your rights, below).
We do not rely on consent as our legal basis for any current processing. If this changes in future (for example, if we introduce optional communications that require consent), we will update this policy and obtain your consent before that processing begins.
Who we share your information with
We share personal data only with the following categories of recipient, and only to the extent necessary:
Ghost Pro (our website and email provider): Ghost Pro hosts our website and manages our registered community. Ghost Pro acts as our data processor and processes your name, email address, and browsing activity on our site. Ghost Pro stores data in EU regions.
HubSpot (our contact-record system): HubSpot holds the record of your registration, namely your name and email address, so that we can manage our relationship with you and our communications with you. HubSpot acts as our data processor.
Buzzsprout (our podcast hosting provider): Buzzsprout hosts our podcast audio files. Buzzsprout collects limited listener data (such as approximate location derived from IP address and listening device type) for download statistics. Buzzsprout does not receive your name or email address from us.
Social media and video platforms: We maintain a presence on LinkedIn, YouTube, and Instagram. If you interact with us through these platforms, those platforms process your data under their own privacy policies. We do not transfer your NEDness registration data to any social media platform.
We do not sell, rent, or trade your personal information to any third party.
We do not display advertising on our website, and we do not share your personal data with advertisers. We take part in the Amazon Associates affiliate programme through book links in the book club, which is explained in our Cookie Policy.
International data transfers
NEDness is based in Jersey, which has been recognised by the European Commission as providing an adequate level of data protection.
Our primary data processor, Ghost Pro, stores analytics data in EU regions. Where any of our processors transfer data outside of Jersey, the EEA, or the UK, we ensure that appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or equivalent protections under the DPJL.
How long we keep your information
We keep your personal information only for as long as necessary for the purposes described in this policy:
- Registration data (name, email): For as long as you remain registered with the NEDness community. If you ask us to delete your account, we will do so and remove your personal data within 30 days, except where we are required by law to retain it.
- Server logs (including IP addresses): Managed by Ghost Pro in accordance with their data retention policies. These are not retained indefinitely.
- Analytics data: Aggregated and anonymised; not linked to identifiable individuals.
How we protect your information
We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. These include:
- use of encrypted connections (HTTPS/TLS) across our website
- access to personal data restricted to authorised people in the founding team
- selection of data processors (such as Ghost Pro) that maintain appropriate security standards
- regular review of our data protection practices
No system is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify the JOIC and, where required, notify you without undue delay.
Your rights
Under the DPJL (and, where applicable, the GDPR), you have the following rights in relation to your personal information:
- Access: You can ask us for a copy of the personal information we hold about you.
- Correction: You can ask us to correct any inaccurate or incomplete information.
- Deletion: You can ask us to delete your personal information where there is no compelling reason for us to continue processing it.
- Restriction: You can ask us to restrict the processing of your personal information in certain circumstances.
- Objection: You can object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling grounds that override your interests.
- Data portability: Where processing is based on consent or a contract and carried out by automated means, you can ask to receive your personal data in a structured, commonly used format.
You are not required to pay any charge for exercising your rights.
To exercise any of these rights, please contact us at privacy@nedness.com.
We will respond to your request within one month. If your request is complex or we receive a large number of requests, we may extend this by a further two months, but we will let you know within the first month.
Complaints
If you are unhappy with how we have handled your personal information, you have the right to complain to the Jersey Office of the Information Commissioner:
Jersey Office of the Information Commissioner
2nd Floor, 5 Castle Street, St Helier, Jersey JE2 3BT
Telephone: +44 (0) 1534 716530
Email: enquiries@jerseyoic.org
Website: jerseyoic.org
If the GDPR applies to you, you also have the right to complain to the supervisory authority in your country of residence.
Cookies
Our cookie use is minimal. For full details, please see our separate Cookie Policy.
In summary: the site itself uses only strictly necessary cookies, such as session authentication for people who have registered, and these do not require your consent. The one exception is the book club: if you choose to use a book link to buy from Amazon, Amazon sets non-essential cookies, and we ask for your consent before they are set. Full details are in our Cookie Policy.
Children
NEDness is a professional governance community. Our services are not directed at anyone under the age of 18, and we do not knowingly collect personal information from children. If we become aware that we have collected personal data from someone under 18, we will delete it.
Changes to this policy
We may update this policy from time to time. If we make significant changes, we will notify registered people by email and update the date at the top of this page. We encourage you to review this policy periodically.
AI and automated decision-making
We do not use your personal data for automated decision-making or profiling.
We use artificial intelligence tools internally for content research, editing, and producing written material from spoken content (such as podcast transcripts). AI is not used to generate original content such as articles, opinion pieces, or governance advice. No personal data from our community is used to train or fine-tune AI models.