PHF strategy review privacy notice

Version: Draft for PHF approval, 13 August 2026

Who is responsible

The Percy Hedley Foundation is the controller. This means PHF decides why and how personal information is used for the strategy review.

PHF is a charitable company limited by guarantee, company number 01855026 and charity number 515943. Its registered office is Hampeth Lodge, Station Road, Forest Hall, Newcastle upon Tyne, NE12 8YY.

Bontle Senne, trading as Bontle Senne Consulting, operates the dashboard for PHF and processes personal information on PHF’s instructions. Her address is 9 The Green, Wooburn Green, High Wycombe, HP10 0EE.

Privacy questions and requests can be sent to PHF’s Data Protection Officer at dpo@percyhedley.org.uk. Questions about dashboard access can be sent to me@bontlesenne.com.

The information PHF uses

For people invited to the dashboard, PHF uses your name and work email address, invitation and access status, sign-in and security records supplied by the hosting service, and the searches and questions you enter.

The review documents may contain names, job titles, professional views or other information about PHF staff, trustees, partners and stakeholders. PHF decides which documents are approved for the review and whether information must be removed or obscured before use.

PHF obtains invitee details from its authorised review contacts and obtains source-document information from documents that PHF supplies or approves.

Please don’t enter new information about a person’s health, disability, safeguarding circumstances, criminal allegations or other sensitive matters into the search or question boxes.

Why PHF uses the information

PHF uses the information to create and manage individual dashboard access, protect confidential review material and investigate security events, let authorised people search approved review documents, provide answers based on those documents when the generated-answer feature is enabled, and manage the review and data-protection requests.

PHF proposes to rely on its legitimate interests in running an informed, secure and efficient strategy review. PHF will confirm this lawful basis before sending invitations. Where an approved source includes identifiable sensitive personal information, PHF will identify and record the additional legal condition that applies, or remove that information from the source set.

Providing an email address is optional. Without it, Bontle can’t create individual dashboard access, but you can still take part in the review through the other routes PHF provides.

Who receives the information

Bontle processes the information for PHF. Netlify hosts the private dashboard, manages protected access and runs the server functions. OpenAI’s application programming interface may provide generated answers when PHF enables that feature.

The searchable document index stays on the server and is not placed in the website files sent to a visitor’s browser. A search returns short matching extracts. When someone asks for a generated answer, the system selects up to eight extracts by automated keyword matching and sends those extracts with the question to OpenAI. The application requests that OpenAI does not store the response through the store: false setting. PHF will approve the applicable OpenAI account terms, locations and transfer safeguards before this feature is enabled.

International processing

Netlify and OpenAI may process information outside the United Kingdom through their service providers. PHF will confirm the countries and legal safeguards before approving the final notice. You can ask PHF’s Data Protection Officer for information about those safeguards.

Retention

The normal maximum retention period for PHF-controlled strategy review information is three years from the date PHF records the review as completed or terminated. PHF may instruct earlier deletion. At the end of Bontle’s services, PHF will choose whether its personal information is returned or deleted, except where the law requires a record to be retained.

Your rights

Depending on the circumstances, you may have rights to ask for access to your personal information, correction, deletion, restriction, objection or transfer. You can ask Bontle to remove your dashboard access at any time. Access removal does not always require every security or audit record to be deleted immediately.

Send a rights request to dpo@percyhedley.org.uk. You can complain to the Information Commissioner’s Office at ico.org.uk if you remain concerned after PHF has considered your request.

The dashboard does not make decisions that have legal or similarly significant effects on a person. Generated answers support review work and must be checked against the cited sources.

Sign-in technologies

The hosting service may use sign-in and security technologies that are necessary to protect the private dashboard. Bontle has not added advertising or marketing tracking. PHF will publish the observed sign-in cookie details before invitations are sent.

Changes

PHF will date any material change to this notice and tell current dashboard users when a change affects how their personal information is used.