Privacy Notice

Who we are

InfoNudge is a security awareness and compliance training product operated by Consultants Like Us Ltd, registered in England and Wales at C/O NJN, 5 Carrwood Park, Selby Road, Leeds, LS15 4LG. For the purposes of UK GDPR we are the data controller for the personal data described in this notice, except where we act as a processor for your employer — see the next section.

You can reach us at info@consultantslikeus.co.uk or 07853 916 262. Our wider company privacy notice is at consultantslikeus.co.uk/privacy-notice; where the two differ on the app, this notice governs.

Your employer and us

InfoNudge is bought by organisations for their staff. You joined using a company code issued by your employer, and your employer decides what training is published to you.

• Your employer is the controller of your learning activity — what you viewed, your quiz scores, your points and your position on their leaderboard. Administrators at your organisation can see this so they can evidence completion for audits such as ISO 27001. We process it on their instructions.
• We are the controller of your account itself — the credentials that let you sign in, the security of the service, and our correspondence with you.

If your question is about why your employer requires this training, or who at your organisation can see your results, please ask them first — they set that policy. If they direct the request to us, we will help.

Data we collect

Everything InfoNudge collects is listed below. There is nothing else and no hidden category.

The only permission the app asks for is permission to send you notifications. It is optional, it is requested at the point of use, and refusing it leaves the rest of the app fully working. The app requests no other device permission.

What we never do

• We do not sell or rent your personal data. Ever, to anyone.
• We do not show advertising in InfoNudge and we share nothing with ad networks.
• We use no third-party analytics, attribution or tracking SDKs in the app, and we do not track you across other apps or websites.
• We do not collect your location, contacts, calendar, health data, camera, photo library or microphone. The app does not ask for access to any of them.
• We do not use your data to train machine learning models.
• We do not make decisions about you by automated means alone that produce legal or similarly significant effects.

How we use it, and why we are allowed to

Under UK GDPR we need a lawful basis for each use. Ours are:

• Contract — creating your account, signing you in, showing you your feed, recording views and quiz results, running saved items, points and the leaderboard, and providing support. Without this we cannot provide the service.
• Legitimate interests — keeping the service secure, preventing abuse, diagnosing faults and maintaining backups. We have balanced these against your rights and limited the data to what the purpose needs.
• Consent — sending you push notifications. You give this at the operating-system prompt and can withdraw it at any time in your device settings.
• Legal obligation — where we must retain or disclose data to comply with the law.

Where we act as processor for your employer, the lawful basis for the training itself is theirs to state — usually legal obligation, or their legitimate interest in meeting their own security and compliance duties.

Who we share it with

We share personal data with your employer’s administrators as described above, and with the service providers below, who process it on our behalf under contract. They may use it only to provide their service to us.

We may also disclose data to our professional advisers, or to a law enforcement or regulatory body where we are legally required to. If our business is reorganised or sold, data may transfer to the acquirer under the same protections; we will tell you if that happens.

International transfers

Some of the providers above process data outside the UK, including in the United States. Where they do, the transfer is covered by the UK Addendum to the EU Standard Contractual Clauses, or by an adequacy decision, together with technical measures such as encryption in transit and at rest. Ask us and we will tell you which safeguard applies to a particular transfer.

How long we keep it

• Account data — for as long as your account exists. Deleting your account removes it.
• Learning activity — for as long as your account exists, or for as long as your employer’s retention policy requires it as audit evidence. Your employer sets that period.
• Push tokens — until you turn notifications off, sign out or delete the app. Tokens that stop working are discarded automatically.
• Password reset tokens — they expire shortly after being issued.
• Server and security logs — a short rolling period set by our hosting providers, typically no more than 30 days.
• Backups — deleted data can persist in encrypted backups for a short period before those backups roll over.

Deleting your account

You can delete your InfoNudge account and its data yourself, from inside the app:

1. Open the InfoNudge app and sign in.
2. Go to Profile (the settings icon in the header).
3. Tap Delete Account and confirm.

This permanently removes your account record, including your name, email address, password hash, saved items, viewed history, quiz results, points and push tokens. It cannot be undone, and you do not need to contact us first.

If you have already removed the app, or you cannot sign in, use our account deletion page or email info@consultantslikeus.co.uk. We will action it within 30 days.

Where your employer is the controller of your training records, they may need to keep anonymised or aggregated completion evidence for their own audits after your account is gone. That evidence no longer identifies you.

Your rights

Under UK GDPR you have the right to:

Access

Ask for a copy of the personal data we hold about you.

Rectification

Have inaccurate data corrected. You can fix your own name and email in the app at any time.

Erasure

Ask us to delete your data. You can also do this yourself — see “Deleting your account”.

Restriction

Ask us to pause our use of your data while a concern is resolved.

Objection

Object to processing we carry out on the basis of legitimate interests.

Portability

Receive the data you gave us in a structured, commonly used, machine-readable format.

Withdraw consent

Where we rely on consent — push notifications, for example — you can withdraw it at any time in your device settings, without affecting processing already carried out.

To exercise any of these, email info@consultantslikeus.co.uk. We will respond within one month, and there is no charge. If your request concerns training records your employer controls, we will pass it to them and tell you we have done so.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather hear from you first so we can put it right.

Security

We are ISO 27001 consultants, and we hold the product to the standard we advise on. Passwords are stored only as bcrypt hashes and are never recoverable in plain text. Access to the app and API is authenticated with signed JSON Web Tokens. Traffic between the app, the portal and our API is encrypted with TLS, and data at rest is encrypted by our hosting and storage providers. Administrative access to production data is limited to the people who need it.

No system is perfect. If you believe you have found a vulnerability, please tell us at info@consultantslikeus.co.uk and give us a reasonable opportunity to fix it before disclosing it publicly.

Storage on your device

The mobile app stores your sign-in token and basic profile details in the device’s own app storage so you stay signed in between sessions. Signing out or deleting the app clears it.

The web portal uses browser storage for the same purpose. We use no advertising or analytics cookies and no third-party trackers, so there is no cookie banner to click through.

Children

InfoNudge is workplace software, provided to employees through their employer. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has an account, tell us and we will remove it.

Changes to this notice

We update this notice when the product changes — for example if we add a service provider, or a new feature handles data differently. The date at the top always reflects the current version. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

Contact us