Privacy notice
Last updated 8 November 2026
This notice explains how NZA Consultancy Ltd collects, uses, shares and protects personal data in decodED, and your rights under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1. Who we are
decodED is operated by NZA Consultancy Ltd, trading as Net Zero Advisory ("NZA", "we", "us" or "our"), a company registered in England and Wales under company number 14478434, whose registered office is at 10 Kenmore Crescent, Bristol, BS7 0TN. We are registered with the Information Commissioner's Office ("ICO") under registration number ZB637874.
If you have any questions about this notice or about how we handle personal data, please contact us at info@netzeroadvisory.uk or write to us at the address above.
2. Our role
- NZA is the controller of account data (who you are, how you sign in, which Organisations you belong to), of billing records and correspondence, and of the aggregated, de-identified analysis described in section 6.
- NZA is a processor for the information an Organisation enters into its own Projects (its "School Data", as defined in our Terms of Service). We process any personal data in it on the Organisation's behalf, to provide the Service. The Organisation is the controller of that data.
A data processing agreement is available on request for schools, trusts and other Organisations.
3. What decodED is and is not
Most of what decodED holds is not personal data. What every visitor sees about a school comes from public records, such as those of the Department for Education, Display Energy Certificates, Ordnance Survey and the Environment Agency, and describes buildings, grounds and the area around them, not people. What an Organisation adds is mainly carbon, climate and nature figures, plans, risk registers and nature records. decodED is for staff, not pupils: pupils never sign in. It does not require, and is not designed to hold, personal data about pupils, and users must not enter pupils' names, photographs or other details. Pupil numbers shown in decodED are aggregate figures from public Department for Education records.
4. Personal data we hold
4.1 Your account
- Your email address and password (stored only in hashed form, so that we cannot read it), whether your email address is confirmed, and when you signed in.
- Your display name, if you add one.
- The schools and school groups you save to your Account, and where you were in decodED for each.
- Which version of our Terms and this notice you accepted, and when.
4.2 Organisations and access
- The Organisations you belong to and your role in each.
- Requests to join an Organisation and who decided them; claims of a school and the email domain used.
- Invitations, including the email address of the person invited. decodED does not email invitations itself: the Admin sends the link from their own email.
- An Organisation's choice about sharing with NZA (section 6), and who made it.
4.3 Personal data within School Data
School Data is mainly about buildings and sites, but some parts name people:
- the people on a Plan (names and roles of staff and partners) and the people who own or help with each action;
- who owns and who reviewed each climate risk;
- who carried out a survey or recorded a wildlife sighting (often initials or a class);
- notes on rooms and floors, and floor plan pictures, which may show names;
- the project history: who saved or changed what, and when. Changes made by NZA support are labelled "NZA support" in place of a name.
4.4 Billing and correspondence
- Billing records: which Organisation pays for which school, the Subscription, its status and when it renews. When you sign up, you pay on Stripe's own checkout page: your account email address is passed to Stripe, and Stripe collects your card details and any billing address or VAT number you give. Card details are never received or stored by us.
- The content of any message you send us, and our reply.
4.5 Collected automatically
- Technical information: your IP address, browser type and device information, recorded in server logs when you use decodED.
- Usage information: the pages viewed, measured in aggregate without cookies and without identifying you.
- Error reports: technical details of errors, including the error message and the page on which it occurred, without your IP address or account details.
5. How we use personal data and our lawful bases
We process personal data only where we have a lawful basis to do so under Article 6 of the UK GDPR.
| Purpose | Lawful basis |
|---|---|
| Creating and running your account; saving your schools; letting you claim or join an Organisation and work with colleagues; storing and showing your Organisation's Projects | Performance of a contract |
| Sending service emails, such as email confirmation and password reset | Performance of a contract |
| Processing payments, sending receipts and renewal reminders, handling cancellations and refunds, and keeping financial records | Performance of a contract; compliance with a legal obligation |
| NZA support: opening an Organisation's Project to help, answer questions and put problems right (section 7) | Performance of a contract |
| Keeping decodED secure, preventing misuse and diagnosing faults | Our legitimate interests in operating a secure and reliable service |
| Measuring use of decodED in aggregate and monitoring errors | Our legitimate interests in understanding and improving the service |
| Recording which version of our Terms and this notice you accepted, and an Organisation's sharing choice | Our legitimate interests in keeping an accurate record of what was agreed |
| Responding to enquiries and support requests | Our legitimate interests in supporting our users |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms and concluded that they are not. You may ask us for more information about this assessment. We do not sell personal data, use it for advertising, or make decisions about you based solely on automated processing. We do not send marketing emails.
6. NZA's aggregate view
Under our Terms, NZA uses the carbon, climate and nature data in every Project to benchmark schools and improve decodED. For this, NZA works from a separate, read-only copy, rebuilt every hour, that leaves out personal data:
- no names, email addresses, account details or Organisation names;
- the people on a Plan, and who owns each action, appear only as counts and kinds (for example, "a member of staff");
- who owns or reviewed a risk, who carried out a survey or recorded a sighting, and who made each change are left out;
- notes on rooms, floors and map pins, and floor plan pictures, are recorded only as present or not.
Text describing the school's buildings, grounds, risks and plans is kept as written, so please do not name individuals in it. We will not publish findings that identify a school or Organisation without its consent.
Sharing is on by default. An Admin can switch it off for their Organisation under Share with NZA in Your account, and its data then leaves the aggregate view within about an hour. Deleted Projects and accounts leave it in the same way.
7. Who can see personal data
7.1 Within your Organisation
Members of an Organisation can see the name, email address and role of its other members, and its Projects. Another Organisation that holds its own Project for the same school never sees yours.
7.2 NZA support
NZA's support team can open any Organisation's Project, read it and make changes, to help, answer questions and put problems right. Every change they make is labelled "NZA support" in the Project's history, and the Organisation can see in Your account when NZA support opened or saved its Projects. NZA support access does not extend to an Organisation's members, invitations or billing. NZA may also update how a Project's data is structured, including with automated tools, so that it keeps working with new versions of decodED; such changes are labelled "NZA support" in the same way.
7.3 Service providers
We use the following service providers ("sub-processors") to operate decodED. They process personal data only on our documented instructions and under written contracts that require them to protect it.
| Provider | Service | Location |
|---|---|---|
| Supabase Inc. | Database hosting, including all School Data; sign-in and account emails | Ireland (EU) |
| Vercel Inc. | Website hosting and application processing | United Kingdom (London); Vercel Inc. is based in the United States |
| Vercel Inc. (Web Analytics) | Aggregate page view measurement, without cookies | United States |
| Functional Software Inc. (Sentry) | Error monitoring | Germany (EU) |
| Stripe | Card payments, subscription billing, receipts and renewal reminders | Stripe's data centres, including the United States |
| Render Services Inc. | Roof geometry processing (building shapes only; no personal data) | Germany (EU) |
| Microsoft Corporation (Microsoft 365) | Business email, for correspondence with us | Microsoft's data centres (see section 8) |
7.4 Map, data and content providers
When you use the map, your browser requests map imagery and public datasets directly from third-party providers, including Esri, Ordnance Survey, MapTiler, OpenFreeMap, OpenStreetMap, the Environment Agency and the NBN Atlas. Software libraries and fonts are delivered by jsDelivr, unpkg and Google Fonts. These providers receive your IP address and the details of the request, as is necessary to deliver content to your browser. They do not receive your account information.
7.5 Other disclosures
We may disclose personal data where required by law or by a court or regulator; to our professional advisers under a duty of confidentiality; or to a prospective buyer or successor in the event of a sale or reorganisation of our business, subject to equivalent protections.
8. International transfers
School Data and account data are stored within the UK and European Economic Area. Some of our service providers may process personal data outside the United Kingdom. Where this occurs, the transfer is protected by appropriate safeguards: UK adequacy regulations (including for the European Economic Area), the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or Addendum approved under the UK GDPR. You may request a copy of the relevant safeguards by contacting us.
9. Retention
We keep personal data only for as long as it is needed for the purposes above, including to meet legal and accounting requirements.
| Category | Retention period |
|---|---|
| Account information, saved schools and saved groups | For the life of the account; deleted within one month of a request to close it (section 10) |
| School Data, including names entered in it | For as long as the Organisation holds the Project; it is not deleted when a Subscription ends. An Organisation's Admins and Editors can remove names, or ask us to |
| Earlier copies of a school's buildings and site | The last 10 saved copies |
| Invitations that are not used | Invitations expire after 7 days and are deleted 30 days after that |
| Declined requests to join | Deleted 90 days after the decision |
| Record of NZA support visits | 12 months |
| NZA's aggregate view | Rebuilt every hour from current Projects; data that is deleted, or whose Organisation switches sharing off, leaves it within about an hour |
| Financial records | Six years from the end of the relevant financial year, as required by law |
| Server logs | Up to 30 days |
| Error reports | Up to 90 days |
| Correspondence | Two years from our last contact with you |
10. Closing your account
To close your account, please email us from the address registered to it. We will delete it within one month. Closing an account:
- deletes your sign-in, display name, memberships, saved schools and saved groups, and any invitations addressed to you;
- deletes any personal or test Organisation of your own, with its Projects;
- keeps what you entered into an Organisation's Projects with that Organisation, with your name removed from the project history (changes are shown as made by a "former member").
Names that you or colleagues typed into School Data, such as the people on a Plan, belong to the Organisation's records. The Organisation can remove them, or you can ask it to.
11. Security
We use appropriate technical and organisational measures to protect personal data. These include encryption in transit, hashed passwords, row-level access controls that restrict each person to the Projects of the Organisations they belong to, a labelled record of every NZA support visit, and access to production systems restricted to a small number of authorised NZA staff.
12. Your rights
Subject to certain conditions and exemptions, you have the right to:
- be informed about how we use your personal data;
- request access to your personal data;
- request that inaccurate or incomplete personal data is corrected (you can change your display name yourself in Your account);
- request that your personal data is erased (section 10);
- request that we restrict the processing of your personal data;
- object to processing based on our legitimate interests;
- receive personal data you have provided in a structured, commonly used and machine-readable format (data portability).
To exercise any of these rights, please contact us at info@netzeroadvisory.uk. There is normally no charge. We will respond within one month, which may be extended in limited circumstances, and may ask you to verify your identity first. Where your request concerns personal data within an Organisation's School Data, we will work with that Organisation, as the controller, to respond.
13. Complaints
If you have concerns about how we use your personal data, please contact us first so that we can try to resolve them. You also have the right to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; ico.org.uk/make-a-complaint.
14. Children
decodED is intended for adults acting for or on behalf of schools and other organisations. Accounts may only be held by people aged 18 or over. Pupils never sign in: teachers may show decodED to pupils in lessons, but pupils should not be given accounts, and their personal data should not be entered. If we become aware that an account has been created by a child, we will delete it.
15. Cookies
decodED does not use advertising or tracking cookies. Information stored on your device is limited to what is strictly necessary to provide the service. Further details are set out in our Cookie policy.
16. Changes to this notice
We may update this notice from time to time. The date at the top shows when it was last revised. Where changes are significant, we will tell account holders by email or within decodED before they take effect.