Privacy Policy

South West Grid for Learning Trust Ltd (referred to as “SWGfL”, “SWG”, “the Grid”, “Our”, “We” and “Us”) operates StopNCII.org (website) and is committed to protecting and respecting your privacy.

This Privacy Notice (together with our terms and conditions (at swgfl.org.uk/terms) and any other documents referred to in it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

SWGfL is a registered charity and company limited by guarantee. We may disclose your personal data to any member of our group, which includes any subsidiaries or holding companies as defined in section 1159 of the UK Companies Act 2006, should such subsidiaries or holding companies exist.

SWGfL Information

South West Grid for Learning Trust Ltd
Belvedere House
Woodwater Park
Pynes Hill
Exeter
EX2 5WS

A charitable trust company registered in England and Wales.
Company Number: 5589479
Charity Number: (England and Wales) 1120354 (Scotland) SC051351
VAT Number: GB 880 861 888.

General

  1. This Privacy Notice explains how we use and protect your personal data for the purposes of your use of StopNCII.org. When you access the website, we collect limited personal data and process no more personal data than is necessary.
  2. For the purposes of UK data protection legislation, we are the Controller for processing personal data where you have:
    1. accessed our website; and/or
    2. used our services via our website;

Our use of your personal data

What types of personal data do we process:

By using our website, you consent to us processing your personal data including:

    1. your email address;
    2. disclosure that you are under or over 18 years of age; and
    3. your IP Address

How we use your personal data:

We will use this information:

  • to allow you to create a secure Password for your use and to prevent other people from accessing your data within the website; and
  • to deliver appropriate and accurate content to you and your device from within the website.
  • to fulfil your request(s) to share your hashed image(s) with social media services and other platforms so that they can remove them. This means your hashed images may be transferred to these organisations even where they are outside the United Kingdom.

We collect your IP Address at a country level only for the purpose of analytics and threat management.

Our lawful basis for processing:

We process your personal data with your consent as above or as necessary:

  1. To protect your vital interests
  2. or the purposes of Our or a third party’s legitimate interests (to correspond or communicate with you; to verify the accuracy of data that we hold about you and create a better understanding of you as a user of our services; for network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access; for prevention of fraud and other criminal activities; for the management of queries, complaints, or claims; and for the establishment and defence of our legal rights); or
  3. or compliance with a legal obligation to which we are subject.

Who we share your data with:

We may share your hashed images with social media services and other platforms so they can help detect and remove the images shared online. Your hashed images are not reversible and SWGfL cannot see the content of the images at any time. Here is a complete list of social media services and other platforms who may receive your hashed images.

Participating platforms may be based in countries around the world. This means that, when your hashes are shared, your personal data may be visible to those platforms via your platform account.

At present, it is not possible to choose which individual platforms receive your hashes. By uploading your hashes to StopNCII, you understand and acknowledge that they will be shared with all platforms that are signed up to the StopNCII service at the time of upload.

We may disclose your personal information with third parties where:

  • we are ordered to do so by a court
  • we are ordered to do so by an authority with the power to demand a disclosure, including social services and the police
  • we are required or authorised to do so by law

We may employ third party companies and/or individuals to perform certain functions on our behalf. To the extent that they require access to personal data (and where we are unable to achieve the desired outcome by providing them with this data in an anonymised manner), we will disclose your personal data only where:

  1. the third party agrees to use it only for the agreed function(s) and not for any other purposes; and
  2. the third party agrees to process the personal data in accordance with this Privacy Notice and as permitted by the UK’s data protection legislation.

Data Transfers

  1. To fulfill your request(s) to remove your hashed images from social media services and other platforms , your personal data will be shared with those services which may be outside the United Kingdom. Where appropriate, and in the absence of derogations under Article 49 of the UK General Data Protection Regulation, we put in place contractual controls and procedures with such service providers to adequately protect your rights.

Data Retention and Security

  1. We will retain personal data only for as long as is necessary.
  2. You may withdraw your consent to processing of any hashed images at any time, by withdrawing your case. You will need your valid case number and the correct pin to do this. Once you have withdrawn your case, we will erase your hashes from our systems and instruct industry partners to do so too. Please be aware, however, that once industry partners become aware of a hash which violates their policies, they reserve the right to continue removing that content.
  3. Your email address is stored for 3 days and deleted. Your case number and hashed pin will be retained as long as your case is active.
  4. We will store any information you provide to us on our secure servers or on secure servers provided by our service providers.

Cookies

  1. Our website places only cookies on your computer that are strictly necessary to enable us to provide the services to you.
  2. Specifically, we use Google ReCaptcha in both “Create” or “Status” screens. A description of the cookies used can be found in the Google ReCaptcha developer documentation.
  3. We also use “lang”, a language cookie to understand which language the user requires.

Your Rights

  1. Where we process personal data relating to you, you have the following rights:
    1. the right to be informed that your personal data is being used or stored by us. This Privacy Notice advises you of this;
    2. the right to access a copy of the personal data we hold about you;
    3. the right to object to direct marketing by unsubscribing from it;
    4. the right to object to processing carried out on the basis of legitimate interests;
    5. the right to erasure of information we use or hold that relates to you;
    6. the right to data portability;
    7. the right to object to decisions being taken by automated means;
    8. the right to have your data rectified if its inaccurate or incomplete.
  2. Please note that some of these rights are not absolute and may be subject to exemptions which we may rely upon.

Complaints

  1. If you are concerned about any aspect of our processing or personal data, please contact us. Contact details are provided below.
  2. Should we fail to resolve your concerns, you have the right to complain to the UK Information Commissioner’s Office.

Contacting Us

Please read this notice carefully and contact us and our Data Protection Officer if you have any queries by emailing us at: privacy@swgfl.org.uk. Or by writing to:

The Head of Privacy
South West Grid for Learning Trust
Belvedere House
Pynes Hill
Exeter
EX2 5WS

Or by telephone on: +44 (0) 345 601 3203

We reserve the right to change this Privacy Notice from time to time and suggest that you review it periodically. This version of the Privacy Notice was last updated in April 2025. January 2026.