Privacy and cookie notice

This notice explains how OuterSpark Ltd, a company registered in England and Wales, company number 17464428, registered office: 17 Faraday Road, Guildford, GU1 1EA (“OuterSpark”, “we”, “us”, “our”) collects and uses personal data when you use this website, our newsletter, our courses, products and services, and any related websites, social channels or platforms we operate, including our associated brands (together, the “Services”).

OuterSpark Ltd is the data controller for the personal data described here. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), and, where they apply to you, the EU GDPR.

To contact us about anything in this notice, or to exercise your rights, please use the contact form. A member of our team will get back to you within 48 hours.

• Identity and contact data: your name, email address and, where you give them, your organisation, job title and phone number.
• Enquiry data: anything you tell us through the contact form, discovery call bookings or mentoring applications.
• Marketing data: your newsletter subscription, your marketing preferences, which form you signed up through, and whether you open or click our emails.
• Transaction data: details of courses, products and services you buy from us. Card and payment details are collected by our payment providers, not by us.
• Technical and usage data: IP address, browser and device type, pages visited, how you arrived at the site, and similar information collected by our hosting provider and, where you consent, by cookies and analytics tools.

We do not knowingly collect special category data, and our Services are not intended for children under 16.

• To send the newsletter, free resources and marketing emails. When you request a free resource such as the UK Space Sector Playbook, or subscribe through any form on our Services, you are told at the point of sign-up that you are joining the OuterSpark newsletter and will receive marketing emails from OuterSpark Ltd, and by submitting the form you give your consent to this. Lawful basis: your consent, which you can withdraw at any time using the unsubscribe link in every email or by contacting us.
• To answer enquiries and arrange calls. Lawful basis: our legitimate interests in responding to people who contact us, or steps you ask us to take before entering into a contract.
• To deliver courses, products, mentoring and consulting you buy, including sending joining details and materials. Lawful basis: performance of a contract.
• To run, secure and improve the Services, prevent fraud and abuse, and understand how the site is used. Lawful basis: our legitimate interests, and your consent where cookies or similar technologies require it.
• To meet legal, tax and accounting obligations and to establish, exercise or defend legal claims. Lawful basis: legal obligation and our legitimate interests.

This website may use cookies, pixels and similar technologies. Strictly necessary cookies keep the site working and secure. With your consent, we use analytics cookies (Google Analytics) to understand how visitors use the site, and marketing or advertising cookies and pixels to measure and improve our campaigns. Our email provider may use tracking pixels and tracked links to tell us whether newsletters are opened and clicked.

We ask for your consent before setting any non-essential cookies, and you can change your choice at any time using “Cookie settings” at the bottom of every page. You can also block or delete cookies in your browser settings, although parts of the site may then not work as intended. Third-party services we link to or embed set their own cookies under their own policies.

We use trusted third-party providers to run our Services. They process personal data on our behalf, or as independent controllers for their own services, and your data may be managed across these platforms. In every case your relationship with us remains with OuterSpark Ltd. Current providers include:

• Beehiiv: newsletter and email marketing.
• Gumroad: sales, checkout and delivery of courses and digital products (acting as merchant of record for those purchases).
• Resend: delivery of contact form messages.
• Vercel: website hosting and security logs.
• Google: calendar bookings for discovery calls and, with your consent, analytics.
• YouTube, Instagram, TikTok and LinkedIn: our social channels and video content we link to.

We may add further providers in future, including e-commerce, payment, booking, learning and embedded content platforms. When we do, we will only use providers that offer appropriate protection for your data, and we will update this notice.

We never sell your personal data.

Some of our providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we make sure it is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard.

• Newsletter and marketing data: until you unsubscribe or ask us to delete it.
• Enquiries: up to 24 months after our last contact, unless they lead to a contract.
• Customer and transaction records: six years after the end of the financial year they relate to, for tax and legal purposes.
• Technical logs: in line with our hosting provider’s retention, typically a matter of days or weeks.

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its use (including for direct marketing, at any time), to data portability, and to withdraw consent at any time without affecting processing that has already taken place. To make a request, use the contact form. A member of our team will get back to you within 48 hours. We may need to verify your identity, and we will respond within one month as required by law.

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

We use appropriate technical and organisational measures to protect personal data, and our providers are required to do the same. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

We may update this notice from time to time. The date at the top shows the latest version. Where changes are significant, we will tell subscribers by email.