Last Updated: Wednesday, 16th September 2026
The National Design Academy (“NDA”, “we”, “us” or “our”) is committed to protecting your privacy and handling your personal information fairly, transparently and securely.
This Privacy Policy explains how we collect, use, store and share your personal information when you visit our website, make an enquiry, apply for or enrol on a course, make a payment, study with us, use our online learning services, communicate with us or otherwise interact with the National Design Academy.
It also explains your rights in relation to your personal information.
Note: Our use of cookies and similar technologies is explained separately in our Cookie Policy, available on our website.
The National Design Academy is a brand of NDA Foundation, a not-for-profit education provider.
NDA Foundation is the legal entity responsible for the National Design Academy and is the data controller for the personal information described in this Privacy Policy.
NDA Foundation
Company Number: 07654911
Rufford Hall
Waterside Way
Trent Park
Nottingham
NG2 4DP
United Kingdom
Email: info@nda.ac.uk
Website: www.nda.ac.uk
NDA Foundation is a not-for-profit organisation. Profits are reinvested into the Foundation for the benefit of its students.
If you have any questions about this Privacy Policy or how we use your personal information, please contact us using the details above.
The information we collect depends upon your relationship and interactions with us.
This may include:
When you register to use our online systems, we may process information including:
Passwords are handled through our authentication systems and are not available to staff in readable form.
When you make an enquiry or request information about one of our courses, we may collect:
When you apply for or enrol on a course, we may collect:
Note: Applications and enrolments are administered through our Application & Enrolment Platform (AEP) at nda.online-applications.co.uk.
For Bachelor’s and Master’s degree applications, where academic and/or professional entry requirements apply, applicants may be asked to upload supporting evidence through the AEP. This may include CVs, qualification certificates, portfolios of work and written references from employers.
These documents are attached to the applicant’s application and student profile and are stored securely in an Amazon Web Services (AWS) S3 storage bucket. They are used to assess whether the relevant entry requirements are met and may also be retained as evidence for academic partner or regulatory audit purposes.
If you become an NDA student, we may process information relating to:
Note: Our online learning environment is provided through our Virtual Learning Studio (VLS) at www.virtuallearningstudio.co.uk.
During enrolment and your studies, we may collect information concerning:
Note: Some of this information is special category personal data and receives additional protection under UK data protection law.
We only process this information where it is necessary and where we have both an appropriate lawful basis and an additional legal condition permitting the processing of special category data.
We may use this information for purposes including:
Access to this information is restricted as appropriate.
We process information relating to course fees and other payments, including:
We do not generally receive or retain complete payment card details where these are collected and processed directly by the relevant payment provider.
We may retain information contained in communications between you and NDA, including emails, telephone communications, website forms, live chat and support conversations and correspondence relating to applications, enrolments, payments and studies.
We may process:
When you use our websites and online services, we may collect information such as:
Where required by law, non-essential technologies are only used after you have provided the appropriate consent through our cookie consent system.
We may collect information:
For example when you:
Certain technical information may be collected when you use our websites and online systems through cookies, scripts, tags, pixels and similar technologies.
Where consent is required, non-essential technologies will only be used after you have provided the appropriate consent.
In some circumstances we may receive information from organisations including:
Note: We must have a lawful basis whenever we process personal information. The lawful basis depends upon what we are doing with your information.
We use your information to respond to enquiries, provide requested course information, answer questions and assist prospective students.
Lawful basis: taking steps at your request before entering into a contract and/or our legitimate interests in responding to prospective students and providing information about our courses.
We use your information to create and administer your account, process applications, assess eligibility, administer enrolments and establish your student relationship with NDA.
Lawful basis: taking steps at your request before entering into a contract and performance of a contract.
Some personal information is required in order for us to process your application, assess your eligibility for a course, complete your enrolment, administer your studies, process payments or meet our legal, regulatory or academic obligations.
Where information is mandatory, we will normally identify this when we ask you to provide it.
Note: If you do not provide information that is necessary for a particular purpose, we may be unable to process or approve your application, complete your enrolment, provide access to a course or service, process a payment, provide appropriate student support or meet an applicable legal, regulatory or academic requirement.
Where information is optional, we will not treat it as a condition of applying for or receiving a service unless it subsequently becomes necessary for a stated purpose.mandatory, we will normally identify this when we ask you to provide it.
We use student information to deliver courses, provide access to the VLS, communicate with students, provide tuition and support, administer assessments, monitor progress and maintain appropriate academic records.
Lawful basis: performance of a contract, compliance with legal obligations and, where appropriate, our legitimate interests in operating and administering our educational services.
We may process relevant personal information, including special category information, to provide appropriate support, understand additional needs, make appropriate adjustments and undertake appropriate equality monitoring.
Where special category information is processed, we identify and document both an appropriate lawful basis under Article 6 UK GDPR and an appropriate condition under Article 9 UK GDPR and the Data Protection Act 2018.
We process information to collect course fees, establish payment plans, administer Direct Debits, manage failed or overdue payments, process refunds, reconcile transactions and maintain financial records.
Lawful basis: performance of a contract and compliance with legal obligations.
We use contact information to provide application, enrolment, payment, course, service and academic communications and respond to support requests.
Lawful basis: performance of a contract, taking steps before entering into a contract, compliance with legal obligations and/or legitimate interests.
We may analyse appropriate information to maintain our systems, understand how our services are used, improve our courses and student experience, troubleshoot problems and evaluate performance.
Lawful basis: our legitimate interests in operating, developing and improving our educational services.
Where this involves technologies requiring consent, we will obtain that consent.
We may process information to protect our websites and systems, authenticate users, prevent and detect fraud and investigate suspicious activity.
Lawful basis: our legitimate interests in protecting NDA Foundation, our systems and users and, where applicable, compliance with legal obligations.
We use ActiveCampaign to help manage enquiries, customer relationship management and marketing communications.
Where you choose to receive marketing, we may send information about:
Where consent is required for electronic marketing, we will ask for it separately from registration, application or enrolment.
Note: You can unsubscribe from marketing emails at any time using the unsubscribe link in our marketing emails. Withdrawing marketing consent does not prevent us from sending necessary administrative, transactional, academic or service communications.
We periodically maintain our ActiveCampaign records. Contacts identified as invalid or automated/bot registrations may be removed, and inactive marketing contacts are reviewed and, where appropriate, removed at regular intervals.
Removal from ActiveCampaign does not necessarily result in deletion of information held in other NDA systems where we have another lawful reason to retain that information.
If a former student subsequently applies or enrols again, relevant information may be transferred from the AEP to ActiveCampaign as part of the new enquiry, application or enrolment journey.
Some communications and administrative processes may be triggered automatically based on actions you take or the status of your enquiry, application, enrolment, payment or studies.
For example, creating an account, submitting an application, completing an enrolment, making a payment or reaching another stage of the applicant or student journey may trigger relevant confirmations, reminders, administrative messages or other communications.
We may use systems including the AEP and ActiveCampaign to manage these communications and workflows.
Automated administrative and service communications relating to your account, application, enrolment, payments or studies are separate from optional direct marketing communications. You may therefore continue to receive necessary administrative or service communications even if you have chosen not to receive marketing or have subsequently unsubscribed from marketing communications.
We use analytics, user-experience and advertising technologies to understand how visitors use our websites, identify areas where users may experience difficulties, improve website design and usability, and measure the effectiveness of our advertising.
These services may include:
We also use Google Site Kit within WordPress to connect and manage Google services including Search Console, Google Analytics and PageSpeed Insights. Google Analytics is the visitor analytics service described above; Search Console and PageSpeed Insights are used to help us monitor search visibility and website performance.
Depending on the service and your consent choices, information processed may include device and browser information, IP address, pages viewed, navigation, clicks, scrolling, website interactions, advertising interactions, conversion events, referring sources and cookie or similar identifiers. Some services may also provide aggregated heatmaps or session-replay functionality to help us understand how our websites are used.
Where required, analytics, user-experience, advertising and tracking technologies will only operate after you have provided the appropriate consent.
Note: You can manage or withdraw your choices using the Cookie Settings on our website.
For details of the analytics, user-experience, advertising and tracking technologies currently in use, including their providers, purposes, categories and duration, please see our separate Cookie Policy.
We use specialist payment providers to process payments securely.
Our current payment providers include Stripe for credit and debit card payments (including Apple Pay and Google Pay), GoCardless for Direct Debit payments and PayPal where PayPal is selected as the payment method.
Some existing payment plans established through previous payment providers continue to be processed by those providers until the relevant payment plans are completed. We no longer establish new payment plans through those legacy providers.
Depending upon the provider and payment method, information processed may include identity and contact information, billing information, card or bank account details, payment amount, currency, transaction status, authentication information, fraud-prevention information, payment-plan information, refunds and disputes.
Note: Payment providers may process certain information as independent data controllers under their own privacy policies.
Our main website is: www.nda.ac.uk.
All course applications and enrolments are administered through our bespoke application and enrolment platform, or ‘AEP’ for short: nda.online-applications.co.uk.
Students access online learning and course materials through our bespoke virtual learning environment, the Virtual Learning Studio or ‘VLS’ for short: www.virtuallearningstudio.co.uk.
The NDA website, AEP and VLS are hosted using Amazon Web Services (AWS) infrastructure.
We use appropriate access controls and technical and organisational measures to protect information processed through these systems.
Our website, AEP, ActiveCampaign and VLS support different stages of the prospective student and student journey.
Information may move between these systems where necessary to administer your enquiry, application, enrolment, communications and studies.
For example, information provided through our website or AEP may be used to create or update relevant records within our CRM and communications systems, including ActiveCampaign. Once you enrol, relevant information may also be used to create and administer your student record and provide access to the VLS.
Information may be transferred between these systems automatically through secure system integrations and APIs where appropriate. We limit these transfers to information reasonably necessary for the relevant purpose.
Note: Your information may therefore be processed across more than one NDA system during your relationship with us. The purposes, lawful bases, retention arrangements and rights described in this Privacy Policy apply as appropriate to that processing.
We use several technology providers to help us provide our services.
These include:
We use Microsoft 365 services for communications, collaboration and document management, including Outlook, Teams, SharePoint and OneDrive where appropriate.
We use Zendesk for live chat and/or customer support functionality.
Zendesk may process contact and technical information and the content of communications when you use these facilities.
Our website and learning materials may contain video content provided through YouTube and Vimeo.
Where embedded services use non-essential storage or access technologies requiring consent, they are subject to our cookie consent arrangements. For further information about cookies and similar technologies used by these services, please see our Cookie Policy or manage your preferences through the Cookie Settings available on our website.
We use QR Code Generator by Bitly to create dynamic QR codes in some of our digital and printed communications and to understand how those QR codes are used.
When a dynamic QR code is scanned, the provider may collect scan statistics such as the date and time of the scan, operating system, approximate location at country or city level, and whether the scan is unique. We may use this information to understand engagement with our communications and campaigns and to improve their effectiveness.
Static QR codes do not provide the same scan-tracking functionality.
Our Application & Enrolment Platform uses some automated processes when administering applications.
Our Short Courses, Continuing Professional Development (CPD) and Diploma-level courses do not have academic entry requirements.
Applications for these courses may therefore be automatically approved by the AEP once the required application information has been completed.
Bachelor’s and Master’s courses have academic and/or professional entry requirements.
Applicants may be required to provide evidence of previous qualifications and/or relevant industry experience, including CVs, qualification certificates, portfolios of work and written references from employers. These documents are uploaded through the AEP and form part of the applicant’s application and student profile.
This information is reviewed by an appropriate member of our academic team.
Note: Supporting evidence for successful degree-level applications is retained for four years and may be reviewed if required for audit by our academic partner, De Montfort University Leicester (DMU), or by Ofsted where applicable.
Decisions to accept or reject applications for these courses are therefore not made solely by automated means.
If you have questions about an automated decision concerning your application, believe a decision has been made incorrectly, or wish to challenge the decision, you can contact us at info@nda.ac.uk. You can provide additional information or representations and request that the decision is reviewed by a member of staff.
We do not sell your personal information.
Where necessary and lawful, information may be shared with:
AIM Qualifications: All NDA Level 3 Diplomas are accredited and awarded by AIM Qualifications. All NDA CPD Modules and Short Courses are endorsed by the AIM Qualifications Quality Mark.
De Montfort University Leicester (DMU): All NDA undergraduate and postgraduate level courses are accredited and awarded by De Montfort University. Relevant application and entry-requirement evidence may be made available to DMU where required for academic quality assurance or audit purposes.
Note: Where another organisation processes personal information on our behalf, we require appropriate contractual and data protection arrangements.
Some organisations may also act as independent data controllers for particular processing activities, in which case their own privacy notices apply.
Some of our technology and service providers operate internationally.
Personal information may therefore sometimes be processed or stored outside the United Kingdom.
Where information is transferred outside the UK, we take appropriate steps to ensure the transfer complies with UK data protection law.
Depending upon the destination and circumstances, safeguards may include:
You can contact us for further information about safeguards applying to a particular international transfer.
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet appropriate legal, contractual, academic, accounting and reporting requirements.
Applications started through the AEP that do not proceed to enrolment may be removed following manual review at regular intervals. Any remaining incomplete applications are automatically removed after 12 months.
Where an applicant enrols, relevant student and enrolment records are retained for longer.
Certain records may be retained on a long-term basis where necessary to:
Note: Students may return to NDA to progress onto further levels of study several years after completing an earlier course.
Supporting documents uploaded through the AEP for Bachelor’s and Master’s degree applications, such as CVs, qualification certificates, portfolios of work and written employer references, are retained for four years.
These documents are stored in an AWS S3 storage bucket and retained so that evidence used to assess entry requirements is available if required for academic partner or regulatory audit, including by De Montfort University Leicester (DMU) or Ofsted where applicable.
Note: At the end of the four-year retention period, these supporting documents are automatically deleted from the S3 storage bucket.
After completing a course, student records on the VLS may be archived and the student’s account moved to Alumni status.
This allows us to maintain an appropriate record of previous study and facilitate future progression or re-enrolment.
ActiveCampaign contacts identified as inactive, invalid or automated/bot registrations may be removed.
Inactive marketing contacts are reviewed and, where appropriate, removed at regular intervals, unless there is another lawful reason to retain relevant information.
Certain financial and transaction records may need to be retained after a course or payment plan has ended in order to comply with accounting, tax and other legal requirements.
Note: When information is no longer required, we will securely delete, anonymise or otherwise remove it from active use in accordance with our retention procedures.
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss, destruction and other unauthorised processing.
These measures include appropriate access controls, authentication, network and system security, backups, monitoring, staff procedures, contractual controls and physical security.
Access to personal information is limited to staff, contractors and providers who require it for legitimate purposes.
We use RoundWorks IT as our third-party managed IT support provider. RoundWorks IT supports the management, maintenance and security of our company hardware and digital systems and may have access to personal information where this is necessary to provide IT support, security, monitoring, maintenance or incident response services. IT management and security software deployed by RoundWorks IT across company devices is updated on a weekly basis to help keep systems and devices up to date and protected.
Note: No internet transmission or electronic storage system can be guaranteed to be completely secure. We therefore regularly review our security arrangements and take measures appropriate to the nature and risk of the information being processed.
Our websites use cookies and other storage and access technologies, which may include:
Some are necessary for our websites and online services to operate.
Others may be used for analytics, embedded content, website performance, advertising, conversion measurement and marketing.
Where consent is required, non-essential technologies will not be activated until you have made the appropriate choice through our cookie consent system.
You can accept, reject or manage non-essential technologies using the Cookie Settings available on our website and can subsequently change or withdraw your choices.
Note: For details of technologies currently used, including their provider, purpose, category and duration, please see our separate Cookie Policy.
Our website does not currently respond automatically to browser-based “Do Not Track” (DNT) signals.
Instead, we provide control over non-essential cookies and similar technologies through our cookie consent management platform.
Depending upon the circumstances and the lawful basis for processing, you may have the following rights.
You have the right to understand how we collect and use your personal information.
You can ask for a copy of personal information we hold about you. This is commonly known as a Subject Access Request.
You can ask us to correct inaccurate personal information or complete information that is incomplete.
You may also be able to update certain information directly through the Profile facilities within our online systems.
In certain circumstances, you can ask us to delete your personal information.
This right is not absolute and we may be permitted or required to retain information where another lawful reason applies.
In certain circumstances, you can ask us to restrict how we process your information.
In certain circumstances, you may have the right to receive information you provided to us in a structured, commonly used and machine-readable format and/or have it transmitted to another organisation.
Note: You have the right to object to certain processing based upon our legitimate interests. You have an absolute right to object at any time to the use of your personal information for direct marketing.
If you object to direct marketing, we will stop using your information for that purpose.
You have rights in relation to certain decisions made solely by automated means.
Where an application is automatically processed by the AEP, you may contact us to express your view, provide additional information or representations, challenge the decision and request that it is reviewed by a member of staff.
Where we rely upon consent, you may withdraw it at any time.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise your data protection rights, contact:
Email: info@nda.ac.uk
Post:
National Design Academy
Rufford Hall
Waterside Way
Trent Park
Nottingham
NG2 4DP
United Kingdom
Please explain which right you wish to exercise and provide sufficient information to allow us to identify the relevant records.
We may ask for information to verify your identity.
Note: There is normally no charge for exercising your rights, although data protection law allows a reasonable fee or refusal in certain limited circumstances.
If you have concerns about how we collect or use your personal information, please contact us first so that we can investigate.
You also have the right to complain to the UK’s independent data protection regulator, the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
Further information about data protection rights and making a complaint is available from the ICO.
Our websites may contain links to websites, applications or services operated by other organisations.
Once you follow a link to an external service, that organisation may process your information independently from NDA Foundation.
We recommend reviewing the relevant organisation’s privacy information before providing personal information.
Some of our courses and services may be available to younger students.
Where we process information relating to children or young people, we take appropriate measures to ensure that their information is handled fairly, lawfully and transparently, taking account of their age and the nature of the processing.
Note: Where consent is relied upon and parental or guardian consent is required by law, we will take appropriate steps to obtain or verify that consent.
This Privacy Policy provides an overview of how NDA Foundation processes personal information in connection with the National Design Academy.
We may also provide additional or more specific privacy information at relevant points where personal information is collected or used, including through:
This may include short or just-in-time privacy information explaining why particular information is being requested, how it will be used or providing a link to further information.
Any additional privacy information provided at these points should be read alongside this Privacy Policy.
Note: Where we make a material change to how we use personal information, we will update our privacy information as appropriate and bring relevant changes to the attention of affected individuals where required.
We may update this Privacy Policy from time to time to reflect changes to our courses, services, technology, processing activities, providers or applicable law and regulatory guidance.
When we make changes, we will update the “Last updated” date at the top of the policy.
Where a change materially affects how we process personal information, we will provide additional notice where appropriate.
We recommend reviewing this policy periodically.
For questions about this Privacy Policy, how we process your personal information, or to exercise your rights, please contact:
National Design Academy
NDA Foundation – Company Number 07654911
Rufford Hall
Waterside Way
Trent Park
Nottingham
NG2 4DP
United Kingdom
Email: info@nda.ac.uk
Website: www.nda.ac.uk
UK students pay approximately 50% of the full course fee – the balance is funded by the UK Government’s Adult education budget (AEB).
The National Design Academy is the only design school to be able to offer this funding as our Diplomas are all fully accredited by AIM Qualifications.