Privacy Statement

Purpose

This Privacy Statement explains how Think Through Nutrition (TTN), legally the Institute for Food, Brain and Behaviour, collects, uses, stores and protects personal information. It applies to data collected through our programmes, research, digital platforms (including LANAH), websites, events and partnerships.

Data controller

TTN is the data controller for personal data that it collects directly.

When TTN works jointly with partners, data may be processed under a joint-controller or processor arrangement.

Enquiries can be directed to:

  • Address: Data Protection Lead (Chief Operating Officer), Think Through Nutrition, Gravita Oxford LLP, First Floor, Park Central, 40/41 Park End Street, Oxford, OX1 1JD.
  • Email: info@thinkthroughnutrition.org

What information we collect

We may collect and process the following types of information:

  • Contact details (name, email address, phone number, organisation).
  • Professional or demographic details relevant to programme participation.
  • Responses to surveys, questionnaires or evaluations.
  • Information supplied through LANAH or research studies (e.g. wellbeing or dietary data, usually anonymised).
  • Payment, donation or supplier details where applicable.

How we use personal information

We use personal data to:

  • Deliver and evaluate our programmes, research and digital tools.
  • Communicate with participants, partners and supporters.
  • Manage our relationship with funders, contractors and volunteers.
  • Meet legal, regulatory and reporting requirements.
  • Improve our services through anonymised analysis and feedback.

Lawful bases for processing

We process personal data only where one or more lawful bases under the UK GDPR apply, including:

  • Consent (e.g. newsletter sign-ups or voluntary research participation).
  • Contractual necessity (e.g. employment or supplier relationships).
  • Legal obligation (e.g. accounting and reporting).
  • Legitimate interests (e.g. project management and stakeholder engagement).

When processing special-category data such as health information, TTN relies on explicit consent or the research-and-public-interest provisions in the Data Protection Act 2018.

Sharing information

We only share personal data where necessary and proportionate.

Where data are shared with partners, written Data Sharing Agreements or Memoranda of Understanding are used to define responsibilities.

Data are stored on secure UK-based servers (e.g. AWS EU West-2 London or Azure UK South London). We do not transfer personal data outside the UK unless equivalent safeguards are in place.

How long we keep information

Personal data are retained only for as long as necessary to fulfil their purpose, comply with legal obligations or meet funder requirements.

Research and evaluation data are normally kept securely for up to ten years in line with University and funder guidance, after which they are anonymised or destroyed.

Security of your data

We apply technical and organisational measures to protect information against unauthorised access, alteration, disclosure or loss.

This includes encrypted storage, password-protected systems, restricted access folders and secure disposal procedures.

Your rights

Under the UK GDPR you have the right to:

  • Be informed about how your data are used.
  • Request access to your data.
  • Ask for correction or deletion of inaccurate data.
  • Restrict or object to processing.
  • Request transfer of your data (data portability).

Requests can be submitted to info@thinkthroughnutrition.org. We aim to respond within one calendar month.

Automated decision-making

TTN does not use automated decision-making or profiling in a way that produces legal or significant effects on individuals.

Version control and review

This policy will be reviewed annually by the Management Committee and approved by the Board of Trustees, or sooner if required by legislation or organisational change.

Last reviewed: October 2025

Next review: September 2026