Privacy policy.
Built in Britain is an independent UK research and advocacy project. We explore how Student visa rules affect postgraduate founders and the UK companies they want to build. Built in Britain is the controller for the personal information described in this notice.
Questions, rights requests and data-protection complaints can be sent to connor@builtinbritain.org.
The short version
The evidence form is an Airtable form embedded in this website. When you submit it, your response travels directly from your browser to Airtable rather than through a custom Built in Britain form endpoint. This reduces the amount of custom code handling your response, but it does not remove all security or data-protection risk.
We use responses to understand barriers faced by postgraduate founders, produce aggregated or genuinely de-identified research, clarify evidence and, if you ask us to, signpost startup resources, programmes and contacts. We do not publish your identity, a direct quotation or an identifiable story without asking you separately.
Information we collect
The evidence form asks for your stage of research, broad field, a high-level venture description and the visa or system challenges you have faced. University and email are optional. Email is the only contact identifier the form is intended to collect.
A response without an email is not necessarily anonymous. A university, field, research stage, venture description or unusual combination of details may still identify you or make you identifiable.
When you visit the site, Vercel Web Analytics processes limited information such as the page visited, referrer, approximate location, device, operating system and browser. Vercel states that its standard Web Analytics does not use cookies or persistent cross-site identifiers. Hosting and security infrastructure may also process ordinary request and security-log information needed to deliver and protect the site.
Why we use information
- Research and advocacy: to analyse high-level experiences, identify themes and produce aggregated or genuinely de-identified findings about barriers to forming UK startups.
- Evidence follow-up: to clarify a response and signpost startup resources, programmes and contacts when you have provided an email and selected the follow-up choice.
- Campaign updates: to send occasional updates only when you have separately opted in.
- Publication: to use an identified story, an identifiable account or a direct quotation only after separate, specific approval.
- Operation and security: to understand aggregate site use, maintain the service, prevent misuse and protect the project and its visitors.
- Legal responsibilities: to respond to valid rights requests, complaints, legal claims or lawful requests from authorities.
Our lawful bases
We rely on legitimate interests for core research and advocacy, proportionate evidence follow-up, aggregate site measurement and security. Our interests are understanding how the rules affect postgraduate founders, improving the evidence base for reform and operating the project safely. We limit the information collected and give you the controls described in this notice so that those interests do not override your rights.
We rely on consent for campaign updates and for any identified, identifiable or verbatim public use. You can withdraw that consent at any time. We rely on legal obligation where the law requires us to use or disclose information.
Submitting evidence is voluntary and is not a statutory or contractual requirement. We do not use submissions to make automated decisions about you or to profile you for access to services.
Who receives information
Access to identifiable evidence is restricted to authorised people working on the project who need it for the purposes above. We do not sell personal information. We do not give identifiable submissions to policymakers, universities, funders or the public unless you separately approve the specific disclosure.
Our principal service providers are:
- Airtable, which hosts and processes new form responses and any optional email in the same restricted base;
- Vercel Web Analytics, which provides aggregate website measurement;
- our hosting and email providers, where they process technical information or communications on our behalf.
We may also disclose information to professional advisers, courts, regulators or law-enforcement bodies where reasonably necessary and lawful.
Storage and international transfers
New evidence is stored in the restricted Airtable base. Airtable states that the United States is its default data-hosting region. Its Data Processing Addendum includes safeguards intended to support transfers of UK personal information. Before public launch, the project must verify that the applicable DPA and UK transfer mechanism are in place.
If historical submissions exist in retired form storage, they must be inventoried and securely deleted or migrated into the current restricted evidence store. Email correspondence is stored by the project’s email provider. Service providers may use subprocessors in other countries under their contractual safeguards.
How long we keep information
We keep identifiable information only while it is reasonably necessary for the active research and advocacy project, evidence verification, agreed follow-up or campaign updates. We review the need for it at least annually.
We delete or genuinely anonymise identifiable information when it is no longer needed, when the project ends, when you withdraw update consent, or following a valid deletion request unless we have a lawful reason to retain it. Genuinely anonymised findings may be kept because they no longer identify a person. Provider backups may persist for a limited period under the provider’s normal deletion cycle.
Security and what not to submit
We use a restricted Airtable base, limited administrator access and service-provider security controls. No internet service can promise absolute security.
Do not submit passport details, visa or application reference numbers, case files, passwords, health information, another person’s personal information, confidential or patentable technology, export-controlled material, trade secrets or commercially sensitive information. The form is for high-level evidence only. If unnecessary sensitive information is submitted, we may redact or delete it.
Your rights
Depending on the circumstances, you may ask us for access to your personal information, correction, deletion, restriction or a copy, or object to our use of it. You may withdraw consent for updates or an approved public use at any time. Withdrawal does not make earlier lawful use invalid, and it may not be possible to reverse genuinely anonymised or aggregated findings already published.
Email connor@builtinbritain.org with enough information for us to locate your response. If you submitted without contact details, we may be unable to verify which response is yours. We may ask for proportionate proof of identity before acting on a request.
You can also make a data-protection complaint to that address. We will acknowledge it within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner’s Office.
People under 18
The evidence form is intended for people aged 18 or over. Do not submit evidence if you are under 18.
Advice and signposting
Built in Britain may signpost startup resources, programmes, contacts and regulated advisers. It does not provide immigration, legal, financial or business advice. For advice about your circumstances, use an appropriately qualified professional or a regulated immigration adviser.
Changes to this policy
We may update this policy when the project, form or service providers change. We will publish the new date on this page and seek fresh consent if a change requires it.