The Nest. Privacy Policy Last updated: 6 October 2026 This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, get in touch, work with us, join the SEFAR directory, sign up to our newsletter or complete one of our online scorecards. We handle your data openly and lawfully, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 1. Who we are The Nest is a trading name of Bastian & Nelly Limited, a company registered in England and Wales (company number 10482346), whose registered office is at Hay Barn, Rectory Farm, Little Chishill, Royston, Hertfordshire SG8 8PB. Bastian & Nelly Limited is the data controller responsible for your personal information. This means we decide how and why your data is used. 2. The information we collect We only collect the information we need. Depending on how you interact with us, this may include: Contact details: your name, email address, phone number, business name and business type. Your preferences: the topics you tell us you want to hear about when you sign up, so we can send you relevant content. SEFAR directory membership: when you join, your company website and your answers to our sign-up questions: what type of business you are, what you make, your business stage, what you need help with and how you heard about us. Consultant and partner listings: when you apply to be listed in the directory, the information you send us for your listing, your rates and the details needed for our agreement with you. Client information: when you work with us, the project details, billing details and correspondence we need to deliver our work and invoice you. Scorecard responses: the answers you give when you complete a scorecard through our scorecard provider (ScoreApp), with the contact details you submit with it. Messages you send us: the content of any enquiry, email or form you submit. Technical and usage data: information such as your IP address, browser type and how you use our site, collected automatically through cookies and similar technologies (see section 9). 3. How we collect your information We collect personal information when you sign up to our newsletter, join the SEFAR directory, apply to be listed, complete a scorecard or other form on our website, book a call, contact us by email or through a contact form, work with us as a client, consultant or partner, or browse our website. 4. Why we use your information and our lawful basis Under UK GDPR we must have a lawful basis for using your data. We rely on the following. Consent: where you have opted in to our newsletter, we send you updates, content and occasional marketing on the topics you have chosen. You can withdraw your consent at any time (see section 10). Contract: we use your information to deliver our consultancy services, to manage our agreements with consultants and partners, and to take steps you ask for before entering into a contract. Legitimate interests: we use your information to respond to enquiries, run your SEFAR directory membership, make the introductions you ask for, operate and improve our website and services, and understand what our members and clients need. We only rely on this where your interests and rights do not override ours. Legal obligation: we keep financial records and may process your data where we are required to by law. 5. Introductions through the SEFAR directory When you ask us to introduce you to a consultant or partner, we share only what they need to respond to your enquiry, and only with your agreement. When we introduce a consultant or partner to a member, we share their listing and contact details with that member. 6. Who we share your information with We do not sell your personal information, and we never share it for other organisations' marketing. We use trusted third-party service providers to run our business. They act as our data processors and may only use your data on our instructions. They include: Wix: our website, membership and email marketing platform, which stores the data you submit and helps us send our newsletter. ScoreApp: our scorecard platform, which collects and stores your scorecard responses and contact details. Google Workspace and Zoom: our email, documents and video call tools. Our accountants: for financial records. We may also disclose your information if required to do so by law, or to protect our legal rights. Some of our providers may store or process data outside the UK. Where they do, we make sure your information is protected by appropriate safeguards, such as the UK's International Data Transfer Agreement or equivalent protections. 7. How long we keep your information We keep your personal information only for as long as we need it. Enquiries: up to 2 years from our last contact. Client and financial records: 6 years, as required for tax purposes. SEFAR directory membership: while you are a member and for 12 months afterwards. Newsletter: until you unsubscribe or ask us to remove you. After that, we delete or anonymise your data within a reasonable period, unless the law requires us to keep it. 8. Your rights Under UK data protection law you have the right to be informed about how your data is used, to access the information we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw your consent at any time where we rely on consent. To exercise any of these rights, email nicola@thenest.uk.com. We will respond within one month. 9. Cookies and tracking Our website uses cookies and similar technologies to help the site function, remember your preferences and understand how the site is used. Some cookies are set by Wix to run and secure the site; others help us measure traffic and performance. You can control or disable cookies through your browser settings, though some parts of the site may not work properly if you do. 10. How to unsubscribe or withdraw consent You can unsubscribe from our newsletter at any time by clicking the unsubscribe link at the bottom of any email we send, or by emailing nicola@thenest.uk.com. Withdrawing your consent will not affect the lawfulness of anything we did before you withdrew it. 11. Making a complaint We hope to resolve any concerns you have, so please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113. 12. Changes to this policy We may update this Privacy Policy from time to time. Any changes will be posted on this page and take effect when posted. Where changes are significant, we will take reasonable steps to let you know. 13. Contact us If you have any questions about this policy or how we handle your personal information, email nicola@thenest.uk.com or write to us at Hay Barn, Rectory Farm, Little Chishill, Royston, Hertfordshire SG8 8PB.