Effective date: 1 August 2025
Last updated: 9 March 2026
Version: 2026-03-09
Part A — The “Register Your Interest” form
Who we are
One Step North Limited (“One Step North”, “we”, “us”) is the data controller for the information you submit through this form. Company registration number 12089467. Registered address: Unit 19/20 Mardon Park, Baglan Energy Park, Port Talbot, Wales, SA12 7AX. Data protection contact: info@1stepnorth.com.
What we collect
When you register your interest we collect the details you enter: company name, contact name, department, email address, phone number (optional) and any notes you choose to add. We also record the date and time of your submission, whether you ticked the consent boxes and the version of this notice you accepted, and a one-way hashed (irreversible) form of your IP address and browser type used only to prevent abuse of the form. We do not store your full IP address.
Why we use it and our lawful basis
- To respond to your enquiry and tell you about the products or services you have asked about — this is necessary for the steps you have asked us to take before entering into a contract (UK GDPR Article 6(1)(b)) and, where you represent an organisation, our legitimate interest in responding to business enquiries (Article 6(1)(f)).
- To send you future communications about One Step North products, services, events and news — only if you tick the optional consent box (Article 6(1)(a) and PECR). You can withdraw this consent at any time by emailing info@1stepnorth.com or using the unsubscribe link in any message we send.
- To keep the form secure and prevent spam — our legitimate interest in protecting our systems.
How we store and protect it
Your details are stored in a database on our UK-based hosting. Personal fields (name, email, phone, notes) are encrypted at rest, access is restricted to authorised One Step North staff through a password-protected administration area, and all traffic to this site is encrypted (HTTPS). A copy of your submission is also emailed to our team inbox and a confirmation is emailed to you.
How long we keep it
We keep enquiry details for up to 24 months after our last contact with you so that we can follow up on your interest. If you consent to future communications we keep your contact details until you withdraw consent or we no longer have a reason to contact you. You can ask us to delete your details sooner at any time.
Who we share it with
We do not sell or trade your details. They are shared only with the service providers we use to run this website and our email (acting under our instructions as data processors) and, where the law requires, with legal authorities.
Your rights
You have the right to be informed, to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing, to data portability, and to withdraw consent at any time. To exercise any of these rights email info@1stepnorth.com. You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk, telephone 0303 123 1113.
Cookies on this site
This site sets only strictly necessary cookies: a session cookie used to protect the form against forged submissions, and a small cookie that remembers you have dismissed the privacy notice bar. No analytics, advertising or tracking cookies are used, so consent is not required for these under PECR.
Part B — Privacy Notice for users of Careers in 360 and Expoverse
1. Introduction
This Privacy Notice explains how One Step North Ltd (referred to as “we,” “us,” or “our”) collects, uses, and safeguards information when you visit or interact with our immersive communication and training platforms: Careers in 360 and Expoverse (collectively, “the Platforms”).
We are committed to protecting your privacy and ensuring compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
The Platforms are designed to operate without collecting personally identifiable information.
2. Who We Are (Data Controller)
One Step North is the data controller responsible for the technical data collected on the Platforms. This means we determine the purposes and means of processing that data.
- Company: One Step North Ltd
- Company Registration: 12089467
- Registered Address: Unit 19/20 Mardon Park, Baglan Energy Park, Port Talbot, Wales, SA12 7AX
- Data Protection Contact: info@1stepnorth.com
We act as the Data Controller for all Technical Usage Data described in this Notice.
3. The Information We Do Not Collect
The Platforms are open-access and designed to be used without requiring any personal registration, login, or direct input of sensitive information.
We do not collect or store:
- Your name, email address, phone number, or physical address
- Payment or financial information
- Special Category Data (e.g., health, ethnicity, religion)
- User-generated content that could personally identify you
- Voice recordings or transcriptions beyond your active session
- Full IP addresses (we do not store them)
The Platforms can be used without registration, login, or providing any personal details.
4. Information We Do Collect (Technical Usage Data)
We only collect minimal Technical Usage Data required to understand platform performance and provide session-based functionality. This data does not identify you as an individual.
4.1 Approximate Geo-Location (City/Country)
When you visit the Platforms, your device communicates with our servers via your IP Address. We process this IP address for the sole, transient purpose of deriving approximate city and country information. We do not store your full IP address; it is discarded immediately after the location is derived. Only the aggregated, non-identifiable location (city/country) is stored for analytics.
4.2 Essential Session Cookie
We use a short-lived session cookie containing a session hash. This is used solely to:
- maintain your active session,
- allow our AI tools to remember context while you remain on the page,
- prevent security issues such as request tampering.
The session hash does not identify you personally and expires when you end your session or clear cookies.
4.3 Interaction Events
We record anonymous click and navigation events (e.g., which features are used, which buttons are pressed) for the purpose of improving platform performance. These events are linked only to the anonymous session hash and cannot identify you.
5. AI Interaction Data (Text and Voice)
The Platforms include optional AI guidance features. We use third-party providers (e.g., Groq) to power these features under strict Data Processing Agreements.
5.1 AI Text Messages
Messages you type into the AI assistant are kept only within your active session to maintain conversational context. They are not logged or stored on our servers. They are:
- Not stored on our servers
- Not logged
- Not accessible to administrators
- Deleted automatically when your session ends
5.2 Voice Input (Speech-to-Text)
If you choose to use the voice input feature:
- Your audio is sent directly to an external Speech-to-Text provider (e.g., Groq)
- A temporary transcript is created only for your active session
- Neither the audio nor the transcript is stored by us
- We do not receive, store, or access these transcripts
- Administrators cannot view any voice data
The transcript exists only in your browser session and disappears when you end the session, close your browser, or clear cookies.
5.3 AI Model Training
We do not use your text or voice interactions to train any AI models, nor do we permit our service providers to do so.
Careers in 360 is designed with “Children’s Higher Protection” at its core, as required by the Data (Use and Access) Act 2025. We strictly adhere to the ICO’s Age Appropriate Design Code (AADC) to ensure our immersive environments are safe and supportive of a child’s development.
6. Lawful Basis for Processing Technical Usage Data
For the limited technical data described in Section 4, our lawful basis is Legitimate Interests. Our interests include:
- Ensuring platform performance and stability
- Providing essential functionality
- Protecting the Platforms from malicious activity
- Understanding aggregate usage to improve the service
We only process minimal, non-identifiable information and this processing does not override your rights or freedoms.
7. Cookies and Tracking Technologies
We use only essential session cookies. We do not use analytics cookies, advertising cookies, or any non-essential tracking cookies.
Essential cookies are used strictly for security, session management and supporting AI context. Because these are essential under PECR, consent is not required.
8. Disclosure and Sharing of Information
We do not sell, rent, or trade any data. We only share minimal Technical Usage Data with:
- Essential Service Providers (e.g., hosting, security, transient STT processing)
- Project Partners, but only in aggregated, non-identifiable statistical format (e.g., “X visitors this month”)
- Legal authorities, when legally required
Service providers act as Data Processors under strict contractual terms. No identifiable data is ever shared.
9. Data Retention and Security
Retention
- Approximate geo-location statistics: up to 24 months for year-on-year trends
- Session cookies and AI context: session only, deleted when the session ends
- Interaction events: stored anonymously with no identifying markers
Security Measures — we use industry-standard protections including encryption, access controls, server hardening and isolated processing of voice/STT traffic.
10. Your Rights Under UK GDPR
Because we do not store personal data that identifies you, several rights have limited application. However, you retain the following rights:
- Right to be informed (this notice)
- Right of access (you may request confirmation of what we store)
- Right to rectification (if any technical data were inaccurate)
- Right to erasure
- Right to restrict processing
- Right to object
- Right to lodge a complaint
Make a complaint: Information Commissioner’s Office (ICO) — Website: www.ico.org.uk — Phone: 0303 123 1113
To exercise your rights, contact: info@1stepnorth.com. We will acknowledge any data protection complaint within 30 days.
In line with the Data (Use and Access) Act 2025, upon receipt of a Data Subject Access Request (DSAR), One Step North will conduct reasonable and proportionate searches to identify and provide the relevant personal data we process within our immersive platforms.
11. Changes to This Privacy Notice
We may update this Notice to reflect changes in technology, regulation, or platform operation. The “Last Updated” date will change when updates are made.
