Privacy Policy

Last updated: 28 August 2026

1. Introduction

This Privacy Policy explains how the Making Work Work website and programme collects, uses, stores, and protects your personal data.

The Making Work Work suite of programmes are delivered by Challenges Catalyst Ltd (SC377928), 5-7 Montgomery Street Lane, Edinburgh, EH7 5JT, part of The Challenges Group. Challenges Catalyst Ltd is the data controller for personal data collected through the Making Work Work website and programmes.

This policy applies to visitors to the Making Work Work website, people who contact us, applicants, programme participants, and people who choose to receive updates from us.

2. Information We Collect

Information you give us directly: your name, email address, phone number, organisation, programme or service interests, together with any details you submit via our contact forms, applications, enquiries, or when subscribing to our newsletter.
Information collected automatically: your IP address, browser and device type, operating system, referral source, pages visited, approximate location, and time spent on the Website, collected via Wix Analytics and standard website server logs.
Cookie data: collected as described in Section 4 below.
Meeting and communication data: if you have a call, meeting, or consultation with us, notes and/or a transcript may be generated using AI-assisted notetaking software (Granola AI) so that we can follow up accurately.
Programme and participation data: if you apply to or take part in one of our programmes, we may collect application responses, demographic information, support requirements or adjustments, monitoring and evaluation information, and notes relevant to your participation.
We do not knowingly seek special category data (such as health or ethnicity information) unless it is relevant to a specific programme or legitimate purpose. Where we request this information, we will explain why it is needed and, where required, seek your explicit consent.

3. How We Use Your Information

We use your personal data for the following purposes:

To operate, host, and maintain our websites (via Wix).
To manage enquiries, applications, programme participation, and ongoing relationships.
To respond to your enquiries and provide information about our services and programmes.
To send newsletters and marketing communications you have opted in to - you may unsubscribe at any time.
To analyse and improve website performance, content, and user experience (via Wix Analytics).
To support internal administrative work - such as summarising meetings, drafting correspondence, research, or handling routine enquiries - using AI-powered tools including Granola AI and Claude AI (provided by Anthropic). These tools process data on our instructions and are not used to make automated decisions that have a legal or similarly significant effect on you.
To support programme administration, monitoring, evaluation, compliance, and reporting where relevant.
To comply with our legal, regulatory, or contractual obligations, and to establish, exercise, or defend legal claims.

Our legal bases for this processing include: your consent (for example, for marketing or optional data); performance of a contract with you; our legitimate interests (for example, improving our services and website security); and compliance with a legal obligation.

AI tools and model training: we use Granola AI under a Business/Enterprise plan and Claude AI under Anthropic's commercial terms (Claude for Work / API). Under the current terms of both providers, your data - including your intellectual property and any customer data processed through these tools - is not used to train their underlying AI models. We review these terms periodically to confirm this protection remains in place, and we do not enable optional feedback or data-sharing features with these providers that would allow model training on our account data.

4. Cookies and Tracking Technologies

Our websites use cookies and similar tracking technologies, including:
Strictly necessary / functional cookies: required for websites built on Wix to function correctly.
Analytics cookies: Wix Analytics uses cookies to collect aggregated, pseudonymised statistics about how visitors use our websites, which helps us improve them.

You can control or disable cookies at any time through your browser settings. Where required by law, we will ask for your consent to non-essential cookies via a cookie banner or consent tool. Disabling certain cookies may affect how the website functions.

5. Data Sharing and Disclosure

We do not sell your personal data. We share personal data only where necessary with trusted service providers and delivery partners who are required to protect your data and use it only for the purposes we specify.

Wix and our website hosting provider - used to host and operate our websites.
Granola AI - an AI notetaking tool used to record and summarise meetings, used under a Business/Enterprise plan under which our data is excluded from model training by default.
Claude AI (Anthropic) - an AI assistant used to support internal drafting, research, and administrative tasks, used under Anthropic's commercial terms (Claude for Work / API), under which inputs and outputs are not used to train Anthropic's models by default.

We may also share personal data within The Challenges Group where relevant to delivering our services; with delivery partners or funders where necessary for a programme and where you have been informed; with our professional advisers (such as auditors or legal counsel); where required by law, regulation, or a valid request from a public authority; or in connection with a business reorganisation, merger, or sale of assets.

Some programme administration is carried out by team members based overseas who access our UK-hosted systems remotely. Personal data remains on approved infrastructure and is not transferred to or stored on local devices as part of this routine remote access.

Where personal data needs to be shared internationally in a way that goes beyond remote system access, we will make this clear where appropriate and ensure that the required data protection safeguards are in place.

International transfers: some of our service providers (including Granola AI, Anthropic, and other cloud-based providers) may process personal data outside the UK, including in the United States. Where this occurs, we ensure appropriate safeguards are in place - such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or reliance on an adequacy decision - so that your data continues to receive an equivalent level of protection.

6. Data Security and Retention

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or loss. These include access controls, staff training, and working only with reputable service providers who are contractually required to protect your data.

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law, after which it is securely deleted or anonymised. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request erasure of your data in certain circumstances.
Restrict or object to our processing of your data.
Request a copy of your data in a portable format.
Withdraw consent at any time where processing is based on consent, including opting out of marketing communications.
Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled.

To exercise any of these rights, please contact us using the details in Section 10 below.

8. Third-Party Links

Our websites may contain links to third-party websites, plugins, or applications that are not operated by us. Clicking on those links may allow third parties to collect or share data about you. We do not control, and are not responsible for, the privacy practices or content of third-party sites, and we encourage you to review their privacy policies before providing any personal data.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the tools and technologies we use, or legal requirements. Any changes will be posted on the relevant website with an updated "last updated" date. Where changes are significant, we will take reasonable steps to notify you directly.

10. Contact Us

If you have any questions about this Privacy Policy, how we handle your personal data, or if you wish to exercise any of your rights, please contact us at womenreturners@thechallengesgroup.com.