Short version: this site sets no cookies, runs no analytics, and collects personal data in exactly two places — the briefing-call form and the shop notify form. What you send there goes to Chris Frost and nobody else; a shop notify address is used for one email at the first drop, then deleted. The long version follows.

1 / WHO IS RESPONSIBLEData controller

The data controller for this site is Chris Frost, trading as NextMission, United Kingdom. To contact him about your data, email hello@nextmission.co.uk with the subject PRIVACY, or use the form on the Join page.

2 / WHAT WE COLLECTThe briefing-call form

The only personal data this site asks for is what you type into the briefing-call request form:

• Name and email address
• Which service you served in (or that you're still serving, or an ally)
• Which route interests you (manual, Brotherhood, cohort)
• A free-text message about where you are and what needs to change

Lawful basis: taking steps at your request prior to entering a contract (UK GDPR Article 6(1)(b)) and our legitimate interest in responding to enquiries (Article 6(1)(f)).

On the free-text field: we do not ask for health or mental-health information. If you volunteer it, we treat it as shared with your explicit consent, we use it only to make the briefing call useful, and we never share it. Do not put crisis details in a web form — if you're in crisis, use the numbers in the footer instead. They answer faster than we do.

3 / WHAT WE DON'T DONo cookies, no analytics, no list ambush

• This site sets no cookies and uses no local storage.
• No analytics or tracking scripts run here.
• Submitting the form does not add you to a mailing list. You get one reply from one person.
• We never sell or rent personal data. To anyone. Ever.

4 / WHO TOUCHES THE DATAProcessors

Three third parties process limited data so the site can function:

• Formspree, Inc. (USA) — relays your form submission to Chris. Transfers outside the UK are covered by Formspree's standard contractual clauses. See Formspree's privacy policy.
• GitHub, Inc. (USA) — hosts this site on GitHub Pages. Like any web host, GitHub logs visitor IP addresses for security. We don't access those logs. See GitHub's privacy statement.
• Google LLC (USA) — serves the site's fonts from Google Fonts, which means your browser sends its IP address to Google when the page loads. See Google Fonts privacy FAQ.

When paid enrolment goes live it will run through a payment provider (such as Stripe) and a community platform. This policy will be updated before either handles your data, and card details will never touch this site.

5 / HOW LONGRetention

Form submissions are kept for as long as needed to respond to you and, if you enrol, to run the programme — then deleted. If you don't enrol and don't ask us to stay in touch, your submission is deleted within 12 months. Ask for deletion sooner and it happens sooner.

6 / YOUR RIGHTSUnder UK GDPR

You can ask at any time to: access the data we hold on you; correct it; delete it; restrict or object to how it's used; or receive it in a portable format. Use the contact route in section 1 — no forms, no fee, answered within one month.

If you're unhappy with how your data has been handled, you have the right to complain to the Information Commissioner's Office: ico.org.uk · 0303 123 1113.

7 / SCOPEAge and changes

This site is for adults; it is not directed at anyone under 18. If this policy changes, the new version is posted here with a new effective date — material changes will be flagged to anyone whose data we hold.