NORM Privacy Policy

Last updated: 15th May 2026.

1. Who we are

NORM is operated by Hello Norm Ltd (trading as NORM), a company registered in England and Wales. Company registration number: 17222928. Registered address: 2nd Floor College House, 17 King Edwards Road, Ruislip, London HA4 7AE, United Kingdom.

For the purposes of UK data protection law, Hello Norm Ltd is the data controller of the personal information you share with us. We are registered with the Information Commissioner's Office (ICO). Registration number: ZC148628.

If you have any questions about your data, or wish to exercise your rights, you can contact us at privacy@norm.co.uk

2. Who can take part

Because submissions may include personal identity information and, in some cases, sensitive information (such as health-related data), this version of NORM is open to adults aged 18 and over.

Under UK data protection law, children’s personal data receives enhanced protection. In particular, special category data (such as health information) requires explicit consent and careful safeguards.

As submissions to NORM may include sensitive personal information and are intended for public publication, we restrict participation to adults (18+).

We do not knowingly collect or publish submissions from anyone under 18. If we become aware that a submission has been made by someone under 18, we will remove it.

3. What information we collect

When you submit a NORM to our NORMdrop project, we may collect:

• Your written NORM
• Your handwritten image
• Identity details you choose to share (such as age bracket, location, gender, ethnicity, neurodivergence, etc.)
• Your email address (if you choose to provide it)

If you choose to share information about neurodivergence or similar, this may be considered special category (health-related) data under UK GDPR.

We also collect limited technical data through our website, such as IP address and analytics data (see Cookies section below).

4. How we use your information

We use your information to:

• Publish your NORM online (including social media)
• Include it in printed or digital publications connected to the project (e.g. summaries, books, PDFs)
• Use it in workshops, talks, presentations, and promotional materials about NORM
• Include it in creative formats connected to the project (e.g. animations or campaigns)
• Lightly adjust your handwritten image (e.g. colour or clarity) so it works clearly across formats, without changing its meaning
• Review submissions before publishing (we may not publish entries that are abusive, unlawful, or outside the spirit of the project)
• Contact you about your submission (if needed)
• Send you a preview and occasional updates if you opt in
• Understand participation patterns in aggregated, anonymous ways

If we would like to feature your NORM on a standalone product (for example, clothing), we will contact you first.

By submitting your NORM, you give us permission to use it within the NORM project as described above.

5. Lawful basis for processing

We rely on the following lawful bases under UK GDPR:

Consent

• To publish your NORM
• To publish any identity information you choose to share
• To process any special category (health-related) data
• To send email updates if you opt in

Legitimate interests

• To operate and improve the NORM project
• To protect the project from misuse or abuse
• For basic website analytics

You can withdraw consent at any time by contacting us.

6. How long we keep your data

We store submissions securely and retain them as part of the ongoing NORM project unless you ask us to remove yours.

If you withdraw consent, we will remove your submission from future publication and use where reasonably possible.

Email addresses are retained until you unsubscribe.

7. Who we share your data with

We use trusted third-party service providers to operate the project. These may include:

• Tally (form collection)
• Webflow (website hosting)
• Notion (internal organisation)
• Google Drive (secure storage)
• Cloudinary and AWS (image processing and hosting)
• EmailOctopus (email communications)
• Instagram (publication platform)
• Google Analytics (website analytics)

Some providers may process data outside the UK. Where this happens, appropriate safeguards (such as Standard Contractual Clauses) are in place.

We never sell your data.

8. Cookies and analytics

We use Google Analytics to understand how people use the website. This tool collects limited pseudonymised usage data such as pages visited, device type, and general geographic region.

We do not use advertising or behavioural profiling cookies.

You can manage your cookie preferences using our cookie banner, or through your browser settings.

9. Your rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction
• Request deletion
• Withdraw consent
• Restrict or object to certain processing
• Complain to the Information Commissioner’s Office (ICO)

ICO website: https://ico.org.uk

You can contact us at privacy@norm.co.uk to exercise your rights.

10. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.