Privacy & data protection
This notice explains how GBX Circle Ltd (“we”, “us”, “GBX Circle”) collects, uses, stores, and shares your personal data when you visit gbxcircle.com, register for the Circle, attend our forums, or otherwise interact with the Circle.
We have written this in plain language. If anything is unclear, write to hello@gbxcircle.com and we will explain it.
1 · Who is responsible
The data controller is GBX Circle Ltd, a private limited company registered in England & Wales. Contact: hello@gbxcircle.com. For privacy-specific questions: privacy@gbxcircle.com.
2 · What we collect
We collect only what is necessary to run the forum and to communicate with you about it. Specifically:
- When you register or apply: your name, professional role, organisation, work email, country.
- When you submit a form: the message you send, plus the contact details you provide.
- When you visit the site: essential cookies for site function (no analytics cookies are set today).
- When you watch an interview: Vimeo’s player sets its own session cookies governed by Vimeo’s privacy policy.
- When you write to us: the email itself plus any attachments you choose to send.
We do not knowingly collect data about anyone under 18.
3 · Why we collect it · legal basis
| Purpose | Legal basis (GDPR Art 6) |
|---|---|
| Process your registration and provide the forum | (b) performance of a contract |
| Reply to your enquiries | (b) contract / (f) legitimate interests |
| Curate invitations and communications about future forums | (f) legitimate interests (B2B professional communication) |
| Send marketing emails outside the forum’s direct context | (a) your consent — you can withdraw any time |
| Meet legal, tax, accounting obligations | (c) legal obligation |
4 · How long we keep it
We keep registration and forum-attendance data for three years from your last interaction with the Circle, after which we delete or fully anonymise it. Tax and accounting records are kept for the statutory retention period (currently six years in England & Wales).
5 · Who we share it with
We share your data only with the processors who help us run the forum. Each processor signs a Data Processing Agreement (DPA) with us and is GDPR-compliant.
| Processor | Role | Region |
|---|---|---|
| HubSpot | CRM · email · forms | EU / US (SCCs in place) |
| Netlify | Website hosting | US (SCCs in place) |
| Vimeo | Video hosting · in-the-room interviews | US (SCCs in place) |
| Google Workspace | Email · documents · calendar | EU / US (SCCs in place) |
| Calendly | Meeting scheduling | US (SCCs in place) |
| Sanity | Structured content for the forum sites | EU (Frankfurt) |
We do not sell your data and we do not share it with third-party advertising networks.
6 · International transfers
Where personal data leaves the UK or the EEA, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum. We do not transfer data to jurisdictions without an adequacy decision or appropriate safeguards.
7 · Cookies
gbxcircle.com sets only essential cookies needed for site function (such as your gate session). We do not run analytics, advertising, or fingerprinting cookies on this domain today. If we ever introduce analytics, we will add a consent banner and update this notice before turning them on.
The embedded Vimeo player sets its own cookies if you press play; these are governed by Vimeo’s policy linked above.
8 · Your rights
Under the UK GDPR, EU GDPR, and equivalent laws (including the California Consumer Privacy Act), you have the right to:
- Access the data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”), subject to retention obligations
- Restrict or object to processing based on legitimate interests
- Receive your data in a portable, machine-readable format
- Withdraw consent at any time, for processing based on consent
- Lodge a complaint with your data protection authority — in the UK, the Information Commissioner’s Office (ICO)
To exercise any of these rights, write to privacy@gbxcircle.com. We will respond within one month.
9 · Security
The site is served over HTTPS with HSTS, a strict Content Security Policy, and modern transport security. Our internal systems use multi-factor authentication and least-privilege access. If a breach occurs, we will notify affected individuals and the ICO within 72 hours as required.
10 · Changes to this notice
Material changes will be flagged on this page with an updated “Last updated” date at the top. The historical versions are archived on request.
11 · Contact
For any privacy question or to exercise a right:
- Email: privacy@gbxcircle.com
- General contact: hello@gbxcircle.com
- Postal address available on request.