Privacy policy

The law we apply

We handle personal data in line with UK GDPR and the Data Protection Act 2018, as amended by UK legislation including the Data (Use and Access) Act 2025.

For ordinary business-contact, enquiry and booking data, each party normally acts as a controller in its own right. Where we process personal data solely on your instructions as part of project work, the processor terms in the signed Client Agreement (Schedule 2) govern that processing.

Who is the data controller

The Black Circle Group is the controller for personal data collected through this site. For any privacy question, or to exercise your rights, email theblackcirclegroup@gmail.com.

What we collect

We only collect what we need to answer enquiries, deliver sessions and run project work:

• ·Enquiries: your name, email address, venue or group name and message.
• ·Bookings: your name, email address, phone number where you choose a phone session, venue or group, time zone, chosen session, the discussion summary or questions you provide, and the acceptance of our client agreement.
• ·Project and client-contact data: the business contact details of the people we work with, correspondence, and documents you share with us for the engagement.
• ·Payments: handled by Stripe. We receive a payment reference and status only — never your full card number.
• ·Technical data: anonymised usage and security data, plus spam-protection signals from hCaptcha.

Data you should not send us

We handle personal data in line with UK GDPR and the Data Protection Act 2018, as amended by UK legislation including the Data (Use and Access) Act 2025. For ordinary business-contact and booking data each party normally acts as a controller in its own right. Where we process personal data solely on your instructions, the processor terms in the signed agreement (Schedule 2) apply. Please do not send us special-category data, criminal-offence data or extensive employee records unless it is necessary and has been agreed.

Why we use it and our lawful basis

Contract: to arrange, prepare for and deliver a booked session and to take payment. Legitimate interests: to reply to enquiries, prevent spam and fraud, keep records of accepted agreements, and improve our services. Legal obligation: to retain financial records.

We do not sell personal data and we do not use it for automated decision-making or profiling.

Who we share it with

Only with processors who help us run the business: our hosting and database provider, our payment provider Stripe, our email provider, our video-conferencing provider and our spam-protection provider. Each is bound to process data only on our instructions.

International transfers

Some providers process data outside the UK. Where they do, transfers are covered by UK adequacy regulations or the International Data Transfer Agreement / Addendum with appropriate safeguards.

How long we keep it

Enquiries: up to 24 months from the last contact. Booking and session records including accepted agreements: 6 years, to support our legal and financial record-keeping obligations. You can ask us to delete data earlier where no legal obligation requires us to keep it.

Your rights

You have the right to access, correct, delete or port your data, to restrict or object to processing, and to withdraw consent where consent is the basis. Email us and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

Security

Data is transmitted over HTTPS and stored in access-controlled systems. Administrative access requires an individual account with two-factor authentication. Please do not send us special-category data, card details or third-party personal data through our forms.