Privacy policy

Who is the data controller

The Black Circle Group is the controller for personal data collected through this site. For any privacy question, or to exercise your rights, email theblackcirclegroup@gmail.com.

What we collect

We only collect what we need to answer enquiries and deliver sessions:

• ·Enquiries: your name, email address, venue or group name and message.
• ·Bookings: your name, email address, venue or group, time zone, chosen session, the discussion summary you provide, and the acceptance of our client agreement.
• ·Payments: handled by Stripe. We receive a payment reference and status only — never your full card number.
• ·Technical data: anonymised usage and security data, plus spam-protection signals from hCaptcha.

Why we use it and our lawful basis

Contract: to arrange, prepare for and deliver a booked session and to take payment. Legitimate interests: to reply to enquiries, prevent spam and fraud, keep records of accepted agreements, and improve our services. Legal obligation: to retain financial records.

We do not sell personal data and we do not use it for automated decision-making or profiling.

Who we share it with

Only with processors who help us run the business: our hosting and database provider, our payment provider Stripe, our email provider, our video-conferencing provider and our spam-protection provider. Each is bound to process data only on our instructions.

International transfers

Some providers process data outside the UK. Where they do, transfers are covered by UK adequacy regulations or the International Data Transfer Agreement / Addendum with appropriate safeguards.

How long we keep it

Enquiries: up to 24 months from the last contact. Booking and session records including accepted agreements: 6 years, to support our legal and financial record-keeping obligations. You can ask us to delete data earlier where no legal obligation requires us to keep it.

Your rights

You have the right to access, correct, delete or port your data, to restrict or object to processing, and to withdraw consent where consent is the basis. Email us and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

Security

Data is transmitted over HTTPS and stored in access-controlled systems. Administrative access requires an individual account with two-factor authentication. Please do not send us special-category data, card details or third-party personal data through our forms.