1. Who we are
This Privacy & Cookie Policy explains how we collect, use and protect your personal data when you visit https://ceocircle.co.uk or use our services. The data controller responsible for your personal data is:
- CEO CIRCLE LIMITED
- Company number: 17236814 (registered in England & Wales)
- Registered office: 167-169 Great Portland Street, London, England, W1W 5PF
- Contact: support@ceocircle.co.uk
2. Information we collect
- Account & contact data: name, email address, billing details and any information you provide when you register, subscribe or contact us.
- Order & payment data: purchase history and transaction details. Card payments are processed securely by our payment provider (Stripe); we do not store full card numbers.
- Tax & financial data: billing and transaction records we are required to keep for accounting and tax purposes.
- Subscription & membership data: details of the plans, memberships or programmes you sign up for.
- Technical data: IP address, browser type, device information and pages visited, collected through strictly necessary cookies needed to operate the site.
- Communications: messages you send us through forms or email.
- Identity verification data (Ambassadors only): if you join our Ambassador programme, an image of an identity document and, if you register as an individual, your date of birth. This is explained in full in section 9.
We do not knowingly collect data from anyone under 18, and we do not collect special categories of personal data.
3. How we use your information
- To provide our products, services, memberships and subscriptions, and to process payments.
- To manage your account and respond to your enquiries.
- To send you service and administrative emails relating to your account, orders and subscriptions. We do not send marketing newsletters.
- To keep the records we are legally required to maintain for accounting and tax purposes.
- To operate, secure and maintain our website.
- To confirm the identity of Ambassadors we pay commissions to, to prevent fraudulent or duplicate accounts, and to issue commission invoices in the correct legal name.
4. Legal basis for processing
We process your personal data under the UK GDPR on the following bases: performance of a contract (to deliver the products and services you request), compliance with a legal obligation (for example, retaining accounting and tax records), and our legitimate interests (to run, secure and improve our business). Where we ever rely on consent, you may withdraw it at any time.
5. Cookies
Cookies are small text files stored on your device that help a website function. We currently use only strictly necessary cookies — for example to keep you logged in, to remember the contents of your basket, and to process checkout and payments securely. These cookies are essential for the website to work and, under the Privacy and Electronic Communications Regulations (PECR), do not require your consent.
We do not currently use analytics, advertising or other tracking cookies. If we introduce any non-essential cookies or third-party tracking in the future, we will ask for your consent through a cookie banner before they are set, and we will update this policy accordingly. You can also control or delete cookies through your browser settings, although blocking strictly necessary cookies may stop parts of the site from working.
6. Sharing your information
We share personal data only with trusted providers who help us operate our business, and only as far as necessary:
- Stripe — secure processing of card payments.
- IONOS — website hosting and infrastructure.
These providers are required to protect your data and use it only for the purposes we specify. We may also disclose personal data where we are required to do so by law or to protect our legal rights. We do not sell your personal data.
7. International data transfers
As a general rule, your personal data is processed within the UK and the European Economic Area (EEA). However, some payment data may be processed by our payment provider, Stripe, outside the UK/EEA (including in the United States). Where this happens, the transfer is protected by appropriate safeguards approved under UK data protection law, such as the UK International Data Transfer Agreement or Standard Contractual Clauses.
8. Data retention
We keep your personal data only for as long as necessary for the purposes set out in this policy and to meet our legal obligations. In particular, accounting and tax records are retained for the period required by UK law (currently six years). When data is no longer required, we securely delete or anonymise it. Identity documents supplied by Ambassadors are subject to a shorter and stricter rule, set out in section 9.
9. Identity verification for Ambassadors
This section applies only if you join our Ambassador programme. It does not apply to members or subscribers, from whom we never ask for an identity document.
Because we pay commissions to Ambassadors, we need to be able to establish who we are paying. When you register we ask you to upload an image of an identity document — an ID card, passport or driving licence, front and back — and, if you are registering as an individual rather than as a company, your date of birth.
Why we collect it. To confirm the identity of the person or business we pay commissions to; to prevent fraudulent, duplicate or impersonated accounts; to make out commission invoices in the correct legal name; and to confirm that you are 18 or over, which is a condition of the Ambassador programme.
Our legal basis. Our legitimate interests in paying the right person, preventing fraud and keeping accurate financial records. The accounting and tax records that result from paying you are kept in order to comply with a legal obligation.
How we store it. Identity documents are held outside our public website, in storage that cannot be reached from the internet, under randomly generated filenames. They can be viewed only by authorised staff through an administrative interface that requires them to be signed in. There is no link or web address that gives access to a document.
How long we keep it. The image is deleted as soon as your Ambassador application has been reviewed, whether it is approved or declined. After that we keep only the fact that a check took place, the date, and its outcome — we do not keep the document, and we are not able to reproduce it. If you begin a registration and never complete it, the image is deleted after 90 days. Deletion is carried out automatically.
Checking. We check identity documents on a risk basis. Where a document is checked, we compare the name and date of birth on it against the details you have given us. If they do not agree we will contact you before making any decision, and no commission is paid while the matter is unresolved.
We do not share identity documents with any third party, and we do not use them for any purpose other than the ones set out above.
10. Your rights
Under the UK GDPR you have the right to access, correct, delete or restrict the processing of your personal data, to object to processing, and to data portability. Where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, contact us at support@ceocircle.co.uk.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at https://ico.org.uk.
11. Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with an updated revision date.
12. Contact us
If you have any questions about this Privacy & Cookie Policy or how we handle your data, please contact us at support@ceocircle.co.uk.