Privacy Policy
1. Introduction
We appreciate the trust you place in us when sharing your personal data. The security of that data is very important to us. In this document, we explain how we collect, use, and protect your personal data.
We also explain what rights you have regarding your personal data and how you can exercise those rights.
2. Who we are
Connectd networking platform for early-stage start-ups.
Our Registered Office, which is the preferred contact address for data protection matters, is: LinkExec Ltd t.a Connectd
If you have questions about how we process personal data, or would like to exercise your data subject rights, please email us at dataprotection@connectd.co.
3. Collection of personal data
We collect personal data from you or about you for one or more of the following purposes:
- To enable you to submit a profile on Connectd that other users can view
- To sell our products and services to you if you are a prospective user of Connectd
- To market our products and services to you if you are an existing user of Connectd
- To identify and recommend vacancies that may be of interest to you
- To provide you with services such as training or development. This may include recording and transcribing interactive user-to-user advisory sessions, including within pro bono placements and mentor sessions (where facilitated by our platform and as introduced and rolled out from time to time). These recordings and transcripts may be used to: (a) provide value to mentees by surfacing summaries and key insights to reinforce learning; (b) to support internal service improvement and product development, including the development and training of AI-powered note-taking and summarisation tools; and (c) to generate anonymised, aggregate insights and educational or thought-leadership content for external publication, ensuring that no individual user can be identified. Mentors may disable recording during a session if they do not wish it to be recorded. Users may request deletion of the recording copy for their session at any time (see Your rights as a data subject below).
- To manage any non-marketing communications between you and us
- To ensure the security and safe operation of our websites and underlying business infrastructure
- Process payments: First Floor, 5 Fleet Place London, United Kingdom EC4M 7RD, 020 4586 4006
- Cookie data for website functionality, website analytics and performance measurement, product improvement and website personalisation
Technical information
In addition, to ensure that each visitor to any of our websites can use and navigate the site effectively, we collect the following:
- Technical information, including the IP (Internet Protocol) address used to connect your device to the Internet.
- Your login information, browser type and version, time zone setting, browser plugin types and versions.
- Operating system and platform.
- Information about your visit, including the URL (Uniform Resource Locator) clickstream to, through and from our site.
From time to time, we may use technologies, such as tracking pixels (also called 1x1 pixels or pixel tags), to collect the above information from your interaction with emails we send you. This enables us to focus our marketing to your needs, leading to more relevant emails to our subscribers. It also helps us to identify subscribers that are not engaged with our marketing emails, enabling us to remove them from our send lists.
Our cookies policy, which can be viewed here describes how we use cookies on our website. In section 7 below, we identify your rights in respect of the personal data that we collect and describe how you can exercise those rights.
4. Lawful basis for the processing of personal data
The organisation of our business architecture, accounting and systems infrastructure and compliance means that all personal data is processed on common, group-wide platforms. We have processes in place to make sure that only those people in our organisation who need to access your data can do so. Some data are collected for multiple purposes, as shown, and some data are shared with third parties, again as shown.
When we process on the lawful basis of legitimate interest, we apply the following tests to determine whether it is appropriate:
The purpose test – is there a legitimate interest behind the processing?
Necessity test – is the processing necessary for that purpose?
Balancing test – is the legitimate interest overridden, or not, by the individual’s interests, rights, or freedoms?
| Purpose of collection | Information category | Data collected | Purpose for collection | Lawful basis for processing | Data shared with? | Retention period |
|---|---|---|---|---|---|---|
| 1. Register profile/user account | Account information | Name, email address, telephone number Login information | To set up profile To display to other users | Performance of a contract | Internally and Exlabs, our development support Internally and Exlabs, our development support. Other users | Duration of account. Relevant statute of limitations. |
| 2. Sales | Contact information | Name, email address, telephone number, LinkedIn profile | To generate sales leads | Legitimate interest | Data received from third party TypeForm | 2 years of no activity in our CRM system. |
| 3. Marketing | Marketing information | Name, email address Marketing preferences | To market products and services To select preferred marketing channels | Consent | Internally only | Consent withdrawn. 2 years if marketing email unopened. |
| 4. Identify and recommend vacancies | Contact information, Subject matter information | Name, email address, telephone number, LinkedIn profile, Preferences | To match NEDS and Founders | Legitimate interest | Internally and Exlabs, our development support, other users | Duration of account or change of preferences. |
| 5. Provide other services (e.g. training or development) | Account information, completion history | Name, email address, courses completed | Record training history | Performance of a contract | Internally and Exlabs, our development support (data processor). | Duration of account. |
| 6. Recording and transcribing interactive user sessions via our platform | Identification information, contact and professional information, audio information, job titles, professional background, opinions, information about professional projects, plans or goals, session metadata, and any other information that participants voluntarily share during the session | Name, voice, job title, company name, professional background, area of expertise, industry experience, opinions, information about professional projects, plans or goals, and any other information that participants voluntarily share during the session. While not actively sought, participants may voluntarily disclose special category data such as information revealing, for example, health status, ethnicity, or beliefs; any such data will be treated with heightened safeguards. | To provide, enhance, and improve the user experience and our platform features, and to facilitate interactive sessions as initiated by users | Legitimate interest and Consent | Access to unprocessed recordings and transcripts is restricted to authorised administrators and selected developers who require access for maintenance, quality assurance, or development purposes. No personal data is sent to or processed by any large language model (LLM) or external AI service. All AI-related testing and development use anonymised data only. | Up to 60 days |
| 7. Non-marketing communications | Contact information | Name, email address | All non-marketing communications including service messages, and complaints and issues handling. | Legitimate interest | Internally only. | Duration of account. Relevant statute of limitations. |
| 8. Security | Security information | Technical information, as described above, plus any other information that may be required for this purpose | To protect our websites and infrastructure from cyber attack or other threats and to report and deal with any illegal acts. | Legitimate interest | Internally and, as necessary, with professional advisers. | Relevant statute of limitation. |
| 9. Process payments | Payment information | Cardholder name, email address, unique customer identifier, order ID, bank account details, payment card details, card expiration date, CVC code, transaction details, merchant name/ID, location | To process payments from you to us. | Performance of a contract | Shared with Stripe as payment processor. Stripe also acts as a data controller in respect of some aspects of its service. | Relevant statute of limitation. |
5. Retention and storage of personal data
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. (see section 6 below). We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you), in which case we may use this information indefinitely without further notice to you. Interactive user session recording transcripts are immediately anonymised on creation. Each transcript is assigned a unique ID linking it to the relevant session, but the transcript data itself is held separately and cannot, on its own, identify any participant. The ID-to-user link is stored in a separate, secure database and is not used in any aggregate or public reporting.
Connectd is a UK-domiciled organisation whose primary offices are in the UK.
- Our website and web application are hosted in the UK and accessed only by our UK-based staff and our development teams in Poland.
- Our customer relationship management, marketing and accounting systems are either UK-based or EU-based.
- We use CSPs (Cloud service providers) as part of our processing environment and other third-party providers for the purposes set out below. Unless we specifically state otherwise, we are, in respect of all these CSPs, the data controller. Our CSPs are:
- Amazon Web Services to host our website and web application – and we use a dedicated and secure Amazon S3 bucket to store raw recordings and transcripts of interactive user sessions;
- Hyperline to administer and manage subscription accounts;
- Hubspot for our CRM;
- TalkJS for website messaging;
- Mollie for payment processing (and we may continue to use Stripe during our migration period);
- Unless we specifically state otherwise, all the CSPs that we use utilise UK or EU-based processing facilities.
- CRM data housed in Hubspot AWS European Union (Germany)
- Our payment processors and banking arrangements are based in the UK.
- We operate a data retention policy in respect of all data, whether paper-based or digital, and those aspects of it that relate to personal data are contained in the table in section 4 above.
6. Your rights as a data subject
As a data subject whose personal information we hold, you have certain rights. If you wish to exercise any of these rights, please email dataprotection@connectd.co or use the information supplied in the ‘Contact us’ section below. To process your request, we will ask you to provide two valid forms of identification for verification purposes. Your rights are as follows:
The right to be informed
As a data controller, we are obliged to provide clear and transparent information about our data processing activities. This is provided by this privacy notice and any related communications we may send you.
The right of access
You may request a copy of the personal data we hold about you free of charge. Once we have verified your identity and, if relevant, the authority of any third-party requestor, we will provide access to the personal data we hold about you as well as the following information:
- The purposes of the processing.
- The categories of personal data concerned.
- The recipients to whom the personal data has been disclosed.
- The retention period or envisioned retention period for that personal data.
- When personal data has been collected from a third party, the source of the personal data.
If there are exceptional circumstances that mean we can refuse to provide the information, we will explain them. If requests are frivolous or vexatious, we reserve the right to refuse them. If answering requests is likely to require additional time or occasions unreasonable expense (which you may have to meet), we will inform you.
The right to rectification
When you believe we hold inaccurate or incomplete personal information about you, you may exercise your right to correct or complete this data. This may be used with the right to restrict processing to make sure that incorrect/incomplete information is not processed until it is corrected.
The right to erasure (the ‘right to be forgotten’)
Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data. This includes personal data that may have been unlawfully processed. We will take all reasonable steps to ensure erasure.
The right to restrict processing
You may ask us to stop processing your personal data. We will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies, you may exercise the right to restrict processing:
- The accuracy of the personal data is contested.
- Processing of the personal data is unlawful.
- We no longer need the personal data for processing, but the personal data is required for part of a legal process.
- The right to object has been exercised and processing is restricted pending a decision on the status of the processing.
The right to data portability
You may request your set of personal data be transferred to another controller or processor, provided in a commonly used and machine-readable format. This right is only available if the original processing was based on consent, the processing is by automated means and if the processing is based on the fulfilment of a contractual obligation.
The right to object
You have the right to object to our processing of your data where:
- Processing is based on legitimate interest;
- Processing is for the purpose of direct marketing;
- Processing is for the purposes of scientific or historic research; or
- Processing involves automated decision-making and profiling.
8. Contact us
Any comments, questions or suggestions about this privacy notice or our handling of your personal data should be emailed to dataprotection@connectd.co.
Alternatively, you can contact us at our postal address or telephone number:
LinkExec Ltd t.a Connectd
First Floor, 5 Fleet Place
London, United Kingdom
EC4M 7RD, 020 4586 4006
9. Complaints
Should you wish to discuss a complaint, please feel free to contact us using the details provided above. All complaints will be treated in a confidential manner. Should you feel unsatisfied with our handling of your data, or about any complaint that you have made to us about our handling of your data, you are entitled to escalate your complaint to a supervisory authority within the EU. For the UK, this is the ICO (Information Commissioner’s Office), which is also our lead supervisory authority. You can contact the ICO through their website, https://ico.org.uk/global/contact-us/, or using the details below:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire