Legal

1. Who we are

CirculAIRity Ltd (“CirculAIRity”, “we”, “us”) is the controller of personal data collected through www.circulairity.co (the “Site”) and through our dealings with you. This policy covers CirculAIRity and its products, including CirculAIRity Signals.

• Registered name: CirculAIRity Ltd
• Company number: 14011003, registered in England and Wales
• Registered office: Meriton Foundry, Meriton Street, Bristol, United Kingdom, BS2 0SZ
• Privacy contact: privacy@circulairity.co
• Postal address for privacy matters: Meriton Foundry, Meriton Street, Bristol, United Kingdom, BS2 0SZ

We have not appointed a statutory Data Protection Officer because we are not required to. Alex Chikhani, CEO, is responsible for data protection and can be reached at the privacy contact above. If we offer services to people in the EU, our EU representative is the company CEO.

2. The personal data we collect

We collect business contact and usage data. We do not intentionally collect special category data (such as health, ethnicity or political opinions), and you should not send it to us.

• Identity and contact: your name, job title, organisation, work email and phone number. You give us these through forms, email, events or meetings.
• Enquiry content: what you ask us, your area of interest and any documents you send. You give us this.
• Marketing preferences: your newsletter subscription, opt-outs and topics of interest. You give us these.
• Technical and usage: your IP address (truncated where possible), device and browser type, pages viewed, referring site and approximate location (country or region). These are collected automatically through cookies and server logs.
• Engagement: whether our emails are opened and links clicked. This comes from our email platform.
• Investor information: your name, organisation, contact details and investment interest, with identity checks only where the law requires. This comes from you or your adviser.
• Publicly available professional data: your name, role, employer, professional profile, published work and public posts on industry topics. This comes from public sources such as LinkedIn, company websites, conference listings and trade press.

Data we obtain from other sources. Where we collect professional information about you from public sources rather than from you, we will tell you within one month, normally in our first message to you, and point you to this policy. You can object at any time (section 9).

3. How we use your data and our lawful bases

We use your data to run the Site, respond to you, understand our audience, inform business decisions and promote our services. Each use has one lawful basis under Article 6 UK GDPR.

• Responding to enquiries and meeting requests: identity, contact and enquiry details. Lawful basis: legitimate interests (answering people who contact us), or contract where you are a customer or about to become one.
• Operating and securing the Site: technical data. Lawful basis: legitimate interests (a working, secure site).
• Site analytics in aggregate: technical and usage data. Lawful basis: legitimate interests, with cookies set under the PECR statistical-purposes exemption (section 5).
• Market and audience insight to inform business decisions: for example which sectors, regions and topics draw interest; usage, engagement, organisation and role. Lawful basis: legitimate interests (planning products, markets and priorities).
• Business development: building and maintaining a contact list of relevant organisations and people, and prioritising follow-up; identity, contact, public professional data and engagement. Lawful basis: legitimate interests (developing business relationships in aviation, energy and defence).
• Email marketing and newsletters: contact details, preferences and engagement. Lawful basis: consent for personal email addresses and sole traders; legitimate interests for corporate email addresses (section 4).
• Investor relations and fundraising: investor information. Lawful basis: legitimate interests, and legal obligation for any required checks.
• Record-keeping, legal claims and regulatory requests: any relevant data. Lawful basis: legal obligation, and legitimate interests (defending our rights).

Where we rely on legitimate interests, we have assessed that our interests are not overridden by yours. Our assessments are available on request. We do not sell personal data.

4. Marketing and promotion

We send news, research updates and event invitations about CirculAIRity’s work. You can opt out at any time, free of charge.

• Corporate email addresses: (e.g. name@company.com) we may send relevant business communications on the basis of legitimate interests, with an unsubscribe link in every message.
• Personal email addresses, and sole traders or partnerships: we send marketing only with your consent, or where you have bought or negotiated to buy from us and did not opt out.
• Phone: we will not call numbers registered with the Telephone or Corporate Telephone Preference Service unless you have told us you are happy to be called.
• Social media and online advertising: we may show adverts to audiences on platforms such as LinkedIn. We will only upload your details to a platform or use advertising cookies with your consent.
• Opting out: use the unsubscribe link, email privacy@circulairity.co, or tell us at any time. We keep a suppression record so we do not contact you again.

We may score how engaged a contact is (for example, opened emails and pages visited) to decide who to follow up first. This never produces decisions with legal or similarly significant effects on you.

5. Cookies and analytics

We use cookies and similar technologies in three groups. You can change your choices at any time through Cookie settings.

• Strictly necessary and functional cookies: make the Site work, keep it secure, and remember your cookie choices and display settings. Examples: session and cookie-consent cookies. These are always on and are exempt from consent.
• Analytics cookies: count visits and show how the Site is used, in aggregate, so we can improve it. Examples: Google Analytics 4 / Plausible / other. These are on by default with a clear opt-out, under the statistical-purposes exemption.
• Marketing cookies: measure advertising campaigns and build advertising audiences. Examples: LinkedIn Insight Tag and Google Ads. These are off until you opt in.

Our analytics settings are configured for statistics only: IP truncation on, Google signals and ad personalisation off, and data retention set to 14 months. Analytics data is not shared for advertising. If we ever use it to profile individuals or target adverts, we will ask for consent first.

A full list of cookies, their providers and lifetimes is in our Cookie Notice.

6. Who we share your data with

We share personal data only where needed for the purposes above, and we never sell it.

• Service providers acting for us (processors): under written contracts: website hosting, email and newsletter platform, CRM, analytics, cloud storage and office software.
• Professional advisers: lawyers, accountants, auditors and insurers.
• Group companies and investors: where needed for fundraising or corporate transactions, under confidentiality terms. If we sell or restructure our business, data may pass to the new owner under this policy.
• Authorities: where the law requires, or to protect rights, safety or national security.

International transfers. Some providers process data outside the UK, for example in the EEA or the United States. We only transfer data where the destination meets the UK’s data protection test (such as the EEA, or US companies certified under the UK Extension to the EU–US Data Privacy Framework), or under the ICO’s International Data Transfer Agreement or Addendum with any additional safeguards needed. Contact us for details of the safeguard used.

7. How long we keep your data

We keep data only as long as the purpose needs it, then delete or anonymise it.

• Enquiries that do not lead to a relationship: 2 years from last contact.
• Business development contacts (CRM): 3 years from last meaningful interaction, then reviewed or deleted.
• Newsletter subscribers: until you unsubscribe; inactive contacts are reviewed every 2 years.
• Suppression (do-not-contact) list: indefinitely, minimum details only, so we respect your opt-out.
• Analytics data: 14 months.
• Customer, supplier and investor records: 6 years after the relationship ends (tax and limitation periods).
• Server and security logs: up to 12 months.

8. Security

We protect personal data with technical and organisational measures proportionate to the risk. These include encryption in transit (HTTPS) and at rest, multi-factor authentication, role-based access limited to staff who need it, and vetted service providers. If a breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell you without undue delay where the risk is high.

9. Your rights and how to complain

You have the right to:

• access a copy of your personal data;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances;
• restrict how we use it;
• object to processing based on legitimate interests, and to direct marketing at any time, which we will always honour;
• data portability for data you gave us under consent or contract;
• withdraw consent at any time, without affecting earlier processing.

To use any right, email privacy@circulairity.co. It is free. We may ask you to confirm your identity, and we respond within one month (extendable by two months for complex requests). Our searches for your data will be reasonable and proportionate.

Complaints to us. If you are unhappy with how we handle your data, please complain to us first by emailing privacy@circulairity.co. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed and tell you the outcome.

Complaints to the ICO. You can also complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF.

10. Other information

• Children: the Site is aimed at businesses and professionals and is not intended for anyone under 18. We do not knowingly collect children’s data.
• Automated decisions: we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
• Links: other websites linked from the Site have their own privacy policies; we are not responsible for them.
• Changes: we review this policy at least annually and will post updates here with a new date. Significant changes will be notified to subscribers by email.