Privacy & data protection.
How GBX Circle Ltd collects, holds and protects the personal data entrusted to the Circle. It is held to the same discretion as the room itself.
Last updated · September 2026
1 · Who we are
GBX Circle Ltd ("GBX", "the Circle", "we") is the data controller for personal data processed through this forum and its related sites. We are registered in England & Wales (Co. No. 16685118), with a registered office at 80 Strand, London WC2R 0RL. For any question about this notice or your data, contact hello@gbxcircle.com.
2 · What we collect
We collect only what the conversation requires:
- Identity & contact. Name, organisation, job title, email and telephone number, provided when you request access or correspond with us.
- Curation detail. The priorities, challenges and interests you share so we can assess relevance to the room.
- Technical data. Anonymised analytics (pages viewed, approximate region, device) gathered to understand how the site is used.
3 · How we use it
- To assess and administer requests for access to Circle forums.
- To curate the room by matching participants on relevance and seniority.
- To communicate with you about the forum you have expressed interest in.
- To meet our legal, accounting and reporting obligations.
4 · Lawful basis
We rely on legitimate interests (convening a relevant, senior audience), consent (where you opt in to the Signal or other updates, withdrawable at any time), and legal obligation where the law requires us to retain records.
5 · Who sees it
Your data is treated with the discretion of the room. We do not sell it. We do not pass it to advertising networks. We share it only with the processors who help us run the forum, each bound by a data processing agreement:
- HubSpot. Contact records, email and forms. EU and US, under Standard Contractual Clauses.
- Netlify. Site hosting. US, under Standard Contractual Clauses.
- Vimeo. Video hosting for in the room interviews. US, under Standard Contractual Clauses.
- Google Workspace. Email, documents and calendar. EU and US, under Standard Contractual Clauses.
- Calendly. Meeting scheduling. US, under Standard Contractual Clauses.
- Sanity. Structured content for the forum sites. EU, Frankfurt.
We also disclose data where the law requires it.
6 · Where it goes
Where personal data leaves the UK or the EEA we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. We do not transfer data to a jurisdiction without an adequacy decision or an appropriate safeguard in place.
7 · How long we keep it
We retain personal data only as long as necessary for the purpose it was collected, and thereafter as required for legal and accounting obligations. When it is no longer needed, it is securely deleted.
8 · How we protect it
The site is served over HTTPS with HSTS and a strict content security policy. Internal systems use multi factor authentication and least privilege access. If a breach occurs we will notify the affected individuals and the Information Commissioner's Office within 72 hours, as the law requires.
9 · Your rights
Under UK GDPR you may request access to, correction of, or erasure of your personal data; object to or restrict its processing; and withdraw consent at any time. To exercise any right, write to hello@gbxcircle.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
10 · Cookies & analytics
We use privacy respecting analytics to understand site usage in aggregate. These do not identify you personally. You can control cookies through your browser settings.
11 · Health information
GBX Circle is not a Covered Entity or a Business Associate under the United States Health Insurance Portability and Accountability Act. We do not request, process, store or transmit Protected Health Information. Please do not submit it through our forms, our email or an interview.
12 · Changes to this notice
We may update this notice from time to time. A material change will be reflected here with a revised date.
13 · How to reach us
For a privacy question or to exercise a right, write to hello@gbxcircle.com. A postal address is available on request.