Legal
Privacy Policy
What we collect, why, and what rights you have over it.
Circle 26 works with families whose affairs are private by nature. This policy explains what we collect through our website, why, how long we keep it, and what you can ask us to do about it. It is written to be read, not to be skimmed past.
If anything here is unclear, write to us at legal@circle26.com and we will answer.
1. Who we are
Circle 26 Ltd ("Circle 26", "we", "us") is the data controller for personal data collected through circle26.com.
| Registered entity | Circle 26 Ltd |
| Company number | 17426314 |
| Registered office | 4th Floor Office, 205 Regent Street, London, England, W1B 4HB |
| Privacy contact | legal@circle26.com |
We are established in the United Kingdom. Our processing of personal data is governed by the UK General Data Protection Regulation and the Data Protection Act 2018, and is regulated by the Information Commissioner's Office.
2. What we collect, and why
We collect personal data in six situations. Each has its own purpose, its own legal basis and its own retention period.
2.1 When you contact us, schedule a call or request an invitation
What we collect. Your name, email address, telephone number if you give it, the organisation or family office you represent, the country or countries you operate in, and whatever you choose to tell us in your message. Our contact form sends this to HubSpot. Requests to join the Peer Circle are made through a form hosted by HubSpot.
Why. To respond to you, to arrange a call, to assess whether we are the right fit, and, for the Peer Circle, to review your request to join.
Legal basis. Steps taken at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in responding to enquiries about our services and our community (Article 6(1)(f)).
Please keep it general at this stage. We do not need account details, entity names, holdings or the identity of family members to reply to you, and we would ask you not to provide them. If you would rather talk by telephone than write, say so and we will arrange it.
How long we keep it. Twelve months from your last contact with us if the enquiry does not proceed. Where an engagement follows, for the duration of that engagement and for seven years afterwards, in line with our professional and record-keeping obligations.
2.2 When you book a Wealth Clarity Session
What we collect. Your name, email address, the session date and time, any information you provide in advance of the session, our notes from the session, and the written report we prepare for you. We also keep a record of the invoice and payment for the session.
Why. To provide the session you have booked, to prepare your report, to take payment, and to meet our accounting and tax obligations.
Legal basis. Performance of a contract with you (Article 6(1)(b)), and compliance with a legal obligation in respect of financial records (Article 6(1)(c)).
How long we keep it. Where an engagement follows, session records are kept for the duration of that engagement and seven years afterwards. Where no engagement follows, session records are kept for six years after the session and then deleted. Invoice and payment records are kept for seven years, as our accounting obligations require.
What is discussed in a session is confidential and subject to the Chatham House Rule. It is governed by the engagement terms and the non-disclosure agreement that accompany that service, not by this policy.
2.3 When you request the Lean Family Office Guide
Where this happens. On circle26.com/guide and on our articles. Depending on the form, your details are sent to HubSpot or to Ghost, our newsletter platform (see section 5).
What we collect. Your name, email address, and any other field the form asks for. Where the guide is delivered through HubSpot, HubSpot's document viewer may also record that the guide was opened, which pages were viewed and for how long.
Why. To send you the guide, to send you our newsletter, and to understand which parts of the guide people actually read so we can improve it.
The guide comes with our newsletter. Requesting the guide also subscribes you to our newsletter. The form says so before you submit it, and you can unsubscribe at any time from any email we send. Section 2.5 explains how the newsletter works.
Legal basis. Your consent (Article 6(1)(a)), and our legitimate interest in understanding how our published material is used (Article 6(1)(f)).
How long we keep it. Until you unsubscribe from the newsletter, and for twelve months afterwards so that we can honour your unsubscribe request.
2.4 When you register for an event
We run online Expert Sessions and in-person events.
What we collect. Your name, email address, the organisation or family office you represent, and the event you are attending. For in-person events we may also ask about accessibility requirements and dietary requirements.
Why. To register you, to send you joining details, and to run the event.
Legal basis. Performance of a contract with you, or steps taken at your request before entering into one (Article 6(1)(b)).
Accessibility and dietary information. These fields are optional. Dietary requirements can reveal information about health or belief, so we treat them with particular care: we use them only to cater the event you are attending, we do not add them to your contact record, and we delete them within thirty days of the event. Where you provide such information, you consent to our using it for that purpose (Article 9(2)(a)), and you can withdraw that consent at any time.
Other attendees. Whether an event is online or in person, other attendees can see who is present, your name, and whatever you have set as your display name. We do not circulate an attendee list, and we do not share your details with other attendees or with speakers unless you ask us to.
Recording. Expert Sessions are recorded, and we say so before each session begins. Recordings form part of our library and are made available to Peer Circle members through our community platform for as long as Circle 26 operates. If you attend and speak, your voice, your name and anything you contribute form part of that recording. If you would prefer not to be recorded, attend without your camera and microphone on and use the written questions instead, or let us know in advance. If you appear in a recording and later want your contribution removed or edited, write to us and we will do so.
Legal basis for recordings. Our legitimate interest in keeping a library of our sessions for our community (Article 6(1)(f)). You can object at any time, as described above.
Chatham House Rule. Sessions are held under the Chatham House Rule: what is said may be used, but not attributed. Peer Circle members agree to that rule and to our Community Charter as a condition of joining.
How long we keep it. Registration records for twenty-four months. Accessibility and dietary information for thirty days after the event. Recordings for as long as Circle 26 operates, unless you ask us to remove your contribution sooner.
2.5 When you subscribe to the newsletter
What we collect. Your email address and your name. We record when you subscribed, the page you signed up on, and whether you open or click the emails we send.
Why. To send you our newsletter.
Who runs it. Circle 26 Ltd is the controller of your newsletter data. The newsletter is sent through Ghost, which processes your data on our behalf as our service provider (see section 5). When you subscribe, Ghost sends you an email asking you to confirm your address.
Legal basis. Your consent (Article 6(1)(a)).
How long we keep it. Until you unsubscribe, and for twelve months afterwards so that we can honour your unsubscribe request. Every email we send carries a one-click unsubscribe link.
Subscribing is always your choice. We will not add you to the newsletter because you contacted us, registered for an event, booked a session or became a client. It only happens when you sign up through a form that says so, including the guide request form, by ticking a box that is never pre-ticked.
2.6 When you visit the website
We use analytics to understand how the site is used and where it falls short. This is covered in section 4 and in our Cookies Policy.
3. Members of the Peer Circle
The Peer Circle, our invitation-only community, runs on Circle.so, a separate platform, not on circle26.com.
We are the controller for the member data you provide to us and for the content you post within our community, your profile, your posts, your comments and your participation.
Circle.so is our processor for that data, and processes it on our instructions under a data processing agreement.
Circle.so is also an independent controller for its own platform usage and product data. That processing is governed by Circle.so's own privacy notice, not by this policy, and we do not control it.
What members should know. Content you post is visible to other members of the community. Our Community Charter and Terms of Use govern what may be shared and the confidentiality expected of everyone in it. Do not post information about a family, a structure or a transaction that you are not free to share.
Member data is retained for as long as you remain a member of the Peer Circle and for twelve months afterwards.
4. Cookies, analytics and session recording
We do not use analytics or recording of any kind until you consent through the banner on our site. Necessary cookies, which make the site function, run without consent because the site cannot work without them.
Subject to your consent, we use:
| TOOL | PROVIDER | WHAT IT DOES |
|---|---|---|
| HubSpot | HubSpot, Inc. | Analytics, form handling, email delivery, and recording which pages and documents you view |
| Google Analytics | Aggregate statistics on how the site is used | |
| Microsoft Clarity | Microsoft | Session recording and heatmaps, see below |
| Google Tag Manager | Manages how the tools above are loaded |
Microsoft Clarity records your session. It captures how you move through a page, mouse movement, scrolling, clicks and navigation, and allows us to replay it so we can see where the site is confusing or broken. Text you type into forms is masked and is not captured.
We use session analytics to improve the site, not to identify or profile any individual, and we do not attempt to link a recording to a named person.
If you would rather we did not, decline analytics cookies in the banner, or change your choice at any time through the cookie settings link in our footer. The site works fully either way.
Our Cookies Policy lists every cookie, its purpose and its duration.
5. Who we share your data with
We do not sell personal data. We do not share it for anyone else's marketing.
We use the following service providers, each under a written data processing agreement:
| PROVIDER | PURPOSE | DATA LOCATION |
|---|---|---|
| HubSpot | Forms, contacts, email, website and document analytics | European Union |
| Ghost (Ghost Foundation) | Newsletter subscriptions and email delivery | United States |
| Circle.so | Peer Circle community platform | United States |
| Website analytics and tag management | United States | |
| Microsoft | Microsoft Clarity session analytics | United States |
| Microsoft 365 | Business email, Teams, documents and file storage | Malaysia, with limited processing in the United States |
| Notion Labs | Project management and meeting notes | United States |
| Anthropic | AI assistant (Claude), used under business terms | United States |
| Zoom | Online meetings and Expert Sessions | United States |
| DocuSign | Electronic signatures | Australia |
| Xero | Accounting and invoicing | United States |
| Hostinger | Website hosting | United Kingdom, with backups in Germany |
We may also share personal data with our professional advisers where necessary, and with a regulator, court or authority where we are required by law to do so. If our business is transferred, personal data may transfer with it, and we would tell you before that happened.
6. Sending data outside the UK
We are established in the United Kingdom, and our website is hosted here. Some of the providers listed in section 5 process personal data outside the UK. Where they do, the following applies.
European Economic Area. HubSpot processes our data in the EU, and our website backups are held in Germany. The United Kingdom recognises the EEA as providing an adequate level of protection, so no additional safeguard is required.
United States, under the Data Privacy Framework. Microsoft, Google, HubSpot, Notion and Zoom are certified under the UK Extension to the EU–US Data Privacy Framework, which the United Kingdom recognises as providing adequate protection.
Standard Contractual Clauses. For Anthropic (United States), Circle.so (United States), Xero (United States), Ghost (United States) and Microsoft 365 (Malaysia), we rely on the UK Addendum to the EU Standard Contractual Clauses in each provider's data processing terms.
Australia. For DocuSign, we rely on DocuSign's Binding Corporate Rules and the Standard Contractual Clauses with the UK Addendum, as set out in its Data Protection Attachment.
These safeguards operate together with the technical and organisational measures described in section 7.
You may ask us for a copy of the safeguards that apply to a particular transfer by writing to legal@circle26.com.
7. How we protect your data
Access to personal data is limited to those of our people who need it. Working copies are encrypted at rest on every device we use. Accounts carrying access to personal data require multi-factor authentication. Access is reviewed whenever someone joins or leaves, and removed within one working day of a person ceasing to need it.
We ask only for the data we need. Where we can work with a band rather than a figure, or a category rather than a name, we do.
No system is perfectly secure, and we do not claim otherwise. Where a breach affects your personal data and is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where the risk is high, you.
8. Artificial intelligence
We do not use your personal data to train any artificial intelligence model.
Some of the business systems we use, those listed in section 5, include automated or AI-assisted features as part of their standard functionality. Where a provider offers business or enterprise terms under which customer content is not used to train their models, we select those terms.
We do not submit personal data to general-purpose consumer AI services.
9. Your rights
Wherever you are, you may ask us to:
- tell you what personal data we hold about you, and give you a copy
- correct anything inaccurate or incomplete
- delete it, where we have no continuing reason to hold it
- restrict how we use it while a question about it is resolved
- transfer it to you or another provider in a machine-readable format
- stop using it, where we rely on legitimate interests
- withdraw consent at any time, where consent is what we rely on
To exercise any of these, write to legal@circle26.com. We will respond within one month. We do not charge for this, and we will not ask why.
If you are unhappy with how we have handled your data, tell us first, we would rather fix it. You also have the right to complain to a supervisory authority:
- United Kingdom, Information Commissioner's Office, ico.org.uk. This is our lead supervisory authority, and you may complain to them at any time
- European Economic Area, the supervisory authority in the country where you live or work
10. Automated decisions
We do not make decisions about you by automated means alone, and we do not profile you in any way that produces legal or similarly significant effects.
11. Children
Our services are for adults. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.
12. Links to other sites
Our site links to other websites, including Circle.so. We are not responsible for their privacy practices, and this policy does not cover them.
13. Changes to this policy
We will post any change here and update the date at the top. Where a change materially affects how we use your personal data, we will tell those affected directly.
14. Contact
| Privacy enquiries | legal@circle26.com |
| Post | Circle 26 Ltd, 4th Floor Office, 205 Regent Street, London, England, W1B 4HB |