Privacy Policy

This policy explains what personal data Circular Intelligence collects, why we collect it, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Dutch Uitvoeringswet AVG (UAVG). It applies to this website and to any related correspondence or services.

Who we are (data controller)

The data controller responsible for your personal data is:

What data we collect

Data you provide

• Contact form: your name, email address, organisation and the role you select, the message you write, and whether you tick the updates box.
• Newsletter sign-up: your email address, and optionally your first name and organisation. The consent box is required, and the time you gave consent is recorded with your entry.
• Circular Readiness Scan: if you ask for the one page readout, your email address is stored together with your answers, your scores, the revenue band you select and the seat you said you sit closest to.
• Account sign-up: your email address and password, or your Google account if you sign in with Google. If you save a subsidy project, the name, description and filters you save are stored against your account.
• Cohort and ISO 59000 enquiry forms: these open your own email client and send what you type to us by email. Nothing is stored on the site.
• Any information you choose to share in the body of a message or during a meeting.

Data collected automatically

• Basic technical information your browser sends (IP address, user agent, referring page, requested URL) for security, abuse prevention, and aggregated analytics.
• Cookies and browser storage that remember your language choice, whether you have dismissed the announcement bar, and your signed-in session if you have an account (see our Cookie Notice).

Why we use it (purposes and lawful basis)

• Responding to enquiries — to reply to messages and provide requested information. Lawful basis: our legitimate interest in operating the business, or steps taken at your request prior to entering a contract.
• Delivering services — to perform agreed work (assessments, advisory, project support). Lawful basis: performance of a contract.
• Site operation and security — to keep the site available and protect it from abuse. Lawful basis: legitimate interest.
• Legal and tax obligations — to keep records required by Dutch law. Lawful basis: legal obligation.
• Newsletter: to send the monthly briefing and the subscriber discount code you asked for. Lawful basis: consent, given by ticking the box on the sign-up form.
• Scan submissions: to keep the answers and the email address you send us through the Circular Readiness Scan so we can follow up on the readout you asked for. Lawful basis: consent, given by submitting the form.

Who we share it with

We do not sell personal data. We share it only with processors that help us operate the site and the business, under written data processing agreements:

• HubSpot, our customer relationship management system. Contact form submissions and newsletter sign-ups are written to HubSpot as a contact record, the contact form message is attached to that record as a note, and where a contact list is configured the contact is added to it.
• Lovable, the platform this site is built and hosted on, including the Supabase database that holds newsletter subscribers, scan submissions, accounts and saved projects, and Lovable's managed email service that sends account emails.
• Ahrefs Analytics, a cookieless web analytics script that records page views.
• Google, if you choose to sign in with a Google account.
• Stripe, if you book a training seat. The booking button takes you to a Stripe checkout page, and Stripe handles the details you enter there.
• Authorities or advisors where required by law (for example, the Belastingdienst for tax purposes).

Where a provider is located outside the European Economic Area, transfers are covered by an adequacy decision or by the European Commission's Standard Contractual Clauses.

How long we keep it

• Enquiry correspondence: up to 24 months after our last contact, unless a client relationship begins.
• Client records and project files: 7 years after the end of the engagement, in line with Dutch tax retention rules.
• Server logs: typically up to 90 days, longer only where needed for security investigations.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data where one of the GDPR grounds applies.
• Restrict or object to certain processing, including processing based on legitimate interest.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email alexander@circularintelligence.io. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Security

We apply technical and organisational measures appropriate to the nature of the data, including encryption in transit, access controls, and vendor due diligence. No system is perfectly secure; if you believe your data has been compromised, please contact us.

Changes to this policy

We may update this policy to reflect changes to the site, our services, or applicable law. The "last updated" date at the top of this page indicates when the most recent change took effect.