1. Who we are
This privacy notice is issued by EB Unlocked Limited, a company registered in England and Wales (company number 15905257), trading as Unlocked Expertise.
Registered office: Clavering House, Newcastle upon Tyne NE1 3NG.
VAT registration number: GB474901867.
EB Unlocked Limited is the data controller for the personal data described in this notice. When we say “we”, “us” or “Unlocked” in this notice, we mean EB Unlocked Limited.
For data protection enquiries, please contact us at hello@unlockedexpertise.com.
2. Scope of this notice
This notice applies to all personal data we process when you:
- Visit the Unlocked Expertise website at unlockedexpertise.com
- Create an account and use the Unlocked platform as a business user
- Register and deliver mentoring sessions as a mentor
- Access the platform as a representative of an organisation, funder or commissioner
- Receive funded or subsidised mentoring through a programme partner
- Contact us by email, phone or through the website
- Use the Unlocked iOS companion app
3. Personal data we collect
The categories of personal data we collect depend on how you interact with us.
Identity and contact data
Name, email address, phone number, job title, company name and professional profile information.
Account and authentication data
Login credentials (managed securely through AWS Cognito — we never store passwords in plaintext), account preferences, and multi-factor authentication settings.
Profile and professional data (mentors)
Professional biography, areas of expertise, career history, profile photograph, LinkedIn profile information (where imported through our LinkedIn integration), availability settings and calendar data.
Business information (business users)
Company name, industry sector, business stage, size, location and the nature of challenges or support being sought.
Booking and session data
Session briefs, booking times, session attendance records, feedback and ratings, and session-related communications.
Communications
Messages exchanged through the platform messaging system, video session participation records, and correspondence with our support team.
Transaction and payment data
Payment amounts, invoice details, Stripe payment references and payout records. We do not store your full card number — payment card data is handled entirely by Stripe.
Technical and device data
IP address, browser type and version, device information, operating system, time zone and general location data derived from your IP address. We collect this data through server logs and essential platform cookies.
Organisation and programme data
Where you access Unlocked through a funded programme or commissioning organisation, we may receive your name, email address and programme participation details from that organisation.
4. How we collect your data
We collect personal data:
- Directly from you — when you create an account, complete your profile, submit a session brief, book a session, make a payment, send a message or contact us.
- Through your use of the platform — technical data generated when you browse or use features of the website and platform.
- From third-party services you connect — such as LinkedIn (if you choose to import your professional profile) or Google/Microsoft Calendar (if you choose to sync your availability).
- From organisations or funders — where a commissioning body refers you to the platform or funds your mentoring sessions.
5. Purposes and lawful bases
We process your personal data for the following purposes, each relying on a lawful basis under UK GDPR.
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Contract performance |
| Matching businesses with suitable mentors | Contract performance |
| Processing session bookings and facilitating mentoring sessions | Contract performance |
| Processing payments and issuing invoices | Contract performance |
| Providing video session and messaging facilities | Contract performance |
| Sending transactional emails (confirmations, reminders, receipts) | Contract performance |
| Delivering funded programmes on behalf of commissioning organisations | Contract performance / Legitimate interests |
| Providing programme reporting to commissioning organisations | Legitimate interests (accountable delivery of funded services) |
| Responding to support requests and complaints | Contract performance / Legitimate interests |
| Fraud prevention and platform security | Legitimate interests (protecting the platform and users) |
| Tax, accounting and legal compliance (including VAT obligations) | Legal obligation |
| Improving the platform and user experience | Legitimate interests (service improvement) |
6. Who we share your data with
We share personal data only where necessary to deliver the service, fulfil a legal obligation or with your consent. We never sell your personal data.
Service providers (sub-processors)
We use the following third-party providers to operate the platform:
- Amazon Web Services (AWS) — cloud hosting, database, file storage, authentication (Cognito) and push notifications. Data is processed in the EU (eu-west-1, Ireland).
- Stripe — payment processing, payouts to mentors via Stripe Connect, and invoicing. Stripe is a PCI Level 1 certified payment processor.
- Twilio — video session infrastructure and in-platform messaging.
- Resend — transactional email delivery (booking confirmations, notifications, invoices).
- Sanity — content management for the public marketing website only. No user personal data is stored in Sanity.
- Mapbox / Google Places — location services for mentor and business location display.
Optional integrations you may connect
- LinkedIn — if you choose to sign in via LinkedIn or import your professional profile.
- Google — if you choose to sign in via Google or sync your Google Calendar.
- Microsoft — if you choose to sync your Outlook/Microsoft calendar.
Commissioning organisations
Where your mentoring is funded by a programme partner or commissioning organisation, we share programme delivery data (such as session attendance, hours used and aggregated feedback) with that organisation in accordance with the programme terms.
Legal and regulatory
We may disclose personal data where required by law, regulation, legal process or enforceable governmental request, or to protect the rights, safety or property of Unlocked, our users or the public.
7. International data transfers
Our primary infrastructure is hosted by AWS in the EU (eu-west-1, Ireland). Some of our sub-processors are based in the United States.
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. Transfers to the US are protected by the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or by Standard Contractual Clauses (UK Addendum) where they are not.
8. How long we keep your data
We retain personal data only for as long as necessary for the purposes set out in this notice, or as required by law.
| Data type | Retention period |
|---|---|
| Active account data | Duration of the account plus 12 months after closure |
| Session and booking records | 6 years (tax and accounting obligations) |
| Payment and invoice records | 6 years (HMRC requirements) |
| Communications and messages | Duration of the account plus 12 months |
| Server logs and technical data | 90 days |
| Contact form submissions | 24 months |
9. Your rights
Under UK data protection law, you have the following rights in relation to your personal data:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate or incomplete personal data.
- Right to erasure — you can ask us to delete your personal data in certain circumstances.
- Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
- Right to data portability — you can request your data in a structured, machine-readable format.
- Right to object — you can object to processing based on legitimate interests.
- Rights related to automated decision-making — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these rights, please contact us at hello@unlockedexpertise.com. We will respond within one month.
10. Use of artificial intelligence
Unlocked has the technical capability to use AI-assisted mentor matching and recommendation features, powered by AWS Bedrock. This functionality is currently disabled and not in active use.
If AI-assisted features are activated in the future, we will update this privacy notice before deployment to describe the data used, the purpose of the processing, the safeguards in place and how you can query or challenge any AI-informed recommendations.
No decisions about access to services, pricing or eligibility are made solely by automated means. Human oversight is maintained for all significant decisions affecting users.
12. Children
Unlocked Expertise is a business mentoring platform designed for use by adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
13. Changes to this notice
We may update this privacy notice from time to time. Material changes will be communicated through the platform or by email. The “last updated” date at the top of this page indicates when the notice was most recently revised.
14. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve your concern.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection authority:
- Website: ico.org.uk
- Telephone: 0303 123 1113
If you have questions about this policy, contact hello@unlockedexpertise.com
EB Unlocked Limited · Company No. 15905257 · VAT GB474901867