Privacy Notice

This privacy notice is issued by EB UNLOCKED LTD, a company registered in England and Wales (company number 15905257), trading as Unlocked Expertise.

Registered office: Clavering House, Newcastle upon Tyne NE1 3NG.
VAT registration number: GB474901867.

EB UNLOCKED LTD is the data controller for the personal data described in this notice. When we say “we”, “us” or “Unlocked” in this notice, we mean EB UNLOCKED LTD.

For data protection enquiries, please contact us at hello@unlockedexpertise.com.

This notice applies to all personal data we process when you:

• Visit the Unlocked Expertise website at unlockedexpertise.com
• Create an account and use the Unlocked platform as a business user
• Register and deliver mentoring sessions as a mentor
• Access the platform as a representative of an organisation, funder or commissioner
• Receive funded or subsidised mentoring through a programme partner
• Contact us by email, phone or through the website
• Work for a business we contact about mentoring or partnership, or that contacts us, including by phone

The categories of personal data we collect depend on how you interact with us.

Identity and contact data

Name, email address, phone number, job title, company name and professional profile information.

Account and authentication data

Login credentials (managed securely through AWS Cognito — we never store passwords in plaintext), account preferences, and multi-factor authentication settings.

Profile and professional data (mentors)

Professional biography, areas of expertise, career history, profile photograph, LinkedIn profile information (where imported through our LinkedIn integration), availability settings and calendar data.

Business information (business users)

Company name, industry sector, business stage, size, location and the nature of challenges or support being sought.

Booking and session data

Session briefs, booking times, session attendance records, feedback and ratings, and session-related communications.

Communications

Messages exchanged through the platform messaging system, video session participation records, and correspondence with our support team.

Transaction and payment data

Payment amounts, invoice details, Stripe payment references and payout records. We do not store your full card number — payment card data is handled entirely by Stripe.

Technical and device data

IP address, browser type and version, device information, operating system, time zone and general location data derived from your IP address. We collect this data through server logs and essential platform cookies.

Organisation and programme data

Where you access Unlocked through a funded programme or commissioning organisation, we may receive your name, email address and programme participation details from that organisation.

Business contacts and phone calls

If you run or work for a business we contact about mentoring or partnership, or that contacts us, we hold your name, job title, company, work email, work phone number and notes of our conversations. Some of this comes from public sources such as Companies House and your company's website.

We record business phone calls that our team makes or receives, and turn each recording into a written transcript. We tell you at the start of the call that it is being recorded. We use recordings and transcripts to keep an accurate note of what was said and agreed, and to follow up properly. If you would rather a call was not recorded, say so and we will stop the recording or call you back without it.

We collect personal data:

• Directly from you — when you create an account, complete your profile, submit a session brief, book a session, make a payment, send a message or contact us.
• Through your use of the platform — technical data generated when you browse or use features of the website and platform.
• From third-party services you connect — such as LinkedIn (if you choose to import your professional profile) or Google/Microsoft Calendar (if you choose to sync your availability).
• From organisations or funders — where a commissioning body refers you to the platform or funds your mentoring sessions.

We process your personal data for the following purposes, each relying on a lawful basis under UK GDPR.

We share personal data only where necessary to deliver the service, fulfil a legal obligation or with your consent. We never sell your personal data.

Service providers (sub-processors)

We use the following third-party providers to operate the platform:

• Amazon Web Services (AWS) — cloud hosting, database, file storage, authentication (Cognito), push notifications, and storage and transcription of business call recordings (Amazon Transcribe). Data is processed in the EU (eu-west-1, Ireland).
• Stripe — payment processing, payouts to mentors via Stripe Connect, and invoicing. Stripe is a PCI Level 1 certified payment processor.
• Twilio — video session infrastructure, in-platform messaging, and connecting our business phone calls. Call recordings are moved to our own storage in Ireland as soon as each call ends and are not kept by Twilio.
• Resend — transactional email delivery (booking confirmations, notifications, invoices).
• Sanity — content management for the public marketing website only. No user personal data is stored in Sanity.
• Mapbox / Google Places — location services for mentor and business location display.

Optional integrations you may connect

• LinkedIn — if you choose to sign in via LinkedIn or import your professional profile.
• Google — if you choose to sign in via Google or sync your Google Calendar.
• Microsoft — if you choose to sync your Outlook/Microsoft calendar.

Commissioning organisations

Where your mentoring is funded by a programme partner or commissioning organisation, we share programme delivery data (such as session attendance, hours used and aggregated feedback) with that organisation in accordance with the programme terms.

Legal and regulatory

We may disclose personal data where required by law, regulation, legal process or enforceable governmental request, or to protect the rights, safety or property of Unlocked, our users or the public.

Our primary infrastructure is hosted by AWS in the EU (eu-west-1, Ireland). Some of our sub-processors are based in the United States.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. Transfers to the US are protected by the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or by Standard Contractual Clauses (UK Addendum) where they are not.

We retain personal data only for as long as necessary for the purposes set out in this notice, or as required by law.

We protect personal data, including sensitive data such as payment information and data from calendars you connect, with the following technical and organisational measures.

• Encryption in transit. All traffic between your device and our website, platform and servers is encrypted using HTTPS (TLS). Video sessions are encrypted in transit by our video provider, Twilio. We do not record mentoring sessions. Business call recordings are stored encrypted and can only be played by signed-in members of our team.
• Encrypted access tokens. The access tokens that let us read and update a calendar you connect are encrypted with AES-256 before they are stored. The encryption key is held in AWS Secrets Manager, separately from the database.
• Encrypted messages. Messages you send through the platform are encrypted with AES-256 before they are stored, using a key held in AWS Secrets Manager, separately from the database. Notification emails and in-app notifications tell you who has written to you but do not include what they said. Messages are not end-to-end encrypted: because we hold the key, a small number of people with access to our production systems could technically read them. They only do so to keep the service running, to look into a concern you raise, or where the law requires it. Conversations with our support team are visible to that team. There is a plain-English explanation, with a diagram, at unlockedexpertise.com/privacy.
• Encrypted file storage. Files such as profile photographs and invoices are stored in Amazon S3, which encrypts them at rest.
• Passwords and payment cards. Passwords are handled by AWS Cognito and are never visible to us. Multi-factor authentication is available on every account. Card details are entered directly with Stripe and never reach our servers.
• Access control. Each user can see only their own data and what is shared with them for a session. Within Unlocked, access to personal data is limited to the administrators who need it to run the service, through role-restricted accounts.
• Data minimisation. We collect only what the service needs. For example, from a connected calendar we keep the times and titles of busy events, and nothing else (see section 10).
• Hosting. Our platform and database run on AWS in the EU (eu-west-1, Ireland), and the database accepts only authenticated connections.
• Incidents. If a personal data breach occurs, we will notify the Information Commissioner's Office within 72 hours where required, and tell affected users without undue delay where the breach is likely to put them at high risk.

Mentors can choose to connect a Google Calendar or a Microsoft (Outlook) calendar so that clients cannot book them when they are busy, and so that booked sessions appear in their calendar. Connecting a calendar is optional.

What we access

With your permission, we view the events in your calendar and create, update and delete the events for sessions booked through Unlocked. We also read the email address and name of the connected account so we can show you which calendar is connected.

How we use it

• We read events from the day before to 60 days ahead, and use the times of events you are busy for to stop clients booking you at those times.
• When a session is booked, rescheduled or cancelled, we add, update or remove that session in your calendar. Disconnecting the calendar stops this.

What we store

For each busy event we store only its start and end time, its title and whether it is an all-day event. We do not store event descriptions, attendees, locations or attachments. Only you can see your stored calendar events. Other users see only that a time is unavailable.

What we never do

We do not sell calendar data, use it for advertising, share it with anyone else, or use it to develop or train artificial intelligence or machine learning models. Our staff do not read it unless you ask us to for support, or where it is needed for security or to comply with the law.

Unlocked Expertise's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting

You can disconnect a calendar at any time from your availability settings. When you do, we delete its access tokens and every busy event we stored from it straight away. You can also remove our access from your Google account permissions or your Microsoft account apps.

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete personal data.
• Right to erasure — you can ask us to delete your personal data in certain circumstances.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can request your data in a structured, machine-readable format.
• Right to object — you can object to processing based on legitimate interests.
• Rights related to automated decision-making — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any of these rights, please contact us at hello@unlockedexpertise.com. We will respond within one month.

Unlocked has the technical capability to use AI-assisted mentor matching and recommendation features, powered by AWS Bedrock. This functionality is currently disabled and not in active use.

If AI-assisted features are activated in the future, we will update this privacy notice before deployment to describe the data used, the purpose of the processing, the safeguards in place and how you can query or challenge any AI-informed recommendations.

When we record a business phone call, our team can ask Claude, an AI model provided by Anthropic, to draft notes of the call from its transcript. A member of our team checks and corrects every draft before it is saved. Anthropic processes the transcript to produce the draft only.

No decisions about access to services, pricing or eligibility are made solely by automated means. Human oversight is maintained for all significant decisions affecting users.

Our use of cookies is described in our Cookie Policy. We use only essential cookies required for the platform to function. We do not use third-party analytics or advertising cookies.

Unlocked Expertise is a business mentoring platform designed for use by adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this privacy notice from time to time. Material changes will be communicated through the platform or by email. The “last updated” date at the top of this page indicates when the notice was most recently revised.

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve your concern.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection authority:

• Website: ico.org.uk
• Telephone: 0303 123 1113