Spin State Privacy Policy
Spin State privacy policy
Last updated: 30 July 2026
This notice explains how Spin State Limited collects, uses and shares personal information, and the rights you have over it. It is written to be read, not skimmed past. If anything in it is unclear, email us and a human will answer.
Who we are
Spin State Limited, a company registered in Northern Ireland, company number NI702477, registered office 50 Stranmillis Embankment, Belfast BT9 5FL. We are the data controller for the processing described here.
Contact: info@yourspinstate.com
What this notice covers
Our website and member community at yourspinstate.com, which run on the Circle platform
The Spin State Leadership Indicator at indicator.yourspinstate.com
Forms we run, including event registration and book request forms
Event ticketing and purchases
Our client services, including leadership programmes and advisory work
Business-to-business marketing and outreach
Email, phone and message correspondence with us
What we collect and why
When you join or use the community. Name, email address, profile information you choose to add, the posts, comments and messages you write, event registrations and attendance, and course progress. We use this to run the community, deliver the programmes you have joined, and keep the space safe. Lawful basis, performance of our contract with you, and our legitimate interest in running a well-managed community.
When you take the Leadership Indicator. Your full name, email address, your answers, and the score and band they produce. We use this to build your report, send it to you, and follow up about it. Indicator contacts go into our customer relationship system. Lawful basis, our legitimate interest in responding to people who ask us for an assessment, and consent for any ongoing marketing.
When you request a book or register for an event. Name, email, business name where asked, postal address where a physical copy is being sent, and ticket and payment details for paid events. Payment card details go directly to our payment processor, we never see or store card numbers. Lawful basis, performance of a contract, taking steps at your request before one.
When you are a client. Contact details, organisation details, the content of the work we do together, and billing records. Lawful basis, performance of our contract, and legal obligation for accounting records.
When we research and contact businesses. We gather business contact information, name, role, organisation, work email, public profile details, from public sources and licensed business databases, to contact people whose role suggests our work is relevant to them. Lawful basis, our legitimate interest in business-to-business marketing. Every message we send tells you how to stop hearing from us, and we honour that immediately.
Automatically, when you use our sites. IP address, device and browser information, pages visited and actions taken, collected through cookies and similar technologies, including Google Analytics, and advertising tools from Meta and LinkedIn. We use this to understand how the sites are used and to measure our advertising. Lawful basis, consent for non-essential cookies, collected through the cookie banner. You can withdraw it there at any time.
AI, stated plainly
Two separate things are true, and we would rather you knew both.
The community platform's AI. Circle, our platform provider, offers AI-powered features that process prompts and community content through third-party model providers, currently OpenAI, in the United States. Circle's agreements govern that processing, its subprocessor list is public at trust.circle.so. These features are active in our community. Content processed by them is used to provide the feature and retained by the provider for a limited period under Circle's agreements with them.
Our own use of AI. We use AI tools, including Anthropic's Claude, in how we run the business, drafting, analysis, and administration, under controlled connections we configure ourselves.
Two commitments that apply across both. Your personal data is never used by us, or on our instruction, to train, fine-tune or improve any AI model. And where AI features operate in a space we run for a client organisation, we tell that client before their people's content is processed by them.
Who receives your information
We share personal data with service providers who process it for us under contract:
Platform and hosting, Circle (community and website), Supabase and Vercel (Leadership Indicator), and their infrastructure providers
Communications, our email and transactional mail providers, including Resend and Microsoft 365
Customer relationship management, Zoho Bigin
Automation, Zapier, which moves data between the systems above
Payments, Stripe, and our accounting systems and accountants
Forms and scheduling, Typeform and Calendly
Analytics and advertising, Google, Meta and LinkedIn
AI providers, as described in the AI section above
Agencies working under our instruction on marketing and outreach
We also share information where the law requires it, and in connection with a business sale or reorganisation, under confidentiality.
We do not sell personal data. Community posts are visible to other members, what you share there is shared with them.
Where your data goes
Several of our providers process data in the United States. Where personal data leaves the UK we rely on recognised safeguards, the UK Addendum to the EU standard contractual clauses or the UK International Data Transfer Agreement, and the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. Copies of the relevant safeguard are available on request.
How long we keep it
Community accounts, while your membership is active, deleted on request after you leave
Leadership Indicator responses, while we have an active relationship with you, reviewed at least every two years
Client files, for the duration of the engagement plus six years, matching legal and professional record requirements
Accounting records, six years, legal obligation
Marketing lists, until you unsubscribe or we hear nothing from you for a sustained period
Correspondence, as long as needed for the matter it concerns
Your rights
You can ask us for access to the personal data we hold about you, correction of anything wrong, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interests, including all direct marketing, which we will stop without argument. Where processing rests on consent you can withdraw it at any time.
Email info@yourspinstate.com and we will respond within one month.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk. If you are in Ireland or elsewhere in the EU, you can complain to your local supervisory authority, in Ireland the Data Protection Commission at dataprotection.ie.
Security
Data is encrypted in transit, access is restricted to what each system and person needs, and our platform providers hold independent security attestations, Circle holds SOC 2 Type II. No system is beyond breach, if one ever affects your data in a way that puts you at risk, we will tell you and the ICO as the law requires.
Age
Our community and services are for adults. You must be 18 or over to hold an account.
Changes
When this notice changes we will update the date at the top, and for material changes we will tell members directly.
Contact
Spin State Limited50 Stranmillis Embankment, Belfast BT9 5FLinfo@yourspinstate.com