This Privacy Policy explains how My Endorsement (“My Endorsement”, “we”, “us”, “our”) collects, uses, shares and protects your personal information when you use our website at myendorsement.co.uk, our client, adviser and assessor portals, and our related services (together, the “Service”).
We are committed to protecting your privacy and handling your personal data transparently and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Please read this policy carefully. If you do not agree with it, please do not use the Service.
1Who we are
My Endorsement operates the website and services described in these terms.
For the purposes of data protection law, My Endorsement is the data controller of the personal data we collect about you, except where we act as a processor on behalf of a client (for example, when we process information you provide about co-founders or team members).
If you have any questions about this policy or how we handle your data, contact us at hello@myendorsement.co.uk or write to us at the address above.
2What this policy covers
This policy applies to:
- Prospective clients and website visitors who browse our site, submit an enquiry, or start a free trial;
- Clients (founders) who purchase or use our advisory and endorsement-readiness services;
- Co-founders and team members whose information a client provides to us;
- Advisers who register to deliver services through our platform; and
- Assessors from endorsing bodies who are granted access to review a client's case.
A note on our role: My Endorsement provides business and endorsement-readiness advisory services to help founders prepare to approach a UK endorsing body. We are not an endorsing body, a law firm, or a regulated immigration adviser, and we do not make endorsement or immigration decisions.
3The information we collect
Depending on how you interact with us, we may collect the following categories of personal data.
3.1 Information you give us
- Account and contact details: name, email address, telephone number, password, and job title or role.
- Identity and verification (KYC) data: where required to deliver the Service, we may collect your date of birth, nationality, a government-issued identity document (such as a passport or driving licence), a photograph or “selfie” holding your ID, proof of address, and information about your right to work or reside in the UK.
- Business and application information: details of your venture, business idea, market and financial information, pitch materials, company registration details, intellectual property information, and any documents you upload at each stage of your journey.
- Communications: the content of messages, feedback, survey responses, mentoring notes, and any correspondence with us or with an adviser.
- Payment information: billing name and address, and transaction records. Card details are collected and processed directly by our payment provider (Stripe) — we do not store your full card number.
3.2 Information we collect automatically
- Technical and usage data: IP address, device and browser type, operating system, referring URLs, pages viewed, actions taken, dates and times of access, and other analytics data.
- Cookies and similar technologies: see section 11.
3.3 Information from third parties
- Payment and identity providers may confirm the status of a payment or verification.
- Referrals: if you were referred to us, we may receive limited details from the referrer.
- Social and advertising platforms (for example, where you respond to a campaign) may provide us with lead information you submitted there.
4Special category and sensitive data
Some information we process — such as identity documents and a photograph of you — is used to verify your identity and eligibility. We treat identity and KYC information with heightened care, apply additional security, and only collect what is necessary. Where we process any information that constitutes special category data under the UK GDPR, we do so only where a lawful condition applies (for example, your explicit consent, or where processing is necessary for reasons of substantial public interest or the establishment, exercise or defence of legal claims).
Please do not send us sensitive personal information that we have not requested.
5How we use your information and our lawful bases
We use your personal data for the purposes below. Under the UK GDPR we must have a lawful basis for each use; the relevant basis is shown in brackets.
- To provide the Service — creating and managing your account, delivering advisory and preparation services, enabling mentoring, generating documents, and supporting your journey. (Performance of a contract.)
- To verify identity and eligibility — carrying out KYC checks on clients and advisers. (Legal obligation and/or performance of a contract; explicit consent where required for special category data.)
- To take payment — processing fees, add-ons, upgrades, invoices and receipts. (Performance of a contract.)
- To communicate with you — responding to enquiries, sending service and transactional messages (such as confirmations, reminders, and decision notifications). (Performance of a contract and our legitimate interests in operating the Service.)
- To provide customer support and improve the Service — troubleshooting, analytics, product development, and quality assurance. (Our legitimate interests in running and improving a reliable service.)
- To manage advisers — onboarding, KYC, contracts, assignment of cases, and payments. (Performance of a contract and legitimate interests.)
- To enable assessor review — providing an endorsing-body assessor with read-only access to a client's case where the client has generated access. (Performance of a contract and legitimate interests.)
- For marketing — sending you information about our services where you have opted in or where permitted by law. (Consent and/or legitimate interests; you can opt out at any time.)
- To keep records and comply with law — accounting, tax, dispute resolution, and regulatory compliance. (Legal obligation and legitimate interests.)
- To protect the Service — security, fraud prevention, and enforcing our terms. (Legitimate interests.)
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about this balancing exercise.
6Artificial intelligence and automated processing
Parts of the Service use artificial intelligence to help generate assessments, draft materials, score practice activities, and produce suggestions. Where AI is used:
- Outputs are provided as drafts and guidance and are intended to be reviewed by you and, where applicable, by a human adviser;
- We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without meaningful human involvement; and
- We take steps to protect the information you submit to AI features.
If you have questions about our use of AI or wish to request human review of any output, contact us using the details in section 17.
8International transfers
Some of our service providers may process your data outside the United Kingdom. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place — such as transfers to countries covered by UK adequacy regulations, or the use of the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — so that your data receives an equivalent level of protection. You can contact us for details of the safeguards that apply.
9How long we keep your information
We keep personal data only for as long as necessary for the purposes for which it was collected, including to provide the Service, comply with legal, accounting or reporting obligations, and resolve disputes. In particular:
- Account and case data is retained for the duration of your engagement and for a reasonable period afterwards.
- Identity / KYC data is retained only for as long as necessary for verification and legal-compliance purposes, then securely deleted or anonymised.
- Financial and transaction records are retained for the period required by tax and accounting law (generally at least six years).
- Marketing data is retained until you opt out or as otherwise required.
When personal data is no longer needed, we securely delete or anonymise it.
10How we protect your information
We use appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls and least-privilege permissions, secure file storage with time-limited access links, authentication safeguards, logging and monitoring, and staff and adviser confidentiality obligations. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) and, where required, you.
12Marketing communications
We will only send you marketing messages where you have consented or where we are otherwise permitted to do so. You can opt out at any time by using the unsubscribe link in our emails or by contacting us. Opting out of marketing will not stop service or transactional messages that are necessary to provide the Service.
13Your rights
Under the UK GDPR you have the following rights, which you can exercise free of charge (subject to certain conditions and exemptions):
- Access — to obtain a copy of the personal data we hold about you;
- Rectification — to have inaccurate or incomplete data corrected;
- Erasure — to ask us to delete your data (“right to be forgotten”) in certain circumstances;
- Restriction — to ask us to limit how we use your data;
- Portability — to receive certain data in a structured, commonly used, machine-readable format;
- Objection — to object to processing based on legitimate interests or to direct marketing; and
- Withdrawal of consent — where we rely on consent, to withdraw it at any time (without affecting prior processing).
To exercise any of these rights, contact us at hello@myendorsement.co.uk. We may need to verify your identity before responding, and we will respond within the timeframes required by law (usually one month).
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns first.
14Children
The Service is intended for use by individuals aged 18 or over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
15Third-party links
Our site and communications may contain links to third-party websites and services (for example, endorsing bodies or payment pages). We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy notices.
16Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where changes are significant, we will take reasonable steps to notify you. Your continued use of the Service after an update constitutes acceptance of the revised policy.
17Contact us
For any questions, requests or complaints about this policy or your personal data:
- Email: hello@myendorsement.co.uk