The short version
- Your membership data is held in the United Kingdom.
- Providers never get Practitioner contact details or the member list. Not for any price.
- We do not sell member data, and we do not provide it as a lead source.
- Accessibility and dietary needs you tell us for an event are held in our own UK systems and never on the community platform.
- Employer Branding News is a separate company with its own privacy notice. Section 2 explains what passes between us.
- Questions, rights requests and complaints go to dpo@ebclub.app. We acknowledge within 30 days.
1Who this notice is from
EBClub is operated by Beyond Cloudnine Limited, a company registered in England and Wales under company number 16761069, registered office 33 Chapman Way, Haywards Heath, West Sussex, England, RH16 4UL. For the personal data described in this notice, we are the data controller.
This notice covers the EBClub community platform at ebclub.employerbranding.news, the EBClub pages on Employer Branding News, EBClub membership applications and accounts, EBClub events, the EBClub learning library and the EBClub provider directory.
| Role | Who | Contact |
|---|---|---|
| Data Protection Lead | Steve Ward | dpo@ebclub.app |
| General membership contact | The EBClub team | community@ebclub.app |
| EU representative (Article 27 GDPR) | Appointment in progress. This notice will be updated when appointed | |
| UK representative | Not applicable. We are established in the United Kingdom |
We are not required to appoint a Data Protection Officer under Article 37 of the UK GDPR. Steve Ward is our Data Protection Lead and is the person to contact about anything in this notice.
2How EBClub and Employer Branding News relate to each other
Employer Branding News is a separate publication operated by Fathom Data Labs Pte Ltd, a company registered in Singapore under company number 202410787C at 160 Robinson Road, #14-04, Singapore 068914. EBClub and Employer Branding News are operated by different companies, and each is a controller of the personal data it holds.
Fathom Data Labs Pte Ltd also builds and runs the membership operations system that we use to process applications and manage memberships. When it does that, it acts on our instructions as our processor under a written agreement, and it is not permitted to use your membership data for its own purposes.
If you subscribe to the Employer Branding News newsletter, Fathom Data Labs Pte Ltd is the controller of that subscription and its own privacy notice applies.
If you then apply to join EBClub, Beyond Cloudnine Limited becomes the controller of your membership. Information you gave when applying passes from the Employer Branding News sign-up page to EBClub so that we can process your application.
The two companies share limited personal data with each other under a written data sharing agreement: your identity and contact details, your membership status, and, where you are a Provider, your directory listing. We do this so that a single sign-up works, so that your directory listing can appear on both properties, and so that we can tell whether you should be receiving member communications.
Our legal basis for that sharing is our legitimate interest in operating a joined-up membership and publication, and, for the newsletter, your consent. You can object to it at any time using the contact details in Section 18.
3Personal data we collect
| Category | What it includes |
|---|---|
| Identity and contact | Name, email address, phone number where you give it, country or region, profile photo. |
| Professional | Employer or business name, job title, professional profile links such as LinkedIn, industry, specialisms, seniority. |
| Eligibility and vetting | Your answers to application questions, evidence you provide about your role or business, and the notes and decisions we record when reviewing your application. |
| Membership and billing | Membership type, status, start and renewal dates, Stripe customer and subscription identifiers, invoices, receipts and transaction records. We do not hold your full card number. |
| Community activity | Your profile, posts, comments, reactions, direct messages, spaces you belong to, and moderation records including reports made by or about you. |
| Events | Registrations, attendance, dietary or accessibility requirements you tell us about, questions you ask, and photographs and recordings where an event is captured. |
| Learning | Course enrolments, progress, submissions and feedback. |
| Directory | Your Provider listing, including organisation details, services, regions covered, links and logo. |
| Newsletters and marketing | Subscription preferences, and whether you opened or clicked an email. |
| Technical | IP address, device and browser information, log data, cookie and analytics identifiers, and security records. |
| Support | Your messages to us, complaints, and the history of your account. |
We do not deliberately collect special category data. Accessibility or dietary information you give us for an event may reveal health or belief information. We hold it only in our own operations system in the United Kingdom, never on the community platform, use it only to make the arrangements for that event, and delete it afterwards.
4Why we use it, and our legal basis
Where the UK GDPR or EU GDPR applies, we must have a legal basis for each purpose. This table sets them out.
| What we do | Why | Legal basis |
|---|---|---|
| Review your application and decide whether to approve it | To check you are eligible and to protect the community | Steps at your request before a contract; and our legitimate interest in protecting the integrity of a vetted community |
| Create and run your account | To give you what you signed up for | Performance of our contract with you |
| Take payment and manage renewals for Provider membership | To charge the fee you agreed | Performance of our contract with you |
| Send service messages about your account, renewal, billing or the Terms | So you are not surprised by a charge or a change | Performance of our contract, and legal obligation |
| Run the community, spaces, direct messages and moderation | To operate the service | Performance of our contract; and our legitimate interest in keeping the community safe |
| Enforce the Community Guidelines, investigate reports and prevent misuse | To protect Practitioners from unsolicited selling, scraping and misrepresentation | Our legitimate interest in protecting members and the community |
| Publish your Provider directory listing on EBClub and Employer Branding News | It is a benefit you paid for | Performance of our contract with you |
| Run events, including registration, attendance and recording | To deliver the event | Performance of our contract; consent for photography and recording where required |
| Run the learning library | To deliver courses | Performance of our contract |
| Send the newsletter and marketing | To keep you informed about EBClub | Your consent, which you can withdraw at any time |
| Analytics and measuring how the site and community are used | To improve the service | Consent where required by cookie law; otherwise our legitimate interest in understanding usage |
| Advertising and remarketing | To reach relevant audiences | Your consent |
| Security, fraud prevention and protecting our systems | To keep the service safe | Our legitimate interest in security; legal obligation |
| Keeping records of accounts, payments and tax | Because we must | Legal obligation |
| Establishing, exercising or defending legal claims | To protect our position | Our legitimate interest in defending our rights |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can ask us for that assessment, and you can object at any time under Section 9.
5Where your data comes from
- From you, when you apply, create a profile, pay, post, register for an event, take a course or contact us.
- From your employer or organisation, if they arrange or pay for your membership.
- From Employer Branding News, where you signed up there first, as described in Section 2.
- From publicly available professional sources, where we check the information you gave us on your application against what your employer or professional profile says. We use this only to confirm eligibility.
- From our platforms and providers, automatically, such as log data, cookie identifiers and payment confirmations.
6Who we share it with
We do not sell your personal data. We share it with the following categories of recipient.
6.1 Service providers acting on our instructions
| Provider | What they do | Where |
|---|---|---|
| Heartbeat Chat, Inc. | Hosts the community platform, discussions, direct messages, events and courses | United States |
| Stripe | Processes payments, subscriptions, invoices and refunds | United States and Ireland |
| Ghost Pro | Hosts the public and member pages and sends newsletters | Amsterdam, Netherlands |
| Supabase | Hosts our membership operations database and application | United Kingdom (London) |
| Cloudflare | Provides network, security and delivery for our applications | Global edge network |
| Resend | Sends transactional and membership email | Ireland |
| Directify, through Employer Branding News | Hosts the public provider directory, which is operated by Fathom Data Labs Pte Ltd | Germany, with EU storage |
| Analytics and, where you consent, advertising measurement | United States and EU | |
| CookieYes | Records and manages your cookie preferences | United Kingdom |
| Fathom Data Labs Pte Ltd | Builds and operates our membership operations system on our instructions | Singapore, with hosting as above |
Each of these is bound by a written contract requiring them to process personal data only on our instructions and to keep it secure. Heartbeat processes community data as our processor under its Data Processing Addendum, and engages its own subprocessors, which it lists publicly and notifies us of in advance.
Heartbeat also operates its own Content Policy, which applies to everyone using its platform alongside our Community Guidelines. It does not actively monitor community content and acts on reports, so day-to-day moderation is ours. It can act on its own account where its policy is breached.
6.2 Other members
Your profile, posts, comments and directory listing are visible to other members according to the space they are in and your membership type. Practitioner Spaces are not visible to Providers or Partners. Your direct messages are visible to the people in them. Our moderators can see reported content.
6.3 Fathom Data Labs Pte Ltd
As described in Section 2, we share limited data with Fathom Data Labs Pte Ltd as a separate controller for Employer Branding News, under a written data sharing agreement. Separately, Fathom acts as our processor for the membership operations system, under a written processing agreement.
6.4 Others
- Event venues, hosts and production partners, where you attend an event, limited to what they need.
- Sponsors, only where you have separately opted in to your details being shared with a named sponsor. We do not pass your details to a sponsor because you attended an event.
- Professional advisers, auditors and insurers, where necessary.
- Authorities, regulators or law enforcement, where we are legally required to.
- A buyer, if we sell or reorganise the business, subject to the same protections.
We do not give Providers or Partners access to Practitioner contact details, member lists or Practitioner-only discussions. We do not sell member data. We do not provide member lists as a lead source, whatever anyone pays.
7International transfers
EBClub members are worldwide. Most of the systems we use are in the United Kingdom or the European Economic Area: our membership database is in London, our website and newsletter platform is in Amsterdam, our transactional email provider is in Ireland, and the provider directory is in Germany. Transfers between these are covered by adequacy and need no additional safeguard.
Two providers are in the United States. Heartbeat hosts the community platform, and Stripe processes payments. Our operations system is built and run for us from Singapore. Personal data is therefore transferred outside the United Kingdom and the European Economic Area for those services.
Where we transfer personal data out of the UK or the EEA to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies. We rely on the Standard Contractual Clauses as our primary safeguard rather than on any certification scheme, so that your protection does not depend on the continued validity of a single adequacy decision.
We also carry out transfer risk assessments and apply additional measures, including encryption in transit and at rest, where appropriate.
You can ask us for a copy of the safeguards we rely on by contacting us at dpo@ebclub.app.
8How long we keep it
| Data | Retention |
|---|---|
| Declined applications | 12 months from the decision, then deleted, so that we can handle an appeal or a repeat application |
| Active membership records | For as long as you are a member |
| Membership records after you leave | 24 months, then deleted or anonymised |
| Payment, invoice and tax records | 6 years from the end of the relevant financial year, as required by tax law, extended to 7 years as a matter of policy |
| Community posts and comments | Kept while the community operates, unless you ask us to remove specific content |
| Direct messages | 24 months after your membership ends, then deleted |
| Moderation records and reports | 3 years from the decision, so we can act consistently on repeat behaviour |
| Event registrations and attendance | 24 months |
| Event recordings and photographs | 3 years, or until you withdraw consent where consent applies |
| Accessibility and dietary requirements | Deleted after the event |
| Course enrolments and progress | 24 months after your membership ends |
| Newsletter subscription and preferences | Until you unsubscribe, then a suppression record indefinitely so we do not email you again |
| Cookie consent records | 12 months where you accepted, then we ask you again. 6 months where you declined |
| Analytics data | 14 months |
| Support correspondence | 24 months from the last contact |
| Records needed for a legal claim | Until the claim and any appeal period ends |
9Your rights
Depending on where you live, you have some or all of the following rights. We will not charge you or treat you differently for using them.
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you |
| Correction | Ask us to correct anything inaccurate or incomplete |
| Deletion | Ask us to delete your data, where there is no good reason for us to keep it |
| Restriction | Ask us to pause using your data while a question about it is resolved |
| Objection | Object to processing based on our legitimate interests, and to direct marketing at any time |
| Portability | Ask for a copy of the data you gave us, in a machine-readable format |
| Withdraw consent | Withdraw consent at any time, where we rely on it. This does not affect what we did before |
| Opt out of sale or sharing | Where you are in a US state that provides it, opt out of any sale or sharing for cross-context behavioural advertising |
| Non-discrimination | Not be treated worse for exercising your rights |
| Human review | Ask a person to look again at a decision made about your application |
To exercise any right, contact dpo@ebclub.app. We will respond within one month. If your request is complex we may take up to two further months and will tell you why. We may need to verify your identity first.
You can also manage a lot of this yourself: edit your profile and directory listing in your account, delete your own posts, change your newsletter preferences from any email we send, and change your cookie choices at any time from the cookie link on our site.
If your request concerns Employer Branding News rather than your EBClub membership, contact dpo@employerbranding.news. If you are not sure which, write to either and we will pass it on.
10How to complain
If you are unhappy with how we have handled your personal data, tell us at dpo@ebclub.app. We will acknowledge your complaint within 30 days and handle it through our documented complaints process.
In the United Kingdom, from 19 June 2026 you are required to raise a data protection complaint with the organisation before escalating it to the Information Commissioner's Office. Coming to us first is not a barrier; it is the route.
If you are not satisfied with our response, you can complain to a supervisory authority:
- United Kingdom: the Information Commissioner's Office, ico.org.uk.
- European Union or EEA: the data protection authority in the country where you live, work, or where you think the issue happened.
- Singapore: the Personal Data Protection Commission, pdpc.gov.sg.
- Elsewhere: your local privacy or data protection regulator.
11Marketing and your choices
- We send service messages about your account, your renewal, billing and changes to our terms. These are part of the service and you cannot opt out of them while you are a member.
- We send the newsletter and marketing only where you have agreed. You can unsubscribe from any email, or from your account, at any time.
- We do not share your details with third parties for their own marketing.
- We do not pass your details to an event sponsor unless you have separately chosen to share them with that named sponsor.
12Cookies and tracking
Our Cookie Notice explains the cookies and similar technologies we use, what each one does, how long it lasts and how to change your choices. You can change your preferences at any time from the cookie link on our site.
The community platform at ebclub.employerbranding.news is provided by Heartbeat and sets its own cookies, which are necessary for you to stay signed in and for the platform to work. Our Cookie Notice describes them.
The EBClub pages on Employer Branding News are covered by the EBN Cookie Notice, because that site is operated by Fathom.
13Automated decisions and vetting
When you apply, we check your answers against our eligibility criteria. Some clear-cut applications are approved automatically. Anything that is not clear-cut is reviewed by a person.
We do not make decisions that produce legal effects for you, or similarly significantly affect you, based solely on automated processing. If your application is declined you will be told, and you can ask a person to review the decision by contacting dpo@ebclub.app.
We do not use your community activity to build advertising profiles about you.
14Security
- Data is encrypted in transit and at rest across our systems and our providers'.
- Access to member data inside our team is limited to people who need it for their role.
- We keep audit records of administrative actions taken on member accounts.
- We assess our providers' security before we use them and review it periodically.
- We have a process for identifying and responding to personal data breaches, and will notify you and the relevant regulator where the law requires it.
No system is completely secure. Please use a strong, unique password, keep your login details to yourself, and tell us immediately at dpo@ebclub.app if you think your account has been accessed by someone else.
15Children
EBClub is for working professionals. It is not intended for anyone under 18 and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact dpo@ebclub.app and we will delete it.
16Country-specific information
16.1 United Kingdom and European Economic Area
We process personal data in accordance with the UK GDPR and the EU GDPR. Sections 4, 7, 9 and 10 set out our legal bases, transfer safeguards, your rights and how to complain. Our EU representative under Article 27 is named in Section 1.
16.2 United States
Depending on your state, you may have rights to know, access, correct, delete and obtain a portable copy of your personal information, to opt out of any sale or sharing for cross-context behavioural advertising and of targeted advertising, and not to be discriminated against for exercising them. You may be able to appoint an authorised agent to act for you.
We do not sell personal information for money. Where you consent to advertising cookies, some tracking may constitute sharing for cross-context behavioural advertising under state law. You can withdraw that consent at any time from the cookie link on our site, which operates as your opt-out. We honour Global Privacy Control signals where we receive them.
We do not knowingly sell or share the personal information of anyone under 16.
16.3 Singapore
Employer Branding News is operated by Fathom Data Labs Pte Ltd and its own privacy notice explains how it handles personal data under the Personal Data Protection Act, including its Data Protection Officer, consent, withdrawal, access and correction.
16.4 Australia and other APAC markets
Where the Australian Privacy Principles or another local privacy law applies to you, we will handle your personal data in accordance with it, and you keep any rights that law gives you.
17Changes to this notice
We will update this notice when what we do changes. If a change is significant we will tell you by email and by notice in the community before it takes effect. The version number and effective date are at the top of this document, and we keep previous versions.
18How to contact us
| Purpose | Contact |
|---|---|
| Privacy questions and data rights requests | dpo@ebclub.app (Steve Ward, Data Protection Lead) |
| Data protection complaints | dpo@ebclub.app, marked 'Data protection complaint' |
| General membership questions | community@ebclub.app |
| Post | Beyond Cloudnine Limited, 33 Chapman Way, Haywards Heath, West Sussex, England, RH16 4UL |
| Employer Branding News privacy | Fathom Data Labs Pte Ltd, dpo@employerbranding.news (Mike Parsons, Data Protection Officer) |
EBClub Privacy Notice, version 1.3, effective 18 August 2026.
EBClub is operated by Beyond Cloudnine Limited, registered in England and Wales, company number 16761069, 33 Chapman Way, Haywards Heath, West Sussex, England, RH16 4UL. Employer Branding News is published by Fathom Data Labs Pte Ltd, registered in Singapore, company number 202410787C, 160 Robinson Road, #14-04, Singapore 068914.