Legal
Privacy policy
What we collect, why we collect it, how long we keep it and what you can ask us to do with it.
Last updated: 25 October 2026
1. Who we are
This website is run by FFounders Group Limited, trading as Future Founders, a company registered in England and Wales (company number 17427573). Our registered office is 15 Tallents Crescent, Harpenden, Hertfordshire AL5 5BP.
We are the controller of the personal data described in this policy. That means we decide why and how it is used, and we are responsible for looking after it.
For anything about your data, email privacy@futurefounders.uk or write to us at the address above.
2. The law we follow
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR). Where we handle data about people in the European Union or European Economic Area, we also follow the EU General Data Protection Regulation (EU GDPR).
3. What we collect and why
Most of what we hold, you give us: through the forms on this site, on a course, or when you talk to us. Sometimes it comes from your employer, from someone who introduced us, or from public sources such as LinkedIn and business directories. We also receive the basic technical data any website receives.
| When | What we collect | What we use it for | Lawful basis |
|---|---|---|---|
| You fill in Start here | Name, email, organisation (optional), the route and options you choose, and anything you write in the message box | To reply to you and suggest the right next step | Steps you have asked us to take before a possible contract (Article 6(1)(b)), and our legitimate interest in answering enquiries (Article 6(1)(f)) |
| You tick the box for occasional emails | Name, email, the date and the exact wording you agreed to | To send occasional emails about courses and practical guides | Your consent (Article 6(1)(a) and PECR regulation 22). You can withdraw it at any time |
| You join the Future Academy waitlist | First name and email | To tell you about courses when they open. Nothing else | Your consent (Article 6(1)(a)) |
| You ask for the automation guide | First name and email | To send you the guide in one email | Providing what you asked for (Article 6(1)(b)) |
| You book a course or become a client | Contact details, what we agreed, invoices and payment records | To deliver the course or work and meet tax and accounting duties | Contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) |
| Your employer books you onto a course | Your name, work email, job title and the course booked, given to us by your employer | To arrange and deliver the course, and confirm attendance to your employer | Our legitimate interest in delivering training your employer has arranged (Article 6(1)(f)) |
| You take part in a course or project | Attendance, progress, the work you share in sessions, and your feedback | To run the course or project, support you and improve how we teach | Contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) |
| We meet you at an event or are introduced to you | Name, job title, organisation and work contact details, from you, the event, the person who introduced us, or public sources such as LinkedIn and business directories | To contact you about our services and keep in touch about possible work together | Legitimate interests (Article 6(1)(f)) |
| You work with us as a tutor or partner | Name, contact and business details, contract, invoices and payment records | To manage our working relationship and meet tax duties | Contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) |
| Any visit to the site | IP address, browser type, pages requested and the time, held in server logs by our hosting provider | To keep the site running, secure and free of abuse | Legitimate interests (Article 6(1)(f)) |
Please do not include special category data (such as health, religion or ethnicity) in the message box. We do not need it, and if it arrives we will delete it.
On courses and projects, please share only what the exercise needs. Do not upload other people's personal data, or your employer's or clients' confidential information, unless you have the right to.
If we get your details from somewhere other than you, we will tell you where they came from in our first message, within one month. Every message lets you opt out, and we will stop straight away if you ask.
Where we rely on legitimate interests, we have checked that our interest is not outweighed by yours. You can ask us for the details of that check.
4. What we do not do
- We do not sell your data or pass it on for anyone else's marketing.
- Our tutors and partners may not use your data for their own purposes, or contact you to sell their own services.
- We do not record course sessions.
- We do not use your data for a new purpose that does not fit why we collected it without telling you first, and asking for your consent where the law requires it.
- We do not use analytics, advertising or tracking cookies on this site. See our cookie policy.
- We do not make decisions about you by automated means alone, including profiling, that have legal or similarly significant effects.
- When we share results about our courses or projects, we use anonymised, combined figures that do not identify you.
- This site is not aimed at children. We do not knowingly collect data from anyone under 18.
5. Who we share it with
We share your data only where we need to, and only what is needed.
Our delivery team. Our courses and projects are delivered by tutors and specialist partners we choose, some of them based outside the UK. Each works under a written contract with Future Founders, on our instructions and to our standards. They see only what they need to deliver your course or project, such as your name, email and the work you share. They may not use it for their own purposes, keep it after the work ends, or contact you to sell their own services. We stay responsible to you for how your data is handled, and you deal with us throughout.
If a partner ever needs to work with you directly under their own terms, we will tell you first, and they will give you their own privacy notice.
Service providers. These handle data on our behalf under a written contract, and are not allowed to use it for their own purposes:
- Website hosting provider: stores the site and its server logs.
- Customer relationship management and email platform: stores enquiries and sends the emails you have agreed to.
- Booking and calendar tool: lets you book calls, courses and individual course sessions.
- Online meeting and learning tools: run live sessions and share course materials.
- Payment provider: takes payment when you book. We do not see or store your full card details.
Others, only where needed:
- Your employer, if they booked your place: we confirm attendance and completion. We do not share the work you do in sessions without your agreement.
- Professional advisers, such as our accountants, lawyers, bankers and insurers.
- HMRC, regulators, courts or the police, where the law requires it or to protect our legal rights.
- A buyer or new owner, if all or part of our business is sold or restructured. They may use your data only as this policy describes.
You can ask us for the names of our providers and partners at any time.
When we work for a client. When a business hires us to improve how it works, we may handle personal data that belongs to that business, such as details of its customers or staff. That business is the controller of that data. We act on its written instructions under our contract with it, and its own privacy notice applies.
6. Transfers outside the UK and EEA
Some of our providers, tutors and partners are based in, or access data from, countries outside the UK and EEA, including India and Singapore. We can give you a current list of these countries on request.
Before any of them can access your data, we make sure it stays protected in one of these ways:
- the UK government has recognised the country as providing adequate protection (UK adequacy regulations), or
- we have signed the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses (and, for data about people in the EU or EEA, the EU Standard Contractual Clauses), and checked that your data will still be properly protected there.
Only in rare cases do we rely on an exception the law allows, for example where a transfer is necessary to deliver a contract you have with us. You can ask us for a copy of the safeguards in place.
7. How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not lead to work | 24 months from our last contact, then deleted |
| Marketing email list | Until you unsubscribe. We then keep only your email on a suppression list so we never email you again |
| Waitlist | Until the course opens and we have told you, or 12 months, whichever comes first, unless you join the email list |
| Automation guide requests | 12 months, then deleted |
| Client and financial records | 6 years after the end of the financial year they relate to, as UK tax law requires |
| Server logs | No more than 30 days, then deleted by our hosting provider |
| Business contacts we have not worked with | 24 months from our last contact, then deleted |
8. How we keep it safe
The site is served over an encrypted connection (HTTPS). Access to personal data is limited to the people who need it, protected by strong passwords and two-factor authentication. If a breach is likely to put your rights at risk, we will report it to the Information Commissioner's Office within 72 hours and, where the risk is high, tell you directly.
9. Your rights
Under UK and EU GDPR you have the right to:
- Access a copy of the data we hold about you
- Correct anything that is wrong or incomplete
- Erase your data where we have no good reason to keep it
- Restrict how we use it while a concern is looked into
- Object to us using it on the basis of legitimate interests, and to direct marketing at any time
- Portability: receive data you gave us in a common, machine-readable format
- Withdraw consent at any time, without affecting anything we did before you withdrew it
To use any of these, email privacy@futurefounders.uk. It is free. We will reply within one month, and may ask you to confirm your identity first. Every marketing email also has an unsubscribe link.
If a request is complex, or you send several, we may take up to two further months; we will tell you within the first month if so. If we need more information to find what you have asked for, the time limit pauses until you reply. We search for your data reasonably and proportionately, including with our tutors and partners.
Some rights have limits. For example, we cannot delete records the law says we must keep, or share data that would reveal someone else's personal information. If we cannot do what you ask, we will explain why and tell you how to complain. We may charge a reasonable fee, or refuse, only if a request is clearly unfounded or excessive.
Please tell us if your details change, so that what we hold stays accurate.
10. Complaints
If you are unhappy with how we have handled your data, you have the right to complain to us directly. Email privacy@futurefounders.uk or write to the address in section 1. You do not need to use any special wording. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at any time: ico.org.uk, helpline 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you live in the EU or EEA, you can complain to the data protection authority in your country.
11. Changes to this policy
We will update this page when what we do changes, and change the date at the top. If the change is significant and we have your email, we will tell you.
12. Links to other websites
This site may link to other websites, such as booking, learning or payment pages run by our providers. Those sites have their own privacy policies, and we are not responsible for how they handle your data. Please read their policies when you visit them.