Privacy Notice

Embue is a subscription-based news and newsletter publication for the UK care and health sector, operated by **EMBUE Group Limited**, a company registered in England and Wales (company number **15274202**), registered office **20-22 Wenlock Road, London, N1 7GU**. We are the **data controller** for the personal data described here. The Information Commissioner's Office (ICO) is the UK supervisory authority for data protection. For any privacy matter, contact us at **privacy@networkembu.com**.

- **Account data** — your name, email address, a securely hashed password, your subscription tier and subscription expiry date. - **Subscription and payment data** — the plan you buy, transaction and order references, billing email, and receipts. Payments are processed by PayPal; we do **not** receive or store your full card or bank details. - **Newsletter and marketing data** — your email address, name, your sector or role, the newsletters you are subscribed to, your opt-in/consent records and timestamps, and engagement data such as whether an email was opened or a link clicked. - **Website and technical data** — IP address, browser and device information, and cookie data (see our Cookie Policy). - **Awards nomination data** — if you submit an awards nomination: the nominee's details, your name, email and (optionally) phone number, and your reason for nominating. - **Advertiser data** — if you book advertising with us: your business contact details, the organisation you represent, your advertising sector, the creative you supply, and order, invoice and payment references. - **Organisation / team account data** — if you manage or belong to a team subscription: the organisation name and verified email domain, the billing and invoice contacts, and which seats are assigned to which members. - **Contact data** — anything you send us through a contact form or by email.

| Purpose | Lawful basis | |---|---| | Creating and running your account; delivering the paid content you subscribe to | Performance of a contract | | Taking payment and issuing receipts | Performance of a contract; legal obligation (tax records) | | Sending your subscription digest (part of the paid product) | Performance of a contract | | Sending optional newsletters you choose to receive | Consent | | Sending marketing to prospective subscribers | Legitimate interests, relying on the PECR "soft opt-in" (and an opt-out basis for business contacts) | | Administering organisation / team subscriptions and seats | Performance of a contract | | Displaying advertising you book with us and reporting on its delivery | Performance of a contract | | Non-essential analytics and cookies | Consent | | Securing our service, preventing fraud and abuse, and improving our content | Legitimate interests | | Responding to your enquiries and nominations | Legitimate interests / consent | Where we rely on **consent**, you can withdraw it at any time without affecting prior processing.

We use email in three distinct ways, each on its own lawful basis under the Privacy and Electronic Communications Regulations (PECR) and UK GDPR: - **Your subscription digest — a service message.** The email digest is part of the paid product. When your subscription becomes active we enrol you and send it to you as a service communication relating to your subscription. You can stop receiving it at any time — opting out simply means you read on the website only — and every issue carries an easy one-click opt-out. - **Optional newsletters (for example, the Awards).** These are extra. We send them only if you **explicitly opt in**, and you can opt in or out at any time from your account. - **Marketing to prospective subscribers.** If you give us your email as a prospective customer (for example, signing up to a free newsletter while considering a subscription), we may send you marketing about our own similar products under the **"soft opt-in"** permitted by PECR, and — for business contacts — on an **opt-out** basis. Every such message carries a clear unsubscribe and we stop as soon as you opt out. Simply registering a website account does **not** sign you up to any marketing — we enrol you only as described above. All email is sent from our authenticated sending domain, `ukmail.networkembu.com`. We honour opt-outs promptly and keep a suppression list so we do not contact you again.

We use essential cookies to run the site and sign you in. With your consent, we use **Google Analytics (GA4)** to understand how the site is used; analytics load only after you consent, and you can withdraw consent at any time. Google acts as our analytics provider and may process this data outside the UK (see sections 6 and 7). Full detail is in our Cookie Policy.

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract: - **Amazon Web Services (AWS)** — hosting of our infrastructure and email delivery via Amazon SES, in the UK (London) region. - **PayPal** — payment processing. PayPal is provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) and may process payment data in the EU and internationally. - **Google (Google Analytics)** — website analytics, **only where you have consented**. Google may process this data outside the UK, including in the United States, under its data-processing terms with appropriate transfer safeguards (see section 7). - Our email list management runs on **self-hosted software on our own UK infrastructure**, not a third-party marketing platform. We may also disclose data where required by law or to protect our rights, users or service.

Your personal data is stored and processed in the **United Kingdom**, on AWS Europe (London) infrastructure (`eu-west-2`), and email is delivered through Amazon SES in the same UK region. Two limited exceptions involve processing outside the UK: (1) our payment provider, **PayPal**, processes payment data in the EU and may process it internationally; and (2) where you consent to analytics, **Google Analytics** may process data outside the UK, including in the United States. Both transfers are covered by the providers' data-processing terms, which incorporate the UK International Data Transfer Addendum / Standard Contractual Clauses. All other personal data remains in the UK. See our Data Residency & Governance statement for detail.

We keep personal data only as long as there is a lawful purpose for it (the UK GDPR "storage limitation" principle). We run a regular, automated review and close or anonymise accounts that no longer have a purpose. **We email you a notice before we close an account**, so you can keep it active if you wish. - **Active accounts** — for as long as your account is open and in use. - **Lapsed subscribers** — if you stop subscribing, we keep your account so you can return easily, then close or anonymise it after **24 months** without an active subscription. - **Registered but never subscribed** — if you register but do not subscribe and the account stays inactive, we close it after **12 months** of inactivity (and, if you have opted out of marketing, we stop marketing immediately and remove prospect data within **90 days**, keeping only a suppression entry). - **Advertiser accounts** — for the life of the advertising relationship; a dormant advertiser account with no live or recent placements is closed after **12 months** of inactivity. We never delete an account while it has active or recent advertising placements that we still need to honour or report on. - **Payment and financial records** — kept as required by UK tax and accounting law (generally six years), held separately from your account and retained even after the account is closed. - **Newsletter / suppression data** — once you unsubscribe we keep only the minimum needed on a suppression list so we do not contact you again. - **Nomination and contact data** — for as long as needed to handle the matter, then deleted or anonymised.

Under UK data-protection law you have the right to: access your data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and to withdraw consent. To exercise any of these, contact **privacy@networkembu.com**. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we'd ask you to contact us first so we can help.

We use encryption in transit (TLS), hashed passwords, access controls, and UK-region storage on infrastructure we control. We keep our systems patched and limit access to personal data to those who need it.

Embue is a professional B2B service and is not directed to children. We do not knowingly collect data from anyone under 18.

We may update this notice from time to time. The "last updated" date shows the current version; material changes will be communicated where appropriate.

Questions or requests: **privacy@networkembu.com**, or write to **EMBUE Group Limited**, **20-22 Wenlock Road, London, N1 7GU**.