Privacy policy

1. About this policy

Foundium is a technology platform operated by a private limited company registered in England and Wales (“Foundium”, “we”, “us” or “our”). Our registered company details are recorded on the public register at Companies House and appear on every invoice we issue.

This policy applies to personal data we process when you visit our websites, use our platform, applications and application programming interfaces, contact our support teams, attend our events, or otherwise interact with us (together, our “Services”). Where a Service has its own privacy notice, that notice supplements this policy.

For the processing described here, Foundium is the controller of your personal data, unless section 10 says otherwise. We are registered with the Information Commissioner’s Office (ICO) and have appointed a data protection officer, who can be contacted through the contact page.

This policy is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and the Data (Use and Access) Act 2025, as each is in force from time to time.

2. What personal data means at Foundium

Personal data is any information that identifies you, or that can reasonably be linked to you, directly or indirectly. It includes information such as your name and email address, and also information such as a device identifier, an IP address or a record of how you use our Services when it can be connected to you.

Data that has been de-identified, so that it can no longer reasonably be linked to you, is still handled with care. We hold it separately from identifying data, we do not attempt to re-identify it, and we require anyone we share it with to give the same commitment.

Data that has been fully anonymised, so that no individual can be identified by any means reasonably likely to be used, is not personal data. We may use it to understand how our Services are used and to produce aggregated statistics.

3. Your privacy rights

You have rights over your personal data under UK law, and we respect them whether you are a customer, a user or a visitor. You have the right to:

• access the personal data we hold about you and obtain a copy of it;
• rectify personal data that is inaccurate and complete data that is incomplete;
• erase personal data where there is no overriding reason for us to keep it;
• restrict our processing while its accuracy or lawfulness is being assessed;
• port data you have provided to us, in a structured, commonly used and machine-readable format, to yourself or to another provider;
• object to processing based on our legitimate interests, including profiling, and object at any time to direct marketing;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you, and to obtain human review of any such decision;
• withdraw consent at any time where we rely on it, without affecting processing carried out before you withdrew it;
• complain to us and to the ICO, as described in section 19.

How to exercise your rights

Many of these rights can be exercised directly in your account settings. You can also make a request at any time through the contact page. There is no charge.

To protect your data, we verify your identity before acting on a request, and the time for our response begins once we have done so. We respond within one month. Where a request is complex, or you have made several, we may extend that period by up to two further months, and we will tell you why within the first month.

We may decline a request where the law permits, for example where it would reveal personal data about another person, where it is manifestly unfounded or excessive, or where we must retain data to meet a legal obligation. If we do, we explain why and tell you how to complain.

4. Personal data we collect from you

We collect personal data when you create an account, use our Services, communicate with us or take part in our activities. What we collect depends on how you interact with us. We collect only what we need for the purposes set out in section 6.

You choose what content to provide. Where information is necessary to provide a Service or meet a legal obligation, we tell you when we ask for it. If you do not provide it, we may be unable to provide that Service.

5. Personal data we receive from other sources

We may receive personal data about you from the following sources, in each case in line with the law and any instructions you give:

• Organisations that give you access to our Services, such as an employer, investor or programme provider, which may provide your name, email address and role to set up your account.
• Other users who invite you, share content with you, or include your details in content they manage through our Services.
• Services you connect, such as a calendar, bank account or productivity tool, which share the data you authorise for as long as the connection remains active.
• Payment and financial service providers, which tell us the status of payments and the outcome of checks they are required to carry out.
• Verification, fraud prevention and sanctions screening services, used to protect our users and to meet our legal obligations.
• Public sources, such as Companies House and professional registers, used to verify information and keep it accurate.
• Event organisers and business partners, where you have asked them to share your details with us.

6. How we use personal data

We use personal data only where we have a lawful basis under Article 6 of the UK GDPR, and, for special category data, a condition under Article 9. The purposes and lawful bases are set out below.

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You can ask us for details of that assessment, and you can object at any time.

If we intend to use personal data for a new purpose that is not compatible with the purpose for which it was collected, we will tell you first and, where required, ask for your consent.

7. Special category data

Some Services may invite you to provide information about your health or wellbeing. That information, and anything derived from it, is special category data under the UK GDPR, and we give it additional protection.

• We process it only with your explicit consent, asked for separately from any other agreement, and never as a condition of using our Services.
• You can withdraw consent at any time in your settings. Processing stops immediately, and the data is deleted from our live systems within 30 days and from backups within a further 35 days.
• It is private to you by default. It is never shared with another user, an organisation that gives you access, or any third party unless you choose to share it.
• It is never used for marketing, advertising, pricing or eligibility decisions.

We have completed a data protection impact assessment for this processing and review it whenever the relevant Services change. Foundium is not a healthcare provider and does not monitor this information for emergencies. If you need urgent help, contact NHS 111, or call 999 in an emergency.

8. Automated processing and artificial intelligence

Our Services use automated processing, including machine learning and large language models, to analyse information, generate insights and make recommendations. This can involve profiling, meaning the automated evaluation of aspects of your circumstances in order to personalise what the Services show you.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Where an automated output could affect you in a significant way, a person reviews it, and you can ask for an explanation of how an output was produced, request human review, and correct the information it relied on.

Some models are operated by third-party providers acting as our processors. Our contracts prohibit them from using your personal data or content to train their own models and limit their retention to what is necessary to provide the Service and meet their security obligations.

We improve our own models using de-identified or aggregated data. We do not use your content, or special category data, to train models that serve other customers.

9. How we share personal data

We share personal data only as described below, and only to the extent necessary for the purpose concerned:

• Service providers who process personal data on our behalf, including providers of cloud hosting, data storage, communications, customer support, security, analytics and artificial intelligence services. They act only on our documented instructions, under contracts that meet Article 28 of the UK GDPR.
• Payment and financial service providers, which process payments and carry out the checks the law requires of them. Where they act under their own regulatory permissions, they are independent controllers and their own privacy notices apply.
• Organisations through which you use our Services, in line with the settings available to you and any agreement between that organisation and us.
• Other users, when you choose to share content or information with them through the Services.
• Professional advisers, such as lawyers, accountants, auditors and insurers, under duties of confidentiality.
• Public authorities, including law enforcement bodies, regulators, HM Revenue & Customs and courts, where we are legally required to disclose information, or where disclosure is necessary to protect the rights, property or safety of Foundium, our users or others.
• Successors and investors, in connection with a merger, acquisition, financing, reorganisation or sale of assets, under confidentiality. Personal data would remain subject to this policy or to a notice at least as protective.
• Anyone else, with your consent or at your direction.

A current list of our sub-processors is available on request through the contact page.

10. When we process data for our customers

Some organisations use our Services to process personal data about their own customers, employees or contacts. In those cases the organisation is the controller, and Foundium processes that data as its processor, only on its instructions and under a contract that meets Article 28 of the UK GDPR.

If your personal data has been provided to us by one of our customers, please refer to that organisation’s privacy notice and direct any requests to it. If you contact us, we will pass your request to the organisation concerned and help it respond.

11. International transfers

Our Services are hosted primarily in the United Kingdom. Some of our service providers operate in, or access data from, other countries.

We transfer personal data outside the UK only where the destination is covered by UK adequacy regulations, or where the transfer is protected by the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment and any supplementary measures it identifies. You can request a copy of the relevant safeguards.

12. How long we keep personal data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting and reporting requirements. When we determine a retention period, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, and the purposes for which we process it.

We may keep personal data for longer where it is necessary to establish, exercise or defend a legal claim, or where the law requires it.

13. How we protect personal data

Security is built into our Services from the start. We use administrative, technical and physical safeguards appropriate to the risk, including:

• encryption of personal data at rest using AES-256 and in transit using TLS 1.3;
• role-based access on the principle of least privilege, with multi-factor authentication and logging for all access to production systems;
• regular access reviews, continuous vulnerability management and annual penetration testing by independent specialists;
• secure development practices, including privacy and security review of new features;
• confidentiality obligations and regular training for everyone with access to personal data;
• due diligence on, and contractual controls over, every service provider;
• resilient infrastructure, tested backups and a documented incident response plan.

If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the ICO within 72 hours of becoming aware of it. If the risk is high, we also tell you without undue delay.

You can help protect your account by securing the email account linked to it, using multi-factor authentication where it is available, and telling us immediately if you suspect unauthorised access.

14. Children

Our Services are designed for adults and are not directed at anyone under 18. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we delete it. If you believe a child has provided us with personal data, please tell us through the contact page.

15. Cookies and similar technologies

We use cookies and similar technologies to operate and secure our Services, remember your preferences and, with your consent, understand how our Services are used. We ask for your consent before using any technology that is not strictly necessary. Our cookie policy explains each technology we use and how to control it.

16. Your marketing choices

We send marketing communications only where you have agreed to receive them, or where the law permits us to contact you as a business contact or an existing customer about similar services. You can unsubscribe at any time using the link in any marketing email or in your account settings.

Service communications, such as security notices, transaction confirmations and changes to our terms, are not marketing, and we send them regardless of your marketing preferences.

17. Third-party websites and services

Our Services may link to, or integrate with, websites and services operated by third parties. Their collection and use of personal data is governed by their own privacy notices, and we encourage you to read them. You can disconnect an integration at any time, and we stop collecting data from it immediately.

18. Our commitment to privacy

Privacy is a responsibility shared across Foundium, overseen by our data protection officer and supported by the following controls:

• data protection impact assessments before we introduce processing likely to result in a high risk;
• privacy by design and by default in the development of every Service;
• records of processing activities, maintained in line with Article 30 of the UK GDPR;
• regular data protection training for our people, and disciplinary consequences for breaches of our policies;
• regular review of this policy and of our practices.

19. Complaints

If you have a concern about how we handle personal data, please contact our data protection officer through the contact page. We acknowledge complaints within 30 days and respond in full without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113. We would appreciate the opportunity to address your concern first.

20. Changes to this policy

We review this policy regularly and update it when our Services or the law change. When we make a material change, we post the updated policy here and notify you by email or through the Services at least 30 days before it takes effect. The version number and effective date at the top of this page show when it was last updated.

21. Privacy questions

If you have questions about this policy or our privacy practices, or wish to exercise your rights, contact our data protection officer through the contact page or from your account settings. Formal written correspondence may be sent to our registered office, as recorded at Companies House.