Who we are

At Sircle (“we”, “us”, or “our”), we are committed to protecting your privacy and ensuring you understand how we use and safeguard your personal data.

Our use of your personal information is governed by this Privacy Notice and relates to the following businesses and trading names:

Topscan (UK) Limited registered in England (04513312) and trading as “Sircle”

This notice explains what information we collect, how we use it, your rights, and how we protect your data in compliance with the UK Data Protection Act 2018 and the UK GDPR.

We also comply with the Data (Use and Access) Act 2025 (DUAA), which updates UK GDPR, DPA 2018 and PECR (Privacy and Electronic Communication Regulations). This Notice reflects these updates including legitimate interests, automated decision-making safeguards and cookie rules.

Who does this Privacy Notice relate to?

This Privacy Notice relates to all Sircle clients and potential clients, who are a businesses (and individuals associated with them) or individuals, all 3rd party businesses and individuals who work with Sircle to provide a service or whom may be a supplier, contractor, sub-contractor or referrer of business as well as any visitors to Sircle’s offices or other sites.

The notice applies to all products and services offered and provided by Sircle. A table setting out the information collected and processed by Sircle and the basis under which we do so is included at the end of this notice.

Where individuals apply for roles with Sircle, additional information about how we collect and use personal data during recruitment is set out in our Recruitment Privacy Notice. That notice should be read alongside this Privacy Notice and applies specifically to job applicants and candidates.

How this Privacy Notice applies

We’ve published this Privacy Notice to make it easier for you to find out how we collect, store, use and protect your personal information and information about individuals who may be connected to your business. You should read this notice, so you know what personal data we collect about you, what we do with it and how you can exercise your rights in connection with it.

This includes what you tell us about yourself, what we learn by having you as a client or working with you as a service provider, your interactions with us on social media, and the preferences you make about what type of marketing you want us to send you.

This Notice will provide you with information such as:

• The types of information Sircle collects about you and individuals connected to your business, and how we use it.
• The legal grounds for how we use personal information.
• The rights which individuals have in relation to the information we hold about them.
• How we keep information secure.

When providing you with our services we will collect information on individuals connected to your business. This information may be collected from you or other independent sources. All relevant individuals will have access to this Privacy Notice and if you, or anyone else on your behalf, has provided or provides personal information to us about an individual connected to your business, you or they must first ensure that you or they have the authority to do so, and that you have provided access to this Privacy Notice to ensure that they are informed.

This Privacy Notice explains how we collect, use and protect personal data. It is provided for information purposes and does not form part of any contract unless expressly stated otherwise.

What type of personal information does the Privacy Notice relate to?

Personal data: this is any information that tells us something about you as a natural person. This could include information such as name, contact details, date of birth, bank account details or any information about your needs or circumstances which would allow us to identify you.

Special Categories of personal data: We typically do not collect special categories of personal data about individuals other than our own employees. This is classified as “sensitive” under data protection legislation and examples include health data, religion or sexual orientation.

However, we may need to process limited special category data in specific situations (for example dietary/accessibility requirements for events or information relating to accidents/emergencies). There are also restrictions when we can collect and use criminal conviction data which will be set out to you should this be requested. Where we do so, we apply an additional condition under the Data Protection Act 2018 alongside an appropriate lawful basis under UK GDPR, and we limit access and retention.

Children’s data: Our services are not directed to children. Enhanced protections apply if children access services, consistent with DUAA and UK GDPR.

We will process all personal data in accordance with the following principles:

1. all personal data will be processed lawfully, fairly and in a transparent manner

2. all personal data will be collected for one or more specified, explicit and legitimate purposes and not processed in a manner incompatible with those purposes,

3. all personal data collected will be restricted to what is adequate, relevant and limited for those purposes,

4. all personal data will be kept accurate and up to date (and reasonable steps will be taken to erase or rectify inaccurate personal data),

5. all personal data will not be kept for longer than is necessary for those purposes,

6. all personal data will be protected by appropriate technical and organisational security measures to prevent unauthorised or unlawful processing and accidental loss, destruction or damage.

Unless otherwise agreed in writing, we act as the ‘controller’ (as such term is construed from the UK’s Data Protection Act (2018), the General Data Protection Regulation (GDPR) or the applicable local law) for the purposes described in this Privacy Notice. Sircle as the data controller will be responsible for compliance with these principles at all times.

In some engagements, we may process personal data on a client’s documented instructions (for example, where we input or manage data within a client’s system). In those cases, the client is the ‘controller’ and their privacy notice will apply. Where we act as a processor, we will only process personal data in accordance with the client’s instructions, our contract and applicable data protection law, and we will put in place appropriate processor terms in line with UK GDPR Article 28.

Lawful processing basis

Under the GDPR, we must justify a lawful basis for processing your personal data. There are six lawful bases for processing data as summarised below:

• Performance of a contract – this is where the collection and processing of your personal information is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract (e.g. provide a quote).
• Legal obligation – this is where the collection and processing of your personal information is necessary for compliance with a legal or statutory obligation, for example verification of identity and fraud prevention, or retaining invoices based on tax legislation.
• Consent – where we process personal information under consent, we will seek your clear and unambiguous consent before processing your data for example to send and/or receive marketing information from Sircle. You can withdraw your consent at any time If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know.
• Legitimate interest – some personal information is processed by Sircle as part of its legitimate interests which using people’s data in ways they would reasonably expect in the context of our business, and which have a minimal privacy impact, or where there is a compelling justification for the processing which outweighs the potential privacy interests of the data subject. Examples include network and information security, web analytics, updating customer details. In addition, the DUAA introduces certain recognised legitimate interests for defined processing activities. Where applicable, we will still ensure processing is necessary and that appropriate safeguards are in place.
• Vital interests – the processing is necessary to protect someone’s life
• Public task – the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.

Where we may process special categories of personal information and criminal conviction information, we do so under additional lawful bases of the Data Protection Act. These may include, but are not limited to:

• Where you have provided explicit consent
• Where processing is necessary for the establishment, exercise, or defence of legal claims.

What types of personal data do we collect and where do we get it from?

We will only collect and process data when this is permissible in line with applicable law and depending on the purpose the data is being used for, the type and sensitivity of the data that is being collected. It isn’t possible to list all circumstances and exceptions applicable to the collection of personal data. Personal data we collect process and retain may include:

• Name and contact details including mobile/landline numbers, email address and business address,
• Role title, position and responsibility details, and additional information around the nature of your role, this may include qualifications and experience that you wish to tell us about,
• Sex / gender
• Photographs taken at events, or site visits to conduct surveys
• CCTV footage if you attend our premises, which is maintained for security purposes. 
• Hobbies and interests where relevant for marketing purposes,
• Personal preferences including dietary requirements, personal details linked to an event (e.g. shoe size for a bowling evening), details around physical ability (e.g. ability to swim for a sailing event), or travel preferences,
• Open data / public records which includes data that you have made freely available in a public domain such as via social media or publications and news articles,
• Permissions – so we can record how you would like to receive information from us, or if you would prefer not to,
• Technical data such as your IP address, browser type, operating system, time zone, log-in information, clickstream data (pages you visited, time spent, links clicked), phone numbers used to contact us, and error messages via cookies and similar technologies.
• Extra information that you choose to tell us.

We collect and process personal data about you in the following ways:

Directly:

• We obtain personal data directly from individuals in a variety of ways, including obtaining personal data from individuals who provide us with their business card(s), complete our online forms, subscribe to our newsletters, register for webinars, attend meetings or events we host or visit our offices. We may also obtain personal data directly when, for example, we are establishing a business relationship, performing professional services through a contract, or through our hosted software applications.

Indirectly:

• To the extent permitted by applicable law, we may collect and process personal data indirectly about individuals and our clients from a variety of sources.  We may receive information about you from our business partners, suppliers, advertising networks, data subscription or analytics providers, and credit reference agencies to enhance our services, comply with legal obligations, or detect fraud. We may also obtain information from public registers (such as companies house, news articles, social media and professional networking sites and web searches.

Consequences of not providing us with certain data

Providing Sircle with certain levels of personal data is the choice of the individual of which that data belongs. You may choose not to give us certain information we ask for, or ask us to delete or stop using information that we already hold on you, and this is your right to do so. 

However, we may have overriding interests or obligations concerning certain data and we must also highlight some possible consequences of us not be able to process certain data belonging to you.

• We may not be able to keep you informed about our new products and services or any relevant changes.
• We may not be able to keep you up to date with industry or regulatory changes, news and market reports.
• We may not be able to keep you informed around any upcoming events or invite you to our events, or as a guest to accompany us to 3rd party events.
• We may not be able to fulfil our contractual obligations to you in order to provide our service.
• We may not be able to continue using your products or services.
• We may not be able to consider new business with you or arrange networking opportunities to benefit both you and us.q1

Purposes for processing your personal data

We use your personal data for a number of different purposes. We must always have a “lawful basis” (i.e. a reason, prescribed by law) for processing your personal data. The Personal data purposes table below sets out the purposes for which we process the different categories of your personal data and the corresponding lawful basis for that processing. For some processing activities, we consider that more than one legal basis may be relevant – depending on the circumstances.

Processing Activity	Justification for Processing	Primary Lawful Processing Basis
Collecting personal data for new clients/3rd parties e.g. receiving a business card, exchanging details at events	We conclude that data has been given to Sircle in order to update you about our services and events	Legitimate Interest
Buying in mail lists	To offer our services and invite clients to events where there is a balanced business interest (and providing such activity is permitted under local law). We only use third-party marketing lists where we are satisfied that the data has been collected lawfully, that appropriate consents or soft opt-in conditions apply under PECR, and that individuals are provided with a clear and easy way to opt out of further marketing.	Legitimate Interest/Consent
Responding to requests for work, quotes and tenders	Necessary in order to commence with a business prospect, processing would be expected by the client or 3rd party	Legitimate Interest /Contractual
Carrying out work and deliver consultancy services and survey activities in line with an existing contract/agreement	To carry out duties in line with contractual/agreement related obligations. To give relevant updates to clients/3rd parties and conduct billing activities.	Contractual
Adding or amending contact details in our management systems	In order to keep records up to date, fulfil contractual obligations, carry out data cleansing activities	Legitimate Interest/Legal Obligation
Maintaining purchase and financial history on client records	In order to continue offering relevant services, ensuring records are kept up to date	Legitimate Interest / Legal obligations
Conduct marketing activities to prospective and existing clients, including direct marketing emails	To carry out marketing activities, inform clients of relevant services available, attend relevant events and give company and industry updates	Consent / Legitimate Interest
Analysing how our electronic marketing communications and website interactions are used by you	To carry out marketing activities, inform clients/3rd parties of relevant services available, attend relevant events and give company and industry updates	Legitimate Interest
Create and Update attendance records for events	Assist with future marketing activities and identify which events are of interest to clients and 3rd parties	Legitimate Interest
Record responses to questionnaires	To maintain business relationships and monitor the quality and relevance of our services or carry out research activities	Consent / Legitimate Interest
Address any requests from clients or 3rd parties	To ensure clients/3rd parties receive the appropriate level of information requested. To identify trends linked to repeated issues and improve our service and relationship with contacts	Legitimate Interest /Contractual
To address complaints from clients or 3rd parties under our Complaints Handling Procedure (CHP) >https://sircleuk.com/complaintshandlingprocedure/	To comply with legal and regulatory requirements To resolve dissatisfaction and assess redress. To identify trends and improve services.	Legal / Contractual / Legitimate Interest
To obtain credit checks and/or references	Comply with applicable legislation and statutory requirements for the prevention of money laundering	Legal obligation/Legitimate interest
Process invoices and collect payment	To take payment and maintain adequate accounting and financial records	To perform contract
Collect CCTV, system, security, event and usage data	Monitoring systems to prevent fraudulent or illegal activity and ensure safety	Legitimate interests/ Legal obligation
Share data with 3rd parties	To make data available to third parties who provide products or services to us	Contractual / Legitimate interest / Legal obligation
Sharing information with law enforcement	Complying with instructions, orders and requests from law enforcement agencies, any court or otherwise as required by law	Legal obligation

There may be on occasion a need to process special categories of personal data as indicated below:

Processing Activity	Justification for Processing	Primary Lawful Processing Basis
Hosting you at our offices and/or providing hospitality or entertainment services	Dietary requirements, accidents and emergencies	Consent, necessary to protect vital interest or incapable of giving consent
Complying with our general regulatory and statutory obligations or obtaining legal advice	Requirements to establish the existence of any unlawful act, dishonesty, malpractice or seriously improper conduct	Public interest, legal defence