Privacy Policy

Who we are

Female Founders Surrey ("FFS", "we", "us") is a trading name of Female Founder Stories Ltd, a company registered in England & Wales, company number 16714388. Registered office: 43 Moy Green Drive, Horley, England, RH6 8NU. Female Founder Stories Ltd is the data controller for your personal data and is registered with the Information Commissioner's Office (ICO), registration reference ZC070811. We run femalefounderssurrey.com and a community for women building businesses in Surrey. For anything privacy-related, contact us at gabi@femalefounderssurrey.com. We keep this simple on purpose: we collect as little as we can, we never sell your data, and we only use it to run this community.

What we collect, and why

(a) When you register for updates via the form on our site: your email address (verified with a one-time code), plus your name, business name, town, link and a short description if you give them, and your choices about hearing from us — event updates, appearing on the FFS podcast, and user research. We use this to keep you posted about FFS and, if you opted in, to invite you to research sessions. Legal basis: your consent, given when you submit the form. Stored in our website database (Supabase, via our hosting provider Lovable). Details previously collected through our old interest form (stored in HubSpot) are being moved into our own database, after which HubSpot will no longer be used.

(b) When you submit a business to the Spotlight: your email address (used once to verify you're human, and kept so we can contact you about your listing), your business name, town, what kind of business it is (optional), link, description and photo. If approved, those business details and the photo are published on our site — in the Spotlight directory and on a page of its own at femalefounderssurrey.com/spotlight/your-business — which search engines can find and anyone can share. Your email address is never shown publicly. Legal basis: your consent and our legitimate interest in running the directory. Stored in our website database (Supabase, via our hosting provider Lovable).

(c) When you sign in or verify your email: we send you a one-time code and set a session cookie so the site remembers you. We also keep a short record that a sign-in email was sent to your address, so we can spot delivery problems.

(d) Your consents, in one place: whichever form you use, we keep a record of what you agreed to — event updates, podcast interest, user research — including when and through which form, so we can prove we're only contacting people who asked. Registering for updates is itself the event-updates opt-in; the podcast and research boxes are always optional. You can change your mind any time: every update email has an unsubscribe link, and you can email us to change or withdraw any consent.

(e) When you register for an event on our site: your name, business name and email; any dietary requirements you choose to tell us (used only for catering and deleted shortly after the event); and your registration record, including whether you attended. For paid events, payment is taken by Stripe on their secure checkout page — we never see or store your card details; we store only the amount, the payment status and Stripe's reference. Some events are hosted on Meetup or Eventbrite instead — their own policies apply to what you share there. Legal basis: performance of a contract (your booking), and consent for the optional tickboxes. If you book places for other people, we store each guest's name and any dietary requirements (deleted after the event, like yours) and their email address if you give it — used only to send them the booking details and a reminder for that event, unless they opt in to more themselves.

(f) One record per person: we keep the details above as a single member record — your email, name, business details, consents, Spotlight listing and event history — so we don't ask you the same questions twice, and so that when you ask "what do you hold about me?" we can answer properly, and delete it properly.

(g) When you give us feedback: what you told us about an event or about FFS, when you told us and, where we know it, who you are and which event it was about. We keep it so we can improve what we do. If you agree, we may publish short extracts on our site. We publish them without your name, your business or the event, and we will take an extract down whenever you ask. Legal basis: our legitimate interest in improving FFS, and your consent for anything we publish.

(h) Fixing problems: if something goes wrong on the site, for example a sign-in code doesn't send or a Spotlight submission doesn't save, we keep a record of what went wrong, when, and the email address involved if we have one, so we can put it right and get back to you. Only Female Founders Surrey admins can see these records and we delete them after 90 days. Legal basis: our legitimate interest in keeping the site working.

(i) Photos at our events: we sometimes take photos at our events and share them on our website and social media to show what FFS events are like. If you'd rather not appear, tick "Please keep me out of event photos" when you book, or tell us on the night, and we'll keep you out of anything we publish. If you see a photo of yourself you'd like taken down, email us and we'll remove it. Legal basis: our legitimate interest in sharing what our community does, and your choice to opt out is always respected.

(j) Who’s coming on event pages: When you book an event, we may show your business name and town, with a link to your Spotlight listing if you have one, in a “Who’s coming” list on that event’s page. We only show the list once at least three businesses are going, and we never show your name, email or any other details. The box is ticked when you book. Untick it if you’d rather not be shown, or reply to any of our emails and we’ll take you off the list. We stop showing it once the event has happened. Legal basis: our legitimate interest in helping local businesses find each other, which you can opt out of at any time.

What we don't do

We don't sell your data. We don't share it with third parties for their marketing. We don't run advertising trackers on our site.

Who processes data for us

Lovable/Supabase (website hosting, database, and email delivery for verification codes, confirmations and updates, sent from femalefounderssurrey.com addresses), Stripe (payment processing for paid events — see Stripe's own privacy policy), and Meetup or Eventbrite where an event is hosted there. Each acts under contracts appropriate to UK GDPR.

A small number of trusted staff and contractors help us run Female Founders Surrey. They are given access only to the areas of our admin tools they need for their work, and anyone in a view-only role cannot see your email address or payment details.

How long we keep it

Member records (including your consents): until you ask us to delete them. Dietary requirements: deleted shortly after the event they were given for. Feedback: until you ask us to delete it. Published extracts are taken down on request. Spotlight listings: while your business is featured, and removed on request. Once removed, we stop serving the page and photo, but search engines and social platforms may keep cached copies for a while. We can't control that. Payment records: kept for six years as accounting rules require. Verification and session data: expires automatically. Records of problems on the site: deleted after 90 days. Event photos: kept while they help show what our events are like, and removed on request. Who’s coming list: shown until the event has happened.

Your rights

Under UK GDPR you can ask us at any time to: see the data we hold about you, correct it, delete it, restrict how we use it, or object to our use of it. You can withdraw consent whenever you like (every email we send has an unsubscribe link, and "delete my listing" is one email away). To exercise any of these, email gabi@femalefounderssurrey.com. If you're not happy with how we handle it, you can complain to the Information Commissioner's Office (ico.org.uk).

Cookies

We use only the cookies needed to make the site work: a session cookie when you verify your email or sign in to administer. No advertising cookies. Stripe sets its own cookies on its checkout page when you pay for an event.

Changes

If we change this policy, we'll update this page and the date at the top. If a change is significant, we'll tell registered members by email.