Legal

Privacy Notice

Secretsourced Ltd · Last updated: 1 November 2026

Secretsourced Ltd (“secretsourced”, “we”, “us”, “our”) is committed to protecting your privacy. This notice explains what personal data we collect, how we use it, and what rights you have.

1. Who we are

Secretsourced Ltd (company number 17493522)
Registered address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

For any questions about this notice or how we handle your data, contact: bilal@secretsourced.ai

2. What data we collect

Depending on how you interact with us, we may collect:

  • Client, candidate, and contractor data: names, contact details, and CRM/ATS data (including, for contract-desk clients, timesheet and pay rate data relating to placed contractors) processed as part of delivering our AI enablement programmes
  • Learner data (Level 1 course): your name, work email address, company, booking and payment details, your answers to the course tasks (including answers sent to us by email or typed into a course page), the marks we give them, your pass or fail result, and your certificate ID. For learners we are the controller of this data, meaning we decide why and how it is used. We ask learners not to enter real client or candidate details into any course task
  • Calendar count (Level 1 course): in the final assessment you connect your own work calendar to your own Claude account and tell us only the number of meetings tomorrow and the earliest start time. We do not connect to your calendar, and we ask you not to send us meeting titles, names or any other calendar details
  • Certificate lookup data (optional): if you choose to, your name, certificate level and date are shown on our public certificate lookup page so others can verify your certificate
  • Marketing contact data: names, emails, and company details of individuals we contact regarding our services
  • Website data: data collected via cookies and analytics when you visit our site (see Section 6)

3. Why we collect it (lawful basis)

We only process personal data where we have a lawful basis to do so:

  • Client data, collected and used to deliver our AI enablement programmes, is processed under the basis of performance of a contract.
  • Learner data is processed under the basis of performance of a contract: we need it to take your booking, run the course, mark your tasks, and issue your certificate.
  • Certificate lookup page (showing your name, level and date publicly) is only used with your consent, which you give by ticking a separate optional box when you book. You can withdraw it at any time by emailing us, and we will remove your details from the page.
  • Marketing contact data is processed under legitimate interest, where we reasonably believe our services may be relevant to you.
  • Cookies and website tracking are used only with your consent, which you can withdraw at any time (see Section 6).

4. Who we share it with

We share data, where relevant, with:

  • Anthropic (Claude): the AI tool our enablement programmes are built around. For the Level 1 course, Claude helps us draft marks for your task answers. A member of our team reviews every mark before a result is issued. Separately, you use Claude through your own account during the course, and Anthropic handles that data under its own terms
  • StackOne: used to support MCP/CRM/ATS connectivity work
  • n8n: used to run the automated workflows connecting your systems to AI tooling. n8n is self-hosted by secretsourced exclusively within the UK and EU; it does not persistently store your data, though data may be transiently cached while a workflow is running
  • Course service providers: we use these only to run the course. For Level 1 they are: Formspree (booking forms), Stripe (payments), Certifier (issuing certificates and LinkedIn badges), Vercel (hosting course pages), Slack (receiving task submissions for marking), and our email and document providers (receiving answers sent by email)
  • Your employer, where they pay for your place: we tell them whether you passed or failed, by name. We do not share your marks, your individual scores or your answers with them
  • The public, if you opt in: if you tick the optional box at booking, your name, certificate level and date appear on our public certificate lookup page, which anyone can see
  • LinkedIn: if you choose to add your certificate to your LinkedIn profile, the certificate details you add are shared with LinkedIn

Internal secretsourced team members access data on a need-to-know basis.

We do not sell personal data to third parties.

5. Where your data is processed

We aim to process personal data within the UK and European Economic Area (EEA) wherever possible. Some of the third-party providers we work with, including Anthropic (Claude), StackOne and some of our course service providers, are based in the United States, so personal data may be processed outside the UK/EEA as a result.

Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) together with the UK International Data Transfer Addendum (UK IDTA), to protect your data to UK GDPR standards.

Our own n8n infrastructure, used to run automated workflows, is self-hosted exclusively within the UK and EU. No international transfer occurs in respect of data processed by n8n.

6. Cookies

Our website uses cookies to support core site functionality and analytics. You can control or disable cookies through your browser settings at any time. For details on the specific cookies we use, see our Cookie Policy.

7. How long we keep your data

We retain personal data only as long as necessary for the purposes it was collected:

  • Client contract and financial records: up to 6 years after the engagement ends (to meet UK statutory/tax record-keeping requirements)
  • Learner task answers (including documents sent by email): 12 months after you submit them
  • Learner certificate record (name, email, result and certificate ID): 6 years, so we can verify your certificate and keep our financial records
  • Certificate lookup page listing: until you withdraw your consent, or until we retire the page
  • Marketing contact data: up to 2 years from last engagement, or until you opt out, whichever is sooner
  • Website/cookie data: per the retention period set by the relevant analytics provider (typically up to 26 months)

8. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to how your data is processed
  • Withdraw consent at any time (where consent is the basis for processing)

To exercise any of these rights, contact bilal@secretsourced.ai.

9. Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the UK’s data protection regulator:

Information Commissioner’s Office (ICO)
ico.org.uk

This notice may be updated from time to time. Please check back periodically for changes.