Privacy Policy
Last updated: 19 July 2026
Contents: 1. Who we are · 2. Definitions · 3. What this policy covers · 4. Data we collect · 5. Why we use it, and on what basis · 6. Cookies and tracking · 7. Who we share data with · 8. International transfers · 9. Security · 10. How long we keep it · 11. Your rights under the GDPR and UK GDPR · 12. Your rights as a US resident · 13. Do Not Track · 14. Children’s privacy · 15. Third-party links · 16. Changes to this policy · 17. Contact
1. Who we are
Eleu (“we”, “us”) is a company in formation. Until incorporation is complete, this policy is issued by its founders, who act jointly as the data controller for the personal data described here.
Contact: hello@eleu-group.com
On incorporation, this section will be updated to name the legal entity, its registered address, company number, and jurisdiction.
2. Definitions
Personal data means any information relating to an identified or identifiable individual. Controller means the person or entity that decides why and how personal data is processed. Here, that is Eleu. Processor means a service provider that processes data on our instructions. Professional contact means an individual with whom we have, or are exploring, a working relationship. You mean the individual whose data is being processed. We use plain language throughout and define anything unusual where it appears.
3. What this policy covers
This policy covers personal data we process:
- through this website: the contact form, newsletter signup, and analytics;
- through direct correspondence: email, phone, messaging, and professional networks such as LinkedIn;
- in the course of building and maintaining professional relationships: the contact and relationship record we keep about the people and organisations we work with;
- at meetings and private events we organise or host.
It applies to website visitors, people who correspond with us, professional contacts, and event participants. It does not cover data processed under separate written terms with members or counterparties once such terms exist; those terms will govern.
4. Data we collect
Data you give us
- Contact form: your name, email address, and the content of your message.
- Newsletter: your email address and a record of your double opt-in confirmation.
- Correspondence: whatever you choose to include when you write to or speak with us.
- Events: contact details, attendance, and any requirements you tell us about (such as dietary or access needs).
Data we collect about professional contacts
Because our work consists of building long-term professional relationships, we keep records about the people we work with and may work with: name, role, organisation, professional background, contact details, how we were introduced, and a record of our interactions. This data comes from you directly, from the person who introduced us, or from publicly available professional sources such as your organisation’s website or your LinkedIn profile.
Data collected automatically
If you accept analytics cookies, Google Analytics collects usage data: pages visited, approximate location (city level), device and browser type, and how you arrived at the site. IP addresses are anonymised. If you decline, none of this is collected and the site works exactly the same.
What we do not collect
We do not knowingly collect data about children, we do not buy contact lists, we do not run advertising or cross-site tracking, and we never sell or rent personal data under any definition, including the broad definitions used in US state privacy laws.
5. Why we use it, and on what basis
| Purpose | Data | Lawful basis (GDPR) |
|---|---|---|
| Replying to enquiries and correspondence | Name, email, message content | Legitimate interest: responding to correspondence you initiated |
| Sending updates you signed up for | Email address | Consent: withdraw anytime via the unsubscribe link |
| Website analytics | Usage data via Google Analytics | Consent: given or refused via the cookie banner |
| Building and managing professional relationships | Business contact and relationship data | Legitimate interest: establishing and maintaining the professional relationships that constitute our work |
| Organising meetings and private events | Contact details, attendance, requirements you provide | Legitimate interest and, for any special category data you volunteer, your explicit consent |
| Complying with legal obligations | Records required by law (e.g. accounting, KYC once applicable) | Legal obligation |
Where we rely on legitimate interest, we have assessed that our interest in maintaining professional relationships does not override your rights, given the professional context and the limited, expected nature of the data. You can object at any time. See Section 11.
We may also process personal data where necessary to evaluate or complete a merger, restructuring, or transfer of the initiative’s assets. In particular, on incorporation of Eleu, the data described in this policy will transfer to the incorporated entity under this same policy; if data were ever to become subject to a materially different policy, we would notify you first.
6. Cookies and tracking
The site sets analytics cookies (Google Analytics) only if you accept them via the consent banner, and you can change your choice at any time through Cookie Settings in the footer. Strictly necessary items, such as the cookie remembering your choice, do not require consent. We use no web beacons, tracking pixels, advertising cookies, or social media trackers. The full list of cookies, their durations, and your controls is in our Cookie Policy.
7. Who we share data with
We never sell or rent personal data. We share it only with:
- Service providers who process data on our instructions under data processing agreements: Lovable and its hosting infrastructure (website hosting), Supabase (contact form storage), Google (analytics, only with your consent), and our newsletter provider (newsletter delivery).
- Professional advisers: lawyers, accountants, and auditors, where necessary and under confidentiality.
- Public authorities, where disclosure is required by law or by a valid request, or where we believe in good faith it is necessary to comply with a legal obligation, protect someone’s safety, or defend legal rights.
- A successor entity, as described in Section 5.
We do not share relationship data between contacts. An introduction is made only with the agreement of the people involved.
8. International transfers
We operate internationally and some of our service providers are based in, or transfer data to, countries outside the EEA and UK, including the United States. Where that happens, transfers are protected by the EU-US Data Privacy Framework, Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism.
9. Security
Access to personal data is restricted to the founders and, where strictly necessary, our service providers. Data is stored with providers offering encryption in transit and at rest, access controls, and audit logging. We keep the volume of data deliberately small: the best protection for data we do not need is not to hold it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; if a breach ever put your rights at risk, we would notify you and the relevant authority as the law requires.
10. How long we keep it
| Data | Retention |
|---|---|
| Contact form messages and email correspondence | Up to 24 months after our last exchange, unless the exchange leads to an ongoing relationship |
| Newsletter addresses | Until you unsubscribe, then removed from the active list |
| Analytics data | 14 months, deleted automatically |
| Business relationship records | For the duration of the relationship and up to 24 months after it ends |
| Event records | 12 months after the event, except records we must keep by law |
| Records required by law | The period the applicable law prescribes |
11. Your rights under the GDPR and UK GDPR
If you are in the EU, UK, or a jurisdiction with similar rules, you have the right to:
- access the data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- have your data deleted;
- restrict how we use it while a question about it is resolved;
- object to processing based on legitimate interest, including relationship records we hold about you;
- receive your data in a portable format;
- withdraw consent (newsletter, analytics) at any time, without affecting what happened before.
To exercise any of these, email us at the address in Section 1. We will respond within one month, and we may ask you to verify your identity first. You also have the right to lodge a complaint with your data protection authority. In the EU, that is the authority of your member state; in the UK, the Information Commissioner’s Office (ICO).
12. Your rights as a US resident
If you are a resident of California or another US state with a comprehensive privacy law, you have rights to know what personal information we hold about you, to access and correct it, to request its deletion, and not to be discriminated against for exercising those rights. We extend these rights to all US residents as a matter of policy, whether or not the relevant statute technically applies to us.
For the avoidance of doubt: we do not sell or share personal information for monetary or other valuable consideration, we do not use it for targeted or cross-context behavioural advertising, and we have not done either in the preceding twelve months. There is therefore nothing to opt out of, but you may contact us at any time with questions. To exercise any right, email the address in Section 1; we will verify your identity and respond within 45 days.
13. Do Not Track
Because analytics runs only with your explicit consent, our practical answer to tracking preferences is the consent banner itself: decline, and nothing is tracked. The site does not respond to browser Do Not Track signals as a separate mechanism.
14. Children’s privacy
This site and our work are directed at professionals. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.
15. Third-party links
The site may link to third-party sites, such as LinkedIn. Their privacy practices are their own; this policy does not cover them, and we encourage you to read theirs.
16. Changes to this policy
If we change how we handle personal data, we will update this page and the date at the top. Material changes affecting newsletter subscribers or professional contacts will be notified directly by email before they take effect.
17. Contact
Questions, requests, or complaints about this policy or your data: hello@eleu-group.com