Contents

1. Who we are
2. Data we collect
3. How we use it
4. Legal basis
5. Sharing data
6. How long we keep it
7. Your rights
8. Cookies
9. International transfers
10. Children
11. Changes to this policy
12. Contact us

Summary: We collect only the data we need to run this community. We don't sell your data. You can ask us to delete your account and data at any time.

01

Who we are

Franchise Community ("we", "us", "our") operates this website and online community platform. We are the data controller responsible for the personal data processed through this site.

If you have any questions about how we handle your personal data, please use the contact details in section 12.

02

Data we collect

Information you give us

• Account details — name, email address, and password when you register
• Profile information — job title, company name, sector, and any optional bio or photo you add
• Community content — posts, comments, messages, and files you share on the platform
• Enquiries & correspondence — emails or messages you send us, including support requests
• Event registrations — if you sign up for webinars, meetups, or other events

Information we collect automatically

• Usage data — pages visited, features used, time spent, and search queries within the platform
• Device & technical data — IP address, browser type and version, operating system, and screen resolution
• Log data — access times, error logs, and referring URLs
• Cookies and similar technologies; see section 8

Information from third parties

• If you choose to sign in via LinkedIn or Google, we receive your name, email address, and profile picture from those services (subject to your settings with them)
• If you pay for a subscription or event ticket, our payment processor (Stripe) handles your card details; we receive only a payment confirmation and billing summary

03

How we use your data

Purpose & Examples Running the platform - Creating and managing your account, displaying your profile, enabling community features Communication - Sending account confirmations, password resets, replies to your support queries Community digest & updates - Weekly digest emails, new feature announcements (you can unsubscribe at any time) Events - Confirming registrations, sending joining instructions and follow-up resources Improving the platform - Analysing usage patterns to fix bugs, improve navigation, and develop new features Safety & security - Detecting and preventing fraud, abuse, or policy violations Legal obligations - Responding to lawful requests from authorities, maintaining required records

04

Legal basis for processing Under UK GDPR we rely on the following lawful bases:

• Contract — processing your account data and delivering services you have signed up for
• Legitimate interests — platform security, fraud prevention, improving our service, and sending community digests to registered members (you can opt out at any time)
• Consent — marketing emails beyond the community digest, and non-essential cookies (where applicable)
• Legal obligation — complying with applicable laws and responding to lawful authority requests

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

05

Who we share your data with We do not sell, rent, or trade your personal data. We may share it with:

• Service providers — companies that help us operate the platform, such as cloud hosting (e.g. AWS or similar), email delivery, payment processing (Stripe), and analytics. They act as data processors under contract and may only use your data to perform services for us.
• Other community members — your public profile and any content you post in open community areas is visible to other registered members. Private messages are only visible to their recipients.
• Professional advisers — accountants, lawyers, and auditors, under strict confidentiality obligations.
• Authorities — where we are required to do so by law, court order, or to protect the rights and safety of our members.
• Business transfers — if Franchise Community is sold or merged, your data may transfer to the new owner subject to the same protections.

06

How long we keep your data Data type Retention period

• Account & profile data - Held while your account is active, then deleted within 30 days of account closure (unless legal hold applies)
• Community posts & content - Held while your account is active; anonymised or deleted on closure at your request
• Usage & analytics data - Up to 26 months from collection, in aggregated or pseudonymised form
• Transaction & billing records - 7 years (UK tax and accounting obligations)
• Support correspondence - 3 years from resolution
• Log data - 90 days

07

Your rights Under UK GDPR you have the following rights. Most can be exercised directly in your account settings; for anything else, contact us at the address in section 12.

• Access - Request a copy of the personal data we hold about you
• Rectification - Ask us to correct inaccurate or incomplete data
• Erasure - Ask us to delete your data ("right to be forgotten"), subject to legal obligations
• Restriction - Ask us to pause processing while a dispute is resolved
• Portability - Receive your data in a structured, machine-readable format
• Objection - Object to processing based on legitimate interests or for direct marketing
• Withdraw consent - Withdraw consent at any time where processing is based on consent
• Complain - Lodge a complaint with the ICO if you believe we have mishandled your data

We will respond to rights requests within one calendar month. We may ask you to verify your identity before processing a request.

You have the right to complain to the Information Commissioner's Office (ICO) — the UK's data protection regulator — at ico.org.uk or by calling 0303 123 1113.

08

Cookies We use cookies and similar technologies. A cookie is a small file placed on your device. Here is what we use:

Category - Purpose - Can you opt out?

• Essential - Keeping you logged in, remembering your preferences, security tokens - No — the platform cannot function without these
• Analytics - Understanding how members use the platform so we can improve it (data is aggregated) - Yes — via the cookie banner or your browser settings
• Preferences - Remembering your display settings and notification preferences- Yes — some also adjustable in account settings

You can manage or delete cookies through your browser settings at any time. Disabling non-essential cookies will not prevent you from using the platform.

09

International data transfers Where data is transferred outside the UK, we ensure appropriate safeguards are in place — such as UK adequacy regulations, standard contractual clauses (SCCs), or an equivalent approved mechanism. We only use service providers who meet these requirements.

10

Children Franchise Community is intended for adults and business professionals. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it.

11

Changes to this policy We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by displaying a prominent notice on the platform at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the current version.

Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

12

Contact us If you have any questions about this Privacy Policy, wish to exercise a data right, or want to raise a concern, please contact us:

Data Controller Franchise Community Email: hello@franchisecommunity.co.uk Post: Berwick Workspace, Boarding School Yard, 90 Marygate, Berwick-upon-Tweed, TD15 1BN

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.