HUBEN LTD

Privacy notice

Last updated: 25 September 2026

Who we are and who this notice covers

HUBEN LTD, company number 17027047, registered in England and Wales. Registered office: Unit 501 Leroy House, 434-436 Essex Road, London N1 3FY, United Kingdom. HUBEN LTD is the controller for its website, free membership, publications, enquiries and its own research described here. Contact research@huben.ltd about privacy or your rights. Our website is available internationally. This notice explains our UK framework without limiting mandatory protections in your country. A commissioned project involving a different controller or purpose needs a separate project notice before personal information is collected.

Free access and your choices

Membership and standard publications are free. Selected full publications require sign-in. Access does not require participation in research, an email subscription or analytics permission. Research invitations and editorial or promotional email each require a separate, optional choice. Paid consultancy or a bespoke report would be covered by an agreed scope and separate terms.

Information we collect

Email access uses your email address, verification and account records. Initial studies use verified email by default: responses may be linked to your email, account identifier, study version and sign-in method. We do not ask for a name in the research questionnaire. If you separately choose LinkedIn sign-in, the provider can supply basic profile information, including a name and email; this is account information, not an extra research question.

We also process communication choices and their evidence, enquiry details, contributions and optional files, publication download records, delivery metadata, and limited technical information for operation and security. A contact enquiry or a contribution with attribution can include a name you provide separately. Do not enter other people's details, health information or sensitive material in free-text answers.

Purposes and lawful bases

Membership and requested access: providing the free service you request under our website terms, including necessary account and access administration.
Initial research responses: your informed consent for the particular study, including its stated analysis and publication of non-identifying findings. Taking part is voluntary.
Research invitations and HUBEN updates: your separate consent for the relevant email category.
Enquiries and paid work: steps you request before a contract, or performance of that contract when you are a party; our legitimate interest in answering ordinary enquiries and liaising with an organisation's contact person.
Contributions: the review and use you expressly permit. Publication with attribution requires the corresponding permission or a separate agreement.
Security and administration: our legitimate interests in preventing misuse, maintaining the service and investigating incidents. We assess necessity and the effect on people's rights.
Accounting and required disclosures: applicable legal obligations. Minimal compliance evidence and opt-out records support accountability and respect for your choices.
Optional analytics: your consent. Rejecting it does not restrict access.

Research participation and withdrawal

Initial studies are for adults aged 18 and over. They do not request names, health information or psychological assessments, and must not collect special-category data. The introduction explains the particular purpose and access model. Verified-email responses are confidential, not anonymous. Where a study expressly permits participation without sign-in, we do not attach your account or email to its responses; free text and separate infrastructure logs can still contain identifying information.

You can leave before submission. Afterwards, contact research@huben.ltd with the study title and participation email or response reference to withdraw consent or request deletion. We may need proportionate verification. Withdrawal does not affect lawful use before withdrawal. Once information is irreversibly anonymised, we cannot find or remove your individual contribution from it. Published aggregate findings cannot generally be separated into individual responses. Removing only an email or replacing it with a code is not, by itself, anonymisation.

Identifiable raw responses are not published or passed to commercial clients as part of a report. We review quotations and small groups for re-identification risk. We do not use these studies to make decisions about you with legal or similarly significant effects. If we learn that a child has submitted information, we restrict use and arrange deletion unless a specific legal requirement prevents it.

Email communications

Research invitations and HUBEN updates have separate controls in email preferences. Optional messages require a verified, affirmative opt-in for their category. We require renewal after 24 months without a fresh affirmative choice; email opens do not renew permission. Every optional email includes an unsubscribe link. Withdrawing either choice does not affect free membership. Necessary verification, security and responses to your requests are separate service messages and must not contain disguised marketing.

We do not buy or scrape mailing lists, infer permission from publicly available addresses, or sell participant mailing lists. A minimal opt-out record may remain to prevent accidental re-contact.

Contributions and AI-assisted editorial work

Submitted material enters private review and is not automatically published. Your selected permission determines its use; attribution requires the relevant permission. Do not upload confidential client information or material you are not entitled to share.

HUBEN may use AI to assist editorial drafting, translation, illustrations or analysis of irreversibly anonymised material, subject to human review. This is not permission to send identifiable responses, emails or confidential submissions to general-purpose AI services. Introducing an AI provider that processes personal information requires a separate assessment, suitable terms and an updated notice before use.

Google Analytics and Search Console

Optional Google Analytics receives limited, consented counts of selected public pages through our server. This implementation does not load a Google tracking script or set analytics cookies. It excludes account, administration, study and unsubscribe pages and does not forward visitor IP addresses, browser referrers, query strings, responses, emails or account identifiers. Each event has a fresh random identifier; it does not measure individual browsing journeys. Withdrawing permission stops future events but cannot recall one already transmitted.

Google Search Console supports public search visibility and indexing. Domain verification through a DNS record does not require a visitor analytics tag. It is separate from your analytics choice. See the cookie notice.

Recipients and international processing

Restricted HUBEN staff and contracted providers may process information needed for their role. Supabase provides authentication, database and private storage. Hosting and email-delivery providers operate the deployed service; Google receives optional analytics events and LinkedIn handles sign-in if you choose it. Professional advisers or public authorities may receive information where necessary and lawful. Sharing identifiable responses with collaborating institutions needs its own arrangement and notice before it occurs.

Providers or authorised personnel may process information outside your country, including outside the UK. Restricted transfers require an applicable adequacy arrangement or appropriate contractual safeguards and any required assessment before they occur. Contact research@huben.ltd for information about the recipients and safeguards relevant to your data. Buying a domain in one country does not determine where service data is processed.

Retention and deletion

These are HUBEN's standard retention limits, chosen for these purposes; they are not universal legal minimums. We review due records monthly, delete earlier when no longer needed and handle individual rights requests separately. An exception requires a documented purpose, restricted access and a review date.

Accounts: While used; review after 24 months without sign-in. Close within 30 days of that review unless another documented purpose requires the account.
Identifiable study responses and study invitations: Delete or irreversibly anonymise within 12 months of collection. Remove an expired or closed-study invitation within 90 days.
General enquiries: Delete within 12 months after the enquiry is resolved. Separate records needed for an agreed paid engagement.
Unpublished contributions and supporting files: Review within 6 months of receipt; delete rejected or withdrawn material within 30 days of the decision and unresolved submissions within 12 months of receipt.
Publication access records: Delete identifiable download records within 90 days.
Optional email preferences: Use only while consent remains current. Renew consent through account preferences within 24 months of the last affirmative choice, or stop optional email.
Consent evidence and rights-request records: Keep only the minimal evidence for 3 years after withdrawal, expiry or resolution, then delete unless a specific legal obligation or dispute requires it.
Email delivery records: Remove personal delivery metadata within 90 days of resolution. Resolve uncertain deliveries before deletion; retain only non-contact replay controls as needed.
Security and administration: Routine technical logs: up to 30 days where under HUBEN control. Administrative audit records: 12 months. Necessary incident evidence is isolated until the incident and any related claim are resolved.
Opt-out records: Retain the minimum email address, scope and date needed to prevent unwanted contact while HUBEN operates the relevant mailing programme; review necessity annually.
Paid engagements and accounting: Keep necessary contract/claim records for 6 years after completion; company accounting records normally for 6 years from the end of the financial year they concern, longer when legally required.

Published attribution and the minimum permission record can remain while an authorised contribution is published and for up to 3 years afterwards. Irreversibly anonymous outputs may remain to support published work, with a relevance review every 5 years. Coded or pseudonymous records remain subject to the personal-data limits above.

Deletion covers working copies and exports. Restricted backups expire under the applicable provider's verified backup cycle and must not return to ordinary use; deletions and opt-outs must be reapplied before a backup is restored into service. Contact us for the applicable backup period. We retain only necessary records subject to a specific legal obligation, active dispute or justified security hold, and explain relevant exceptions when responding to a request.

Your rights and complaints

Depending on applicable law and the processing, you can request access, correction, erasure, restriction or portability, object to legitimate-interest processing, and withdraw consent. You can object to direct marketing at any time. Email research@huben.ltd; you do not need a particular form or a paid service. We aim to respond within one calendar month and follow any shorter applicable deadline. If a lawful extension or exception applies, we explain it. Identity checks are proportionate.

You may complain to us, the UK Information Commissioner's Office, or another competent authority where local law gives you that right. Nothing here removes mandatory local privacy rights.

Security and changes

We restrict administrative access, use private storage for unpublished materials and protect server credentials. No service can guarantee absolute security. Changes in research scope, providers or data use require review; where new consent is needed, we ask before making that use.

Contact HUBEN