Privacy policy
This policy explains what personal data The Exchange collects, why we hold it, who we share it with, how long we keep it, and what you can ask us to do with it. It covers the website and the member platform.
Who is responsible for your data
ESMi Limited runs the Enterprise Service Management Exchange (ESMX) and is the controller of your personal data: it decides how the service uses it. ESMi Limited is registered in England and Wales with company number 14878901, and its registered office is 6 Mill Lane, Ashington, Pulborough, England, RH20 3BX. ICO registration number ZB676689. For a privacy question or request, use the beta feedback control while signed in. If you cannot sign in, ask the person who gave you access to pass the request to the Exchange team. Privacy requests are handled separately from general product feedback.
What we collect
If you create an account
- Your email address and name, and a securely hashed version of your password. We never store your password itself.
- Profile details you choose to add: job title, employer, a short biography, an optional display nickname, professional qualifications, and the topics you have expertise in.
- Your membership tier, and the organisation you belong to where you joined through one.
As you use the platform
- Courses you enrol on, and your CPD ledger — the activities you log, the hours claimed, and the certificates issued to you.
- Anything you post publicly on the platform: community threads and replies, likes, ratings, and articles or videos you submit.
- Your notification preferences and the topics you subscribe to, plus a record of the notifications we have sent you.
- Reports you make about other members’ content, and moderation decisions taken about your own account.
If you contact us or send us a suggestion
- Suggestions for improving the Exchange, including any email address you choose to give us. On the public form the email is optional, and we use it only to tell you if your suggestion is built.
- Complaints, including your name and contact email. You do not need to be a member to raise one.
- Requests about your own data, and a record of how we handled them.
- Corporate membership enquiries: your name, organisation, work email, phone number if you give one, team size and message. We email these to our team and send you a confirmation. They are not stored in the Exchange database. To stop the form being abused we also use your IP address to count how many enquiries come from it in an hour. It is held only in the server’s memory (the form does not write it to a database or log) and is cleared when the server restarts.
Consent records
When you agree to something — these terms, marketing emails, topic notifications, or the terms attached to a gated download — we store the decision, when it was made, and the version of the policy it was made against. We keep an equivalent, append-only log of cookie decisions. These records exist so we can show what you agreed to and when, and so that withdrawing consent is as reliable as giving it.
Why we use it, and on what basis
- To provide membership — running your account, giving you access to content and courses, and maintaining your CPD record and certificates. Necessary to perform our contract with you.
- To answer enquiries, such as replying to a corporate membership enquiry. Necessary to take steps you have asked for before entering into a contract.
- To send you things you asked for — marketing emails, and notifications about topics you follow. Based on your consent, which you can withdraw at any time.
- To keep the platform safe and working — authentication, moderation, preventing abuse of public forms, and acting on the suggestions and complaints we receive. Our legitimate interest in a secure, usable service.
- To meet our obligations — keeping consent and data-request records so we can demonstrate compliance. Necessary for compliance with a legal obligation.
Who we share it with
We do not sell your personal data. We share it only with the service providers we need to run the Exchange, and only so far as they need it:
| Provider | What for | What they see |
|---|---|---|
| Resend | Sending email — sign-in links, service notices and member updates | Your email address and the message content |
| Vimeo | Hosting and streaming some of our videos | Technical data from your browser when you play a video, including your IP address |
| Anthropic | Writing the answers given by Esme, the Exchange’s AI assistant, and the simulated AI persona posts and questions in forum threads | The question you ask Esme and the passages of Exchange content used to answer it. For forum threads, the thread title and text and recent replies, with members shown only as “Member”. Not your name, email address or account details |
| Application and database hosting provider | Running the private-beta servers and database in the European Economic Area | Everything above, stored at rest |
Some of these providers are based outside the United Kingdom. Where that is the case, we use the contractual or legal safeguard required by UK data-protection law for that transfer.
Esme, the AI assistant
When you ask Esme a question and AI answers are switched on, we send the text of your question, with the most relevant passages of Exchange content, to Anthropic so that it can write an answer. We do not send your name, email address or any account identifier. Anything you type into the question itself is sent, so please leave out personal or confidential details. When AI answers are switched off, Esme shows the matching passages instead and nothing is sent to Anthropic.
Simulated AI personas take part only in forum threads that ESMi chooses to start or seed. They do not reply to threads that members start. A persona may start a thread by asking a question, and may post in a seeded thread. Every persona post and question is clearly labelled as AI and reviewed by ESMi before it is published, and none is the view of any member. To write and check persona posts we send Anthropic the thread title and text and up to the 16 most recent visible replies, so if you reply in a thread where personas take part, your reply may be sent. Replies from members are labelled only as “Member”: we do not send members’ names, email addresses or account identifiers. Please leave out personal or confidential details. Read more about our AI personas.
Anthropic acts as our processor. For UK customers its commercial terms are with Anthropic Ireland, Limited, and under them it does not use this data to train its models. It normally deletes API inputs and outputs within 30 days, but may keep them longer where they are flagged for breaching its usage policy or where the law requires it. Anthropic stores this data in the United States and may process it in other countries. Those transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of Anthropic’s data processing addendum.
If Esme cannot find an answer, we keep the question with your account so the team can see which content is missing.
Keeping it secure
Access to administration tools is restricted to named administrators using strong, unique passwords.
Other members can see what you post publicly, and your name on a course roster — but only if you have turned roster visibility on, which is off unless you choose otherwise.
Cookies
We currently set only the cookies needed to run the site: those that keep you signed in and protect forms against cross-site request forgery. We do not currently run analytics or advertising cookies. If that changes, this policy and the cookie policy will be updated first, and non-essential cookies will not be set before you have made a choice.
How long we keep it
We keep your account and profile data for as long as you have an account. If you ask us to erase your data, we clear or anonymise the personal details on your account and you will no longer be able to sign in.
Two things deliberately survive that process. Your CPD ledger and any certificates issued to you are retained, so a professional development record you have already relied on stays verifiable. Records of consent and of data requests are also retained, because they are the evidence that we handled your data properly. Neither is used to contact you or to rebuild a profile.
Corporate enquiry emails are kept in our team mailbox while we discuss membership with you or your organisation, and deleted once the enquiry is closed with no membership following. Resend, which sends them, keeps its own copy for the period set in its service terms.
If you unsubscribe from our emails we keep your address on a suppression list. That is the only way to be sure we do not email you again.
Your rights
Under UK data protection law you can ask us to give you a copy of your personal data, correct it if it is wrong, erase it, restrict or object to how we use it, or send it to another provider. Where we rely on your consent, you can withdraw it at any time — and withdrawing is as easy as giving it.
To exercise any of these rights, use our dedicated privacy request route. We will respond within one month. If your request is complex we may need longer, and we will tell you within that first month if so. You will not be charged.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would rather you came to us first so we can put it right.
Changes to this policy
If we change how we use your personal data we will update this page. A change that affects something you have consented to means asking you again, not assuming your previous answer still applies.