Scottish Business Network Privacy notice
This notice explains how Scottish Business Network uses personal information across its websites, membership community, events, ambassador activities, newsletters and professional relationships.
1. Who we are
SCOTS BUSINESS NETWORK LTD, trading as Scottish Business Network (SBN), is the controller of personal information described in this notice. Company number: SC548512. Registered office: 9 Springfield Road, Linlithgow, Scotland EH49 7JH. For privacy questions or requests, email scott@sbn.scot.
2. Who this notice applies to
This notice applies to visitors to our websites, SBN Family members (including complimentary members and corporate representatives), Ambassadors, event attendees, speakers, newsletter subscribers, prospective members, volunteers and professional contacts. Where other organisations independently control information in a joint activity, they may provide their own privacy notices.
3. Information we collect
Depending on your relationship with us, we may collect names, contact details, city or location, employer, job title, professional sector, LinkedIn and other professional links, correspondence, enquiries, introductions and information you choose to share.
For SBN Family, we process registration and profile details, membership category and status, biography, photograph, community contributions and participation records. Payments are handled through Heartbeat and Stripe. We may see limited billing information such as payment status, receipts, card brand and last four digits, but not full payment-card numbers.
For events, we may collect registration and attendance details, speaker information, feedback, photographs, recordings and information volunteered about accessibility or dietary requirements. Some of this may be sensitive, and we limit its use to appropriate arrangements.
We record professional contacts, meetings and relevant relationship history in Airtable. Information may come from you, referrals, events or publicly available professional sources. Our websites and providers may also process technical information such as IP addresses, browser information and cookies.
4. Purposes and lawful bases
We use information to administer memberships, provide access to SBN Family, manage subscriptions and payments, respond to enquiries, organise events, support Ambassadors and facilitate relevant professional introductions. The lawful basis will depend on the activity and may be performance of a contract, steps towards a contract, legitimate interests or consent.
We use relevant information to maintain genuine professional relationships and to protect our services, prevent misuse and manage disputes where our legitimate interests justify this and are not overridden by individuals’ rights. We retain accounting and other legally required records to meet legal obligations.
For newsletters, promotional emails and event invitations, we follow UK electronic marketing rules and obtain consent or rely on another permitted route where appropriate. Joining SBN or attending an event does not automatically give blanket permission for marketing.
5. CRM and professional contacts
We use Airtable to record professional contact details and proportionate notes about meetings, introductions, interests and interactions. Airtable is not our mass-marketing email platform. Where there is a continuing legitimate professional relationship, relevant information may remain in our CRM after an event or membership ends. We review CRM records at least annually and correct or remove information no longer needed.
6. SBN Family membership community
SBN Family operates on Heartbeat. Standard member profiles are visible to other logged-in members, not the general public, and may include a name, photograph, biography, professional links and membership or role labels. Email addresses and telephone numbers are not shown in the standard member profile, although authorised administrators can access information required to manage accounts. The member directory is not currently searchable.
Community posts and comments may be visible to relevant participants. Members must not harvest information or use the community for unauthorised bulk marketing. We will review privacy implications before introducing material new visibility or messaging features.
Cancelling a paid subscription is different from deleting a member account. Account deactivation retains information for potential reactivation. Following an eligible permanent deletion request, Heartbeat states that the profile and associated activity are removed from the live community, with limited residual information retained as described in section 12.
7. Introductions and sharing with partners
We may suggest relevant introductions based on professional interests and will normally ask before disclosing your personal contact details for an introduction. We do not provide member or attendee contact lists to sponsors or commercial partners for their unrelated marketing without an appropriate lawful basis. For jointly delivered events, we may share necessary booking or attendance information with co-hosts, venues or delivery suppliers, with appropriate information about any independent controller roles.
8. Events, photographs and recordings
We use Eventbrite, Luma and HeySummit to support event registration and delivery, and Zoom or Microsoft services for online sessions and recordings. We may photograph or record events for reporting, community communications and promotion. We provide appropriate event notices and seek separate permission where necessary, particularly for prominent individual features or sensitive circumstances. Contact scott@sbn.scot if you have concerns about photography or recording. Recordings may be held in Zoom, Microsoft or other authorised storage.
9. Newsletters and communications
SBN publishes a newsletter through LinkedIn, where subscribers manage their subscription. We may send permitted event invitations and necessary event or membership service messages through relevant platforms. Promotional communications are subject to appropriate permission checks and opt-out mechanisms; essential booking and service messages are distinct from optional marketing. We retain limited suppression information where needed to honour marketing objections.
10. Service providers and recipients
Our service providers include Airtable (CRM), Heartbeat (membership), Stripe (payments), Squarespace and Strikingly (websites), Eventbrite, Luma and HeySummit (events), Zoom and Microsoft services (meetings, communication and storage), Dropbox (files) and Xero (accounting and VAT records). We may also share necessary information with relevant event partners, professional advisers and authorities where lawful. Some providers act as independent controllers for certain purposes, such as regulated payment processing.
Honeycomb is a legacy membership platform being retired. We do not plan to bulk-migrate its community data into Heartbeat; any separately justified professional relationship records are managed in Airtable. We do not sell member or attendee contact lists.
11. International processing
SBN works internationally, and authorised personnel may access systems while travelling abroad, subject to access controls. Some service providers process personal information outside the UK. Heartbeat has confirmed that SBN Family community data is hosted in the United States (AWS us-east-1), with service providers in other locations including India and Italy. Heartbeat describes Standard Contractual Clauses and a UK Addendum as safeguards for relevant transfers. Airtable also publishes contractual provisions for UK international transfers. Other providers may use lawful international transfer mechanisms where required. We assess relevant transfer arrangements and safeguards in connection with our use of these services.
12. How long we keep information
We keep information only as long as reasonably necessary for its purpose, taking account of legal obligations, legitimate ongoing relationships, disputes and individuals’ rights. Our normal retention periods include:
Event registration and attendance lists: 12 months after the event, unless a separate lawful purpose justifies longer retention.
Accessibility and dietary information: normally deleted within 30 days after the event, unless an exception applies.
Raw event photographs, video and audio: normally 12 months after the event. Routine webinar recordings are also normally retained for 12 months.
Published photographs, edited videos and historical archives: while a genuine editorial, promotional or historical purpose continues, with annual review.
Financial, accounting and transaction records: generally six years, subject to the relevant statutory calculation and any longer legal requirement. Certain core corporate records, such as incorporation documents, are retained indefinitely. Supporting financial documents are maintained with transaction records in Xero.
Professional CRM records: reviewed at least annually and deleted when no continuing lawful purpose exists.
Marketing suppression records: as long as reasonably necessary to respect opt-outs.
Cancelling a Heartbeat subscription does not itself delete a member account. Heartbeat states that, after permanent individual account deletion, limited system logs can remain for up to 45 days, a deletion record for up to 90 days, and backups for up to six months. Deactivated accounts retain data for possible reactivation. Heartbeat states that, when the whole community agreement terminates, community data including backups is deleted within 90 days, subject to applicable exceptions. We may retain separate records where legally required or otherwise lawfully justified.
13. Security
We use proportionate technical and organisational security measures, including role-based access and two-factor authentication for key systems. We investigate suspected personal-data incidents and make notifications where required by law. No online system can be guaranteed completely secure.
14. Your privacy rights
Depending on the circumstances, you may ask to access or correct your personal information, request erasure, restrict or object to processing, or receive eligible information in a portable format. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You have an absolute right to object to direct marketing. Email scott@sbn.scot to make a request; we may need to verify your identity. You may complain to the UK Information Commissioner’s Office at https://ico.org.uk/.
15. Cookies, external links and updates
Our websites and platforms may use necessary cookies and optional analytics or similar technologies, subject to applicable consent requirements. SBN’s Squarespace website provides cookie choices. Google Analytics is not currently configured through the Strikingly Google Analytics Tracker field on Saltire Sentinel. Heartbeat has confirmed that the current SBN Family plan does not support SBN-configured Google Analytics or Meta Pixel tracking and does not use advertising cookies. Heartbeat uses certain functional third-party scripts for support messaging, notifications and link previews.
External sites linked from our services have their own privacy practices. We may update this notice when our activities, services or legal requirements change, with additional notice where appropriate.
Last updated: 15 October 2026.