Privacy Policy

Who we are

Last updated: 29 September 2026

Portobello Business Centre CIC ("PBC", "we", "us") is the data controller for the personal information described in this notice. We are a community interest company that provides business support, advice, grants administration, workshops and training.

Registered company number: 03012156

ICO registration number: Z5744638

Address: 209 Canalot Studios, 222 Kensal Road, London W10 5BN

Email: info@pbc.co.uk

Phone: 020 7460 5050

Data protection contact: Dr Sheela Sharma, Executive Chair and CEO (contact via info@pbc.co.uk)

We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What we collect

We only collect what we need for the service you use. Most of it comes from you directly.

Contact details: name, organisation, job title, email, phone and address.
Bookings: the workshops, events or appointments you book, and your attendance.
Business information: what you tell us about your business when you ask for advice, coaching or grant support, including information funders ask us to collect, such as business type, turnover, number of employees, trading start date and local authority area. Equality monitoring questions (gender, age group, ethnicity and disability) are also asked for funded programmes, and you can always answer "Prefer not to say".
Workshop records: sign-in and sign-out times, feedback forms, knowledge quizzes, assessment exercises, action plans and follow-up reviews (see Workshops, training and CPD certificates).
Access needs: any adjustments you ask for, such as step-free access or large-print materials. We use these only to arrange the adjustment.
Photos: we may photograph some sessions for our communications. You can ask not to be included.
Marketing preferences: whether you want to receive our newsletters and event updates.
Website data: information collected by cookies and similar technology when you use pbc.co.uk (see our Cookie Policy).

How we use it and our lawful bases

UK GDPR requires a lawful basis for each use of your information. Ours are set out below.

• Take and manage your booking, and run the workshop or appointment: contract, or steps you ask us to take before one.

• Issue your CPD certificate through The CPD Certification Service: legitimate interests (giving you the certificate you asked for).

• Record attendance, feedback and assessment results for quality assurance: legitimate interests (checking and improving our training, and meeting CPD standards).

• Report to the organisations that fund our programmes: legitimate interests (meeting our funding agreements).

• Arrange adjustments for access needs: explicit consent, which you can withdraw at any time.

• Send newsletters and event updates: consent, which you can withdraw at any time using the unsubscribe link.

• Follow up on requests for further support: legitimate interests, or consent where you ticked a box asking us to.

• Take photos at sessions for our communications: legitimate interests; you can opt out on the day or later.

• Keep financial and business records: legal obligation.

Where we rely on legitimate interests, we have balanced our interests against yours. You can object at any time (see Your rights).

Equality monitoring. Ethnicity and disability are special category data under UK GDPR. We ask for them only because the organisations that fund our programmes require it to check the support reaches everyone. We rely on your explicit consent: you can answer "Prefer not to say" to any of these questions, and it won't affect your place. We share this information only with the relevant funder for monitoring, and keep it only as long as the funding agreement requires.

Workshops, training and CPD certificates

Some of our workshops are certified by The CPD Certification Service. When you attend one, this is what happens to your information.

Register: you sign in and out on the day, so we can confirm you attended the full session.
CPD certificate: if you ticked the CPD certificate box when booking, we send your name, email address and attendance details to The CPD Certification Service after the workshop. They email you a link to download your certificate from their myCPD Portal. The CPD Certification Service handles your information under its own privacy policy (cpduk.co.uk).
Feedback, quizzes and assessment exercises: we use these to check the workshop is working and to meet CPD quality standards. We report results in summary form, not by name.
Action plan and 30-day review: these are optional. If you share them, we use them to see how the training helped and to reply to you.
Photos: we tell you at the start of the session if we plan to take photos. Tell a member of staff if you'd prefer not to be included.

We keep workshop records for three years (see How long we keep it).

Who we share it with

We never sell your information. We share it only with the organisations below, and only what each one needs.

The CPD Certification Service: name, email, course and attendance, for CPD-certified workshops only, to issue your CPD certificate.
Organisations that fund our programmes, such as East Sussex County Council (including the East Sussex Growth Hub) and the Royal Borough of Kensington and Chelsea: names, contact details, business details, attendance and equality monitoring answers for people taking part in the programme they fund, to report on funded programmes as our funding agreements require.
Wix.com: website, booking, form and email data, because Wix hosts our website, bookings and newsletters.
Microsoft: email and files, for our email and document storage (Microsoft 365).
Live polling tools we sometimes use in sessions, such as Slido or Mentimeter: your poll answers, and a nickname if you choose to enter one, to run live polls during workshops.
Professional advisers, regulators or police: only what is required, where the law requires it or to protect our legal rights.

Our suppliers act on our instructions under contracts that protect your information.

International transfers

Some of our suppliers, including Wix and Microsoft, may store or process information outside the UK. When they do, we make sure it is protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum. You can ask us for details of these safeguards.

How long we keep it

We keep information only as long as we need it, then delete it securely.

Workshop registers, feedback, quizzes, assessment exercises, action plans and 30-day reviews: 3 years after the workshop.
Record of CPD certificates issued: 3 years after the workshop.
Access needs: deleted after the session.
Funded programme records, including equality monitoring: as long as the funding agreement requires, then deleted.
Advice and coaching records: 6 years after our last contact with you.
Financial records: 6 years, as required by law.
Newsletter subscriptions: until you unsubscribe.
Photos used in our communications: up to 3 years, or until you ask us to remove them.

Your rights

You have the right to:

Ask for a copy of the information we hold about you
Ask us to correct anything that is wrong
Ask us to delete your information
Ask us to limit how we use it
Object to us using it on the basis of legitimate interests, or for marketing
Withdraw consent at any time, where we rely on consent
Ask us to transfer information you gave us to another organisation

To use any of these rights, email info@pbc.co.uk. We will reply within one month. There is normally no charge.

Cookies, changes and complaints

Cookies. Our website uses cookies. See our Cookie Policy (linked at the bottom of every page) for details and how to manage them.

Changes to this notice. We may update this notice from time to time. The date at the top shows when it was last changed.

Complaints. If you're unhappy with how we have handled your information, please contact us first at info@pbc.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.