Privacy notice

Stellar Excellence Ltd is responsible for your personal information when we decide why and how it is used. Company number: 17411629.

Registered office: Suite RA01, 195–197 Wood Street, London, E17 3NU.

For privacy questions, requests or complaints, email hello@stellarexcellence.com or write to our registered office marked “Privacy”.

• Enquiries: name, email, company where supplied, message and correspondence.
• Programme and booking arrangements: organiser name, company, role, email, optional phone and notes, sector, place count, preferred timing or month, booking reference, allocated date, booking status and terms acceptance.
• Payments: payer-link labels, places, amounts, currency, payment identifiers, payment/refund status and payer email for receipts. An organiser’s link label may identify a colleague.
• Attendance: relevant delegate contact and attendance arrangements supplied by you or your employer or company organiser. The shared-booking form collects place counts rather than a list of delegate names.
• Website security and operation: IP address, browser/device information, request times, page or resource requests and technical errors available to the services serving the site.
• Private owner access: owner email, account identifier, access role and authentication/session information. Delegates do not need an account.

Information comes from you, your employer or organiser, people dealing with a booking on your behalf, and Stripe for payment outcomes. Where an employer supplies your details, we provide privacy information at the first relevant communication or disclosure, or within one month where applicable.

Stripe collects payment-method and any required billing details directly. Our app does not receive or store full card numbers or card security codes. Please do not send card details through our forms or email. Our forms do not request sensitive personal information; contact us first if an attendance adjustment needs it.

• Business enquiries and company workshops — legitimate interests. We use relevant contact, company and attendance details to respond to requests, arrange and deliver workshops and administer the business relationship. An employer’s contract does not make its employees individual contracting parties.
• Individual contracting parties — contract. Where you contract personally, including as a sole trader, we use the information necessary to take steps you request before contracting and perform your contract.
• Payments, cancellations, transfers and refunds — contract or legitimate interests. Contract applies to necessary processing for an individual party; otherwise our interest is administering the company’s booking and payments.
• Accounting and legally required disclosures — legal obligation. We keep the necessary financial and identifying records required by applicable tax/accounting law and respond to binding legal requirements.
• Security, error investigation and legal claims — legitimate interests. We protect accounts, payment links, customers and our business, investigate misuse and establish or defend claims. Legal obligation applies to specific required action.
• Owner-led allocation planning — legitimate interests. Advisory AI helps the owner plan paid places against dates and capacity. The owner makes the final decision.
• Privacy requests and complaints — legal obligation. We use the information needed to identify and respond to your request.

We weigh our legitimate interests against your interests and rights. Core enquiry, booking and payment administration is not based on consent. We currently use no CRM, newsletter service or client spreadsheet.

Contact enquiries require name, email and message so we can respond; company is optional. Private-programme enquiries require name, company, role, email, sector, delegate count and preferred timing to describe the requested work. Shared bookings require organiser name, company, role, email, place count, preferred month and acceptance of booking terms and business authority. Phone and additional notes are optional.

Required fields must be completed to submit the relevant form. Without sufficient contact or booking details we cannot arrange the requested service; without information Stripe requires, payment may not complete. These are service requirements rather than a general legal duty on you to provide information. Invoice/accounting information may be required by law where applicable.

Our authorised owner uses relevant information. Where needed for delivery, a facilitator, venue or professional adviser may receive only the information needed for their role. A company organiser can see their booking and payer-link labels and statuses. Payer links do not display the organiser’s contact details or other payers’ personal information. Keep organiser links private.

• Lovable operates our app hosting, managed database and authentication, transactional email and payment/AI connections. Its infrastructure includes Supabase for database/authentication and Cloudflare for global edge hosting and assets. Managed email and AI can involve its delivery and inference subprocessors. Lovable’s subprocessor list describes its platform providers; not every listed service receives this site’s information.
• Microsoft 365 hosts our business email and related correspondence.
• Stripe provides payment checkout and processing. It acts as a processor for some activities and a separate controller for activities such as legal compliance and fraud prevention. Banks, card networks and other payment participants receive necessary transaction information. See Stripe’s privacy information.
• Google Fonts receives browser requests for the fonts used by the site, including technical request information.

We may also disclose necessary information when required by law or to establish, exercise or defend legal claims.

Our providers operate internationally. Information may be processed in Europe, the United States and other locations used for global hosting, delivery, support and inference. A database location does not determine the location of all emails, logs, support access or AI requests.

Published provider terms describe mechanisms for relevant international transfers: Lovable’s DPA includes EU Standard Contractual Clauses with the UK International Data Transfer Addendum; Microsoft’s DPA describes contractual transfer provisions; and Stripe’s transfer terms describe Data Privacy Framework coverage for eligible transfers and contractual alternatives, including UK provisions.

Which mechanism applies depends on the provider entity, destination and applicable agreement. These published terms do not establish coverage of every transfer for our account. We do not claim that all information stays in the UK or EU. Contact hello@stellarexcellence.com for information about relevant destinations and safeguards, or to request a copy of applicable safeguards, with confidential details redacted where appropriate.

• Enquiries: 12 months after the last substantive contact, unless a booking or continuing matter requires relevant information longer.
• Routine delegate arrangements: 12 months after delivery or final cancellation/refund resolution.
• Necessary contract and dispute evidence: six years after completion, retaining only the necessary evidence. An unresolved legal matter may require a longer hold.
• Finance records: generally six years from the relevant financial year-end, longer where required by law or an ongoing tax enquiry.
• Inactive unpaid requests: reviewed after 90 days of inactivity. This is a review point. Active or future workshops, ongoing discussions and payment arrangements are retained.

The owner reviews records monthly across the database and Microsoft 365 and manually decides what can be deleted or anonymised. Records are not automatically purged. We check ongoing arrangements, payments, refunds, disputes and legal duties before removing information, and keep only the necessary subset for longer-term evidence.

Owner-account information is retained while access is authorised, with necessary security records retained for their purpose. Provider-controlled security logs, delivery records and backups follow the provider’s applicable retention rules; removal from an active system may not immediately remove protected backups. We retain relevant incident evidence and minimum suppression information where needed to protect the service and prevent unwanted sending.

The site uses session storage to remember scroll position. Owner sign-in uses authentication/session storage. Stripe’s payment interface and associated security services may use cookies or similar technologies when loaded. Google-hosted fonts make direct browser requests.

We have not added advertising pixels, session replay or a dedicated visitor analytics service to this app. Hosting and security providers process technical requests and errors to operate the service. This does not mean every provider interface is cookie-free.

The owner can request allocation suggestions through Lovable’s AI connection using an OpenAI-labelled model. The request includes booking identifier, company, delegate count, preferred month and date/capacity data. It excludes organiser name, email, phone, notes and card details. A company name can identify a sole trader.

The owner reviews suggestions and capacity is checked before saving. AI does not independently confirm bookings. The app makes no solely automated allocation decision with legal or similarly significant effects. We do not claim zero provider retention or a particular inference location. You can contact us to discuss an allocation or concern. Stripe’s own risk processing is described in its privacy information.

Depending on the circumstances and lawful basis, you can request access, correction, erasure or restriction of your information. Erasure is conditional; necessary legal records and claims evidence may need to be retained. Portability applies to information you supplied where automated processing is based on consent or your own contract and the conditions are met.

You can withdraw consent where we actually rely on it, without affecting earlier lawful processing, and exercise applicable rights concerning solely automated significant decisions if such processing applies.

Contact hello@stellarexcellence.com. You do not need an account. We may request proportionate identification or clarification to protect your information. We respond within applicable legal time limits and explain any lawful extension or refusal. Requests are handled manually across relevant systems.

You can object to processing based on legitimate interests for reasons relating to your particular situation. Email hello@stellarexcellence.com and tell us which processing concerns you. We must stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims.

If your information is used for direct marketing, you can object at any time and that processing must stop.

Raise a concern with hello@stellarexcellence.com or write to our registered office marked “Privacy complaint”. We consider complaints and respond under applicable law.

You can also complain to the UK regulator, the Information Commissioner’s Office (ICO). Contacting us does not remove this right.

We review this notice when our services, providers or use of information changes. The update date appears above. Where needed, we tell affected people about material changes before new processing begins.