CEO Hub Privacy Notice
Last updated: 25 September 2026.
Who is responsible
CEO HUB LTD, trading as CEO Hub, is responsible for the personal information used to operate CEO Hub. Our address is Suite 95, 95 Wilton Road, London, SW1V 1BZ, United Kingdom. For privacy questions, rights requests or complaints, email support@ceohub.com, write to our registered office, or use the Contact page and identify your message as a privacy request. Company number: 13662399.
This notice describes the platform’s accounts, community, courses, events, support and commerce features. Independent sellers and external services may have their own notices for processing they control.
Information we use and where it comes from
- Account and profile information: your name, email, username, account roles, password hash, optional profile image, biography and details you choose to add. If you enable two-factor authentication, we store the protected setup information needed to verify codes.
- Google sign-in: if you choose it, Google supplies account identifiers and permitted profile details such as your name, email and image. We do not receive your Google password.
- Learning and community activity: joined hubs, enrolments, lesson progress, posts, comments, messages, files, saved items and activity associated with your account.
- Transactions and commercial activity: the product or plan, payment amount and currency, status and payment-provider references, plus relevant order, seller, booking or dispute information. Card entry is handled by the payment provider; do not send card numbers through posts or support messages.
- Support and safety: questions, feedback, reports and correspondence. Another user may provide information about you when reporting an interaction or arranging a transaction.
- Technical information: request and security logs, network identifiers such as IP addresses, browser information, session cookies and information necessary to operate and protect the service.
Required fields are indicated when you register, purchase or use a feature. Without necessary contact, authentication or payment information, we may be unable to supply that feature. Optional profile content can be omitted.
For age eligibility, we check the date of birth you declare and retain the over-18 outcome, method and confirmation time, alongside the exact terms and privacy versions you acknowledged. We do not store your full date of birth in your account or the acknowledgement record. The check is self-declared, not independent identity verification. These records help administer the adult-only service and evidence the terms of our relationship.
Why we use it
| Purpose | Information involved | UK data protection basis |
|---|---|---|
| Create and manage an account; deliver membership, learning and communications features you request | Account, profile, membership and learning activity | Performance of our contract with you or steps requested before a contract |
| Process orders, billing and support | Contact, order, payment references and correspondence | Contract; legal obligations where accounting or other retention is required |
| Prevent abuse, investigate reports, secure accounts and resolve disputes | Relevant account, content, transaction and technical records | Legitimate interests in a secure, reliable service and the protection of users; legal obligations where applicable |
| Maintain and troubleshoot the platform | Technical records and relevant feature activity | Legitimate interests in maintaining a functioning service |
| Optional marketing or optional device technologies that require permission | Relevant contact details or device information | Consent where required; any different permitted basis must be explained when used |
We consider the impact on users when relying on legitimate interests. You can object to this use. Service and security messages are distinct from optional promotional communications.
Who can see information
Profile information and material you post may be visible to the audience of the feature you use. Messages are available to their participants and may be accessed by authorised staff when necessary to provide support, investigate abuse or meet legal requirements. Do not assume a public profile or shared file is confidential. Other users may retain copies of material you share with them.
We use service providers for hosting, payments, email delivery and technical operations. The current implementation uses Hostinger hosting, Stripe payment services and optional Google sign-in. Live meetings and externally hosted media involve the provider identified when the feature is opened. Hostinger also provides the configured email delivery service. External fonts, icons and software assets are delivered by providers such as Google Fonts, jsDelivr and unpkg; these providers receive the network information needed to deliver their resources.
We disclose relevant information to a seller or buyer where needed for an order or enquiry you initiate, and to professional advisers, authorities or another party where necessary and lawful for obligations, claims or a business transfer. We limit disclosure to the purpose concerned. External providers may also act as independent controllers for their own payment, fraud-prevention or account services.
International processing
Online service providers may process information outside your country. Where UK GDPR or EU GDPR transfer restrictions apply, an appropriate transfer mechanism is required, such as a relevant adequacy decision or approved contractual safeguards with any necessary supplementary measures. Stripe describes transfers to the United States and other processing locations in its Data Processing Agreement, with transfer provisions in its Data Transfers Addendum. Google describes its international processing in its Privacy Policy. We do not represent that all service data remains in the United Kingdom. You can contact us for information about the safeguards applicable to your data; confidential commercial information may be redacted.
How long information is kept
We assess retention by the purpose of the record, whether your account or transaction is active, applicable accounting and other legal obligations, unresolved complaints or claims, and security needs. Account and learning records support your continuing access. Transaction and dispute records may need to remain after account closure. Public or shared contributions may remain where needed to preserve a conversation or another person’s rights, with identification removed where appropriate.
Request account closure or deletion through the privacy contact. We will assess what can be removed and explain any necessary exceptions. Deleted information may remain in restricted backups until those backups are overwritten or expire. We do not promise immediate erasure from every backup or from copies held independently by other users. You can ask for the retention information applicable to a particular record.
Cookies, storage and external content
CEO Hub uses session and authentication cookies and anti-forgery tokens for sign-in and secure forms. Browser storage may also retain preferences and interface state. Blocking necessary cookies may stop sign-in or other requested features from working.
External video, meeting and payment services can receive technical information when loaded and may use their own storage technologies. Optional tracking must use the applicable consent or exception rules; browser cookie controls alone are not a substitute for consent where it is required. Some media pages currently load third-party players when opened. Those providers may use their own cookies and collect your IP address and browser information. You can restrict cookies through your browser and choose not to open external media; restricting cookies can affect functionality. This notice is information about processing, not a request for blanket consent.
Your choices and rights
Depending on the applicable law and processing basis, you can request access, correction, deletion, restriction or a portable copy of your personal information. You can withdraw consent without affecting processing that was lawful before withdrawal. Some rights have legal exceptions; we will explain any that affect a request.
You can object to processing based on legitimate interests. You can object to use of your information for direct marketing at any time. Use the privacy contact or an available unsubscribe control. A marketing objection does not prevent necessary account or transaction messages.
We may need proportionate information to verify identity before disclosing account data. Under UK GDPR, rights requests are normally handled within one month, with lawful extensions or other qualifications where applicable. Tell us if you need an accessible way to make a request.
You can complain to us and, where relevant, to the UK Information Commissioner at https://ico.org.uk/make-a-complaint/ or your local data protection authority. You do not have to give up that right to use CEO Hub.
Automated decisions, children and changes
The platform uses automated rules for access, payment status, security checks and activity features. It is not designed to make solely automated decisions with legal or similarly significant effects such as lending or employment decisions. If an access decision appears incorrect, contact support for review.
CEO Hub is intended for an adult business and learning audience, and account access, purchases and selling activity are restricted to people aged 18 or over under our terms. We do not ask users to provide children’s information. Contact us if you believe a child has supplied information contrary to the service’s eligibility rules.
We will update this notice when our processing changes and communicate material changes appropriately. The publication date and operator details will appear at the top of the published notice.