Privacy policy

Who we are

Ensemble provides training for engineering teams. For anything in this policy, email us at [email protected].

What we collect and why

When you send an enquiry: your name, work email, company, role, the programme, package, delivery mode and headcounts you tell us about, your region and time zone, your preferred timeframe and your message. We also record the wording of the consent you gave and when, the page you came from, and the country and region your connection appears to be in. We use this to reply to your enquiry and to arrange training. Our basis is your consent, and our legitimate interest in responding to people who ask us about our services.

When you register interest in a coming-soon course: your email, optional name and company, the course, your region, and the wording and time of your consent. We use this to tell you when that course launches, and only once you have confirmed your address by following the link we send. Our basis is your consent.

When you book a discovery call: your name, email and the time you chose, which our scheduling provider passes to us so that we can link the booking to any enquiry you sent.

If you accept analytics: which pages you view and which actions you take on the site, such as changing region or opening a package. These events never include your name, email, company, role or message. If you accept analytics and also send an enquiry, we store your analytics identifier with the enquiry, so we can see how visitors who enquire used the site. If you decline, no analytics run, and everything on the site still works.

To protect our forms from spam, we use Cloudflare Turnstile, which runs when you start using a form. We treat this as strictly necessary for a form you have chosen to use. We also keep a keyed hash of your connection’s IP address for a short time to limit repeated submissions.

Your region and consent choices are kept in your own browser’s storage, so that we can remember them. They are not sent to us.

Who processes your data

• Encore Cloud runs our backend service. Hosting region to be confirmed before launch.
• Neon hosts our database, in London.
• Cloudflare hosts this site, runs Turnstile and stores our encrypted database backups.
• GitHub runs the job that makes our nightly backup, which handles the data before it is encrypted.
• Google hosts the mailbox that receives enquiries by email.
• Postmark sends our email, and stores data in the United States.
• Cal.com runs our discovery-call booking, in the United States.
• PostHog records analytics in the European Union, for visitors who accept them, with IP addresses discarded.

Our alerting service receives only opaque identifiers and never personal data.

Transfers outside the UK

Postmark and Cal.com process data in the United States. These transfers rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the International Data Transfer Agreement.

How long we keep it

• Enquiries: 24 months after our last contact with you, unless you become a client.
• Client records: 6 years after our last engagement with you.
• Discovery-call bookings: with the enquiry they are linked to, or 24 months after the call if there is none.
• Coming-soon registrations: until you withdraw, or 12 months after that course launches or is dropped.
• Unconfirmed registrations: 30 days.
• Submissions held as suspected spam: 30 days.

If you withdraw from a coming-soon list, we delete your registrations and keep only a keyed hash of your address, indefinitely, so that we do not contact you again. Encrypted backups persist for up to 30 days after data is deleted.

Your rights

You can ask for a copy of your data, or ask us to correct or delete it, by emailing [email protected]. You can withdraw from a coming-soon list using the link in any email we send about it, and you can change your analytics choice at any time using the link in the footer of this site. You can also complain to the Information Commissioner’s Office.