Social Catalyst UK

Last updated: 8 July 2026

1. Who we are

Social Catalyst UK is the trading name of Antony Kendall, a sole trader providing information security and AI governance consultancy services, including online self-assessment tools.

For enquiries, website forms and our own online assessment tools, we act as the data controller. Where we process staff survey responses, interview notes or other personal data as part of a paid client engagement, our role may be controller or processor depending on the agreed scope of work. Where we act as a processor for a client, the relevant processing terms will be set out in our contract with that client.

Website: socialcatalystuk.com
Contact: antony@socialcatalystuk.com
ICO registration reference: C1978535

If you have any questions about this policy or how we handle your data, please contact us using the details above.

2. What this policy covers

This policy explains what personal data we collect, why, how long we keep it, and your rights, in connection with:

enquiries submitted through the contact page on our website;
our online information security and AI governance assessment tools, including organisational assessments and staff surveys;
report delivery, related service communications and follow-up;
website analytics, where you have accepted analytics cookies; and
client engagements where we provide consultancy, review or verification services.

3. Information we collect

Contact page

When you submit an enquiry through our contact page, we collect the details you provide, which may include your name, email address, organisation, phone number and the content of your message.

Online assessments

When you or your organisation complete one of our online assessments, we collect:

organisation name and, where provided, a named contact’s name, role, email address and phone number;
your responses to the assessment questionnaire, which relate to your organisation’s information security and AI governance practices. This is self-declared information about your organisation rather than about you personally, although it may include role details or identify the person who completed the assessment;
where used, a campaign reference code linking related submissions, such as an organisational assessment and staff survey responses; and
technical information generated automatically when you submit the form, such as timestamp and submission reference.

Staff surveys can be completed anonymously if your organisation chooses not to collect names. Where a link to a named contact or identifiable staff member is provided by your organisation, that person’s details are handled as set out in this policy or, where relevant, in our client contract.

Website analytics

If you accept analytics cookies, we may collect information about how you use our website through Google Analytics. This may include pages visited, approximate location, device and browser information, referral source, time spent on pages and interactions with the website. We use this information to understand and improve the website.

Client engagements

If we start a formal client engagement with you or your organisation, we may also collect information needed to provide the agreed service, such as contact details, meeting notes, documents, evidence supplied by the client, staff survey responses, interview notes and project communications. The exact data collected will depend on the agreed scope of work.

4. How we use your information and our legal basis

Purpose	What we do	Legal basis (UK GDPR)
Respond to enquiries	Reply to messages sent via the contact page	Legitimate interests — responding to enquiries you have made
Provide the assessment service	Store your submitted answers and contact details so we can generate and deliver your report	Performance of a contract / steps at your request; legitimate interests where no direct contract exists yet
Generate your assessment report	Send your submitted answers to an AI service to produce report text, which is then reviewed by Social Catalyst UK before release	Legitimate interests — delivering the core service you requested
Send report links and service notifications	Email you a secure link to your report and related service updates	Legitimate interests / performance of a contract
Website analytics	Use Google Analytics to understand website traffic and improve the website, where analytics cookies have been accepted	Consent
Keep records for the retention period	Retain submissions, reports and related records for the periods described below	Legitimate interests — allowing you to revisit your report and supporting our own record-keeping
Provide paid consultancy, review or verification services	Use information supplied by you or your organisation to deliver the agreed engagement	Performance of a contract / legitimate interests; or processor activity where we process personal data on a client’s instructions

We do not sell your data. We do not add you to a marketing mailing list unless you separately opt in.

5. AI processing of your assessment answers

To generate your assessment report, the answers you submit are sent to Anthropic’s Claude API, a third-party AI service. Anthropic processes this data to provide the service and generate report output. According to Anthropic’s commercial product information, inputs and outputs from the Anthropic API are not used to train Anthropic models by default.

Reports are generated using AI and then reviewed by Social Catalyst UK before release. They are based on the information submitted through the assessment and are not independently verified unless this is separately agreed as part of a paid review or verification service. They should therefore be treated as a human-reviewed initial assessment, not a formal audit.

6. How long we keep your information

Contact page enquiries: kept for as long as necessary to deal with your enquiry and for a reasonable period afterwards in case of follow-up, and no longer than 12 months unless an ongoing client relationship requires otherwise.
Assessment submissions and reports: stored for up to 12 months from submission, after which they are deleted from our active systems. Reports are accessible during this period via a unique, non-guessable link emailed to the named contact. Backup copies may remain for a limited period until overwritten or deleted in line with our backup processes.
Website analytics: retained according to our Google Analytics settings and only for as long as needed to understand and improve website performance.
Client engagement records: if we start a formal client engagement with you or your organisation, information relevant to that engagement may be kept for longer in line with normal business record-keeping requirements, such as contracts, invoices, project records and evidence of work completed.

7. Who we share your information with

We share personal data with the following categories of third-party service provider, who process it on our behalf under contract or in accordance with their service terms:

Anthropic (Claude API) — to analyse assessment answers and generate report text;
Brevo (email delivery platform) — to send transactional emails such as report links and notifications;
Google Analytics — to help us understand website traffic and how visitors use our website, where analytics cookies have been accepted; and
our website hosting provider — to store submissions and reports securely.

We do not share your information with any other third party for their own marketing purposes, and we do not sell personal data.

8. International transfers

Some of our service providers, including Anthropic and Google, may process data outside the UK/EEA, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, Standard Contractual Clauses, or an equivalent adequacy mechanism, to help ensure your data remains protected.

9. Security

We take reasonable technical and organisational measures to protect your information, including access controls and authentication on our administrative systems, restricted directory access on our server, use of reputable service providers, and deletion from active systems once the relevant retention period expires. No method of storage or transmission is 100% secure, but we work to protect your data appropriately for its sensitivity.

10. Your rights

Under UK GDPR, you have the right to:

access the personal data we hold about you;
ask us to correct inaccurate data;
ask us to delete your data, subject to any legal reason we may need to keep it;
object to or restrict certain processing;
request a copy of your data in a portable format; and
withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact antony@socialcatalystuk.com. We will respond within one month.

11. Data protection complaints

If you have a concern or complaint about how we handle your personal data, please contact us at antony@socialcatalystuk.com and mark your message “Data protection complaint”.

We will acknowledge receipt of your complaint within 30 days, take appropriate steps to investigate it, and tell you the outcome without undue delay. If you remain unhappy, you have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

12. Cookies and analytics

Our website uses cookies and similar technologies.

We use strictly necessary cookies where required to operate secure or password-protected areas of the site. These cookies are essential for the website to function properly and do not require consent.

We also use Google Analytics to understand how visitors use our website, such as which pages are visited, how users move around the site, and how the site is performing. Google Analytics may use cookies or similar technologies to collect information such as device, browser, approximate location, pages visited, time spent on pages and referral source.

Google Analytics cookies are not strictly necessary, so they will only be set if you give consent through our cookie banner. You can accept or reject analytics cookies when you first visit the site, and you can change your preferences later.

We do not use Google Analytics for advertising, remarketing or personalised advertising unless this policy is updated and appropriate consent is obtained.

13. Children

Our services are intended for use by organisations and working professionals. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy from time to time, for example if our services, website tools or third-party providers change. The “last updated” date at the top of this page shows when it was last revised. We encourage you to check back periodically.

15. Contact us

Social Catalyst UK

Email: antony@socialcatalystuk.com

Website: socialcatalystuk.com

ICO registration reference: C1978535