Privacy Policy

UPUBLIC Ltd (trading as UPUBLIC and The Interpreting Hub)

Last updated: September 2026

This notice explains how UPUBLIC Ltd collects, uses and protects your personal data when you visit our website (www.upublic.ltd), get in touch with us, sign up for updates, or use our services — including through our sub-brand, The Interpreting Hub. It applies across all pages and services operated by UPUBLIC Ltd, including any future services, once live.

This notice is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are (the data controller)

UPUBLIC Ltd is the data controller responsible for your personal data.

Company name: UPUBLIC Ltd
Company number: NI738541 (registered in Northern Ireland)
Registered address: 48 Bachelors Walk, Lisburn, Co. Antrim, BT28 1XN
Contact email: info@upublic.ltd
ICO registration reference: C1982420

If you have any questions about this notice or how we handle your data, please contact us using the details above.

UPUBLIC Ltd has assessed that it is not required to appoint a Data Protection Officer.

2. What personal data we collect

Depending on how you interact with us, we may collect:

Full name — from signup forms, contact emails, course enrolment, coaching bookings, and when you create an account on The Interpreting Hub
Email address — from signup forms, contact emails, course enrolment, coaching bookings, and when you create an account on The Interpreting Hub
Account password — stored only in encrypted (hashed) form; we cannot see or recover your actual password
Comments or questions you submit — from The Interpreting Hub signup form
Course or coaching preferences (e.g. session type) — from the coaching booking form (once live)
Purchase records — which courses or resources you've bought or been granted access to, and the order amount and date, when you use The Interpreting Hub
Gift recipient details (name and email address) — only if you choose to buy a course or resource as a gift for someone else
Correspondence you send us — email, contact forms
Technical data (e.g. IP address, browser type, pages visited) — only applicable if you use analytics/cookies, see Section 9

We do not knowingly collect any special category data (e.g. health, ethnicity, religion).

Payment data: when you pay for a course or resource, your card details are entered directly into our payment processor Revolut's own secure checkout page. We do not receive, see, or store your full card number, expiry date, or security code on our own servers — see Section 5 for Revolut's role as a data processor.

We do not knowingly collect personal data from children.

3. Why we collect it, and our lawful basis

To send you updates about The Interpreting Hub's launch, courses, and offers — Consent (Article 6(1)(a)), you actively opt in via the signup form
To respond to your enquiries or comments — Legitimate interests (Article 6(1)(f)), to communicate with people who contact us
To administer your enrolment on a course, or a coaching booking — Contract (Article 6(1)(b)), necessary to provide the service you've requested
To meet our legal and regulatory obligations (e.g. accounting records) — Legal obligation (Article 6(1)(c))
To improve our website and services — Legitimate interests (Article 6(1)(f)), balanced against your rights; kept to a minimum

Where we rely on your consent (such as for marketing updates), you can withdraw it at any time — see Section 6.

4. How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected:

Signup/marketing list data (name, email, comments): kept until you unsubscribe or withdraw consent, whichever is sooner.
Course or coaching enrolment records: kept for 6 years after completion, in line with standard UK business record-keeping practice (matching the statutory limitation period for contract-related claims, and HMRC's minimum record-keeping requirement for tax purposes).
General correspondence: kept for 10 years, then deleted or anonymised.

5. Who we share your data with

We do not sell your personal data.

We may share personal data with:

FLEX Language Services Ltd (Belfast) — our delivery partner for the accredited Community Interpreting course, where necessary to administer joint course delivery.
Brevo (Sendinblue SAS) — our email service provider, used to send transactional emails (e.g. course access and gift notifications) and updates to the mailing list you sign up to.
Revolut — our payment processor, used to take payment when you buy a course or resource. Revolut receives and processes your card details directly on their own checkout page; we only receive confirmation that payment was made, together with the amount and a reference number.
DigitalOcean — our hosting provider. Our website, database, and file storage run on DigitalOcean's infrastructure, so all personal data we hold passes through their servers.
Professional advisers (e.g. accountants, legal advisers) where necessary, and regulators or law enforcement where we are legally required to do so.

International data transfers

Brevo is a French company that processes and stores email data within the EU (France, Germany, and Belgium). The EU is recognised as offering an adequate standard of data protection under UK GDPR, so no additional safeguard is required for this transfer.

The DigitalOcean servers that host our website, database, and file storage are physically located in the UK (London). DigitalOcean itself is a US-headquartered company; where this means personal data is accessible from outside the UK for hosting and support purposes, that transfer is covered by DigitalOcean's standard data processing terms, which include the UK Addendum to the EU Standard Contractual Clauses.

Where we use any other provider based outside the UK, in a country that does not have a UK "adequacy" decision, we will only transfer personal data there where an appropriate safeguard is in place, such as:

the destination country having a UK adequacy regulation confirming it offers an equivalent standard of data protection, or
the transfer being covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or
another transfer mechanism recognised under UK GDPR as providing an adequate level of protection.

6. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Rectification of inaccurate or incomplete data
Erasure ("the right to be forgotten"), in certain circumstances
Restrict or object to our processing of your data
Data portability — receive your data in a portable format, where applicable
Withdraw consent at any time, where we rely on consent (e.g. unsubscribe from updates at any point, with no effect on the lawfulness of processing before withdrawal)
Complain to the ICO (see Section 7) if you believe we have not handled your data properly

To exercise any of these rights, contact us at info@upublic.ltd. We will respond within one month, as required by law.

7. How to complain

If you have concerns about how we've handled your personal data, please contact us first at info@upublic.ltd so we can try to resolve it directly.

You also have the right to lodge a complaint with the UK's data protection regulator:

Regulator: Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

8. Keeping your data secure

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including:

All traffic to and from our website is encrypted in transit (HTTPS/TLS).
Passwords are never stored in plain text — only in a one-way encrypted (hashed) form that cannot be reversed.
Card payment details are handled entirely by our payment processor, Revolut, on their own secure checkout page — we never receive or store your full card details.
Our servers are only accessible to authorised administrators using key-based authentication, not passwords.
Our database is backed up on a regular automated schedule, with backups held under the same access controls.
Access to personal data within our own systems is limited to what's needed to run the service.

9. Cookies

We use Plausible Analytics to understand how visitors use our website — page views, referrers, and general traffic trends. Plausible is cookieless: it doesn't use cookies or any other persistent identifiers, and doesn't collect or store any personal data about you, so no cookie consent banner is required. You can read more about how Plausible works in their own privacy policy.

10. Changes to this notice

We may update this notice from time to time, for example as our services develop (including the launch of The Interpreting Hub in full, and In Whisper). The "last updated" date at the top of this page will always reflect the most recent version.