Privacy Policy & Data Protection Notice

Last Updated: October 13, 2026

1. Data Controller Information

STCnet (“we”, “our”, or “us”) operates the STCnet Consultant Network platform. For the purposes of the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and international privacy regulations, the Data Controller is STCnet Consultant Network. For data protection inquiries or to exercise your rights, contact our Data Privacy Desk at [email protected].

2. Information We Collect

We collect and process personal data strictly required to facilitate professional peer matching, consortium formation, and community discussions:

  • Authentication & Identity Data: Managed via Clerk (OAuth/JWT), including your full professional name, verified email address, avatar image, and unique user identifier (UID).
  • Consultant Profile Data: Information voluntarily submitted to our directory register via Airtable, including thematic sector practices, methodologies, countries of experience, country of residence, professional biography, and project availability.
  • Teaming & Opportunity Expressions: Voluntary expressions of interest submitted on specific RFPs or notices, including proposed role notes and contact preferences.
  • Technical & Session Data: Access logs, IP addresses, browser user agents, and cryptographic nonces used strictly for security monitoring and single sign-on (SSO) authentication with the Discourse community forum.

3. Legal Bases for Processing (GDPR Article 6)

We process your personal information under the following legal bases:

  • Performance of Contract (Art. 6(1)(b)): To manage your member account, enable searchability in the consultant directory, and authenticate your access to community forums.
  • Legitimate Interests (Art. 6(1)(f)): To maintain network integrity, prevent spam or unauthorized automated scraping, verify member credentials, and safeguard consultant PII.
  • Consent (Art. 6(1)(a)): For voluntary publication of specialized credentials, opt-in profile suggestions on project callouts, and discretionary community participation.

4. Data Safeguarding & PII Protection

We enforce strict architectural controls to protect independent consultants' sensitive data:

  • Email & UID Masking: Member email addresses and internal system IDs (`clerk_uid`) are strictly hidden from public directory views and search filters.
  • No Automated Public Tagging: Consultants are never publicly branded onto bidding proposals or opportunities without explicit voluntary opt-in.
  • Export Prohibition: Bulk data export (CSV/Excel downloads) is disabled across public and shared directory views to prevent member poaching and unsolicited marketing.

5. Authorized Subprocessors

We share data exclusively with trusted technical infrastructure providers bound by rigorous Data Processing Agreements (DPAs):

  • Clerk Inc. (USA / EU): Authentication, identity management, and session tokens.
  • Airtable / Formagrid Inc. (USA): Secure database records and encrypted form processing.
  • Cloudflare Inc. (Global): Content delivery, SSL/TLS encryption, and Edge API middleware.
  • Discourse: Secure, hosted community forum software.

6. Your Data Subject Rights (GDPR / UK DPA)

Under applicable data privacy laws, you possess comprehensive rights regarding your personal data:

  • Right of Access (Art. 15): Request a copy of the personal data we hold about you.
  • Right to Rectification (Art. 16): Update or correct your profile data at any time via the "My Profile" dashboard.
  • Right to Erasure ("Right to be Forgotten", Art. 17): Request complete deletion of your account, authentication records, and directory listings.
  • Right to Data Portability (Art. 20): Obtain your submitted data in a structured, commonly used format.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner's Office - ICO).

7. Data Retention & Deletion

Your profile information is retained for the active duration of your network membership. Upon receiving an account closure or erasure request at [email protected], all identifying personal data across Clerk authentication and Airtable directories will be permanently purged within thirty (30) business days.