Privacy Policy

Last updated: 19 April 2026

This Privacy Policy explains how B2B Growth Hub Limited ("we", "us", "our") collects, uses, stores, and protects personal data when you use the B2B Growth Expo mobile application and the accompanying admin platform (together, the "Service"). By using the Service you agree to the practices described below.

1. Who we are

B2B Growth Hub Limited is the operator of the Service and the data controller for personal data processed through it.

Registered in England & Wales, company number 13818816
Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: [email protected]

2. Personal data we collect

We collect the following categories of personal data:

Account data — first name, last name, email address, phone number, password hash, and the event(s) you are registered for. Most of this is synced from the event organiser (for example, via Eventbrite) when you register for an event.
Lead-capture data — when you scan another attendee’s business card (QR code, MECARD, or vCard), we store the contact details contained in that code (name, email, phone, company, job title), a timestamp, the event, an optional location label, an optional device identifier, and any notes you choose to add.
Usage data — last login time, API request logs, audit logs of admin actions, and basic error telemetry.
Device data — device identifier you choose to supply during scans, and standard request metadata (IP address, user agent) logged by our hosting provider.

3. How we use your data

To create and secure your mobile-app account.
To let you scan, save, annotate, and export the leads you collect at an event.
To let the event organiser and their authorised admin staff see attendance and scanning activity for the event you registered for.
To provide customer support and respond to your enquiries.
To keep the Service secure (abuse prevention, audit trails, rate limiting).
To meet legal and regulatory obligations.

4. Legal basis for processing (UK GDPR / EU GDPR)

Contract — processing necessary to provide the Service you signed up for.
Legitimate interests — keeping the Service secure, preventing fraud, improving features.
Consent — where you explicitly agree, for example when you choose to scan and save a contact’s details.
Legal obligation — where we are required by law.

5. Sharing and disclosure

We share personal data only with:

The event organiser whose event you registered for, and their authorised admin users, so they can run the event.
Service providers we rely on to run the platform: hosting (Vercel), database (managed MySQL), and the registration source (Eventbrite). These providers act as processors bound by contract.
Authorities if required by law, court order, or lawful regulatory request.

We do not sell your personal data.

6. International transfers

Our infrastructure providers may process data outside the UK / EEA (for example, in the United States). Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum.

7. Retention

We keep personal data for as long as your account is active and for the duration of the event you registered for. Lead-scan data is kept for the duration of the event plus a reasonable period afterwards so that you can export your leads. Audit logs and security logs are kept for up to 24 months. After that, data is deleted or anonymised.

8. Your rights

Under UK / EU data-protection law you have the right to:

Access the personal data we hold about you.
Correct data that is inaccurate or incomplete.
Request deletion of your data.
Restrict or object to certain processing.
Port your data to another service in a machine-readable format.
Withdraw consent at any time, where we rely on consent.
Lodge a complaint with your supervisory authority (in the UK, the Information Commissioner’s Office, ico.org.uk).

To exercise any of these rights, email [email protected]. We respond within one month.

9. Security

Passwords are hashed with bcrypt. Session tokens and mobile JWTs are signed with secure secrets. Transport is secured with HTTPS. Access to the admin platform is role-based and every change is written to an audit log. No system is 100% secure — if you suspect your account has been compromised, contact us immediately.

10. Camera usage

The mobile application requires access to your device camera solely for scanning QR codes during event check-ins and networking activities. No photos or videos are captured, stored, or shared at any time.

11. Additional data usage clarification

We only collect limited user information such as your name, email address, and event-related details strictly to deliver and improve the Service. All collected data is used exclusively for application functionality, including event participation and networking features. Your information is never sold and is not shared with third parties for marketing purposes.

12. Children

The Service is intended for business use at industry events and is not directed at children under 16. We do not knowingly collect data from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date above and, if the changes are material, notify you through the app or by email.

14. Contact

Questions, requests, or complaints about this policy: [email protected].