Privacy policy
Last updated 9 September 2026
1. Identity of the Data Controller
This privacy policy ("Policy") governs the processing of personal data carried out through the website located at https://www.builtwithskills.com (the "Website") and the community operated on the Circle platform at https://builtwithskills.circle.so (the "Community").
The data controller, within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR") and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD"), is constituted jointly by Mr. Jethro Pickering and Ms. Heidi Hein, trading as "Built With Skills" (jointly, the "Controller", "we" or "us"). Ms. Hein carries on this activity as a self-employed individual (autónomo) under Spanish law. No separate corporate entity has been incorporated in connection with this activity.
Contact e-mail: hello@builtwithskills.com. A registered business address and tax identification number have not been published on the Website at the date of this Policy; either will be supplied to any data subject who requests them for the purposes of exercising their rights or entering into a paid engagement with us.
Given the scale of the processing described in this Policy, the appointment of a Data Protection Officer under Article 37 GDPR is not mandatory, and none has been appointed. Any communication that would ordinarily be addressed to a Data Protection Officer should be sent to the e-mail address above.
2. Scope of this Policy
This Policy applies to personal data processed in connection with: (a) browsing the Website; (b) joining or using the Community; and (c) any correspondence sent to us directly. It does not govern the processing carried out by Circle, Vercel, Google, YouTube, Vimeo, or any other third party once you leave the Website or interact with their own services, which is governed by their respective privacy policies, referenced in Section 6 below.
3. Categories of personal data processed
- Data you type into a form on this Website. The contact form and the Built booking form do not transmit anything to a server as you type. Submitting either builds an e-mail in your own browser and hands it to your e-mail application; the data reaches us only once you actually send that e-mail, at which point it is processed as correspondence, described below. The Built booking form asks for your name, e-mail address, which version of Built you want, whether you have a domain, and a short description of your business.
- Data collected on Circle's domain. Any function that requires an account (joining the Community, signing in) is performed on Circle's own domain, so you are able to identify the party collecting your data before you provide it.
- Data collected through Circle. Where you join the Community, Circle collects and holds your name, e-mail address, and any content you post, on our behalf as the entity responsible for the Community's contents.
- Browsing and device data. Google Analytics processes your IP address, browser type, device type and the pages you visit, by means of cookies described in our cookie policy. Google Search Console processes aggregated indexing and query data relating to the Website that does not identify individual visitors.
- Server log data. Vercel, as hosting provider, processes the technical data inherent to any HTTP request (IP address, browser, requested resource) for the purposes of delivering the Website and maintaining its security.
- Correspondence. If you contact us by e-mail, we process the content of that communication and your e-mail address for the purpose of responding to you.
Where you book Built, performing that engagement requires further data beyond the booking form: your answers to the intake questionnaire, and, where relevant, access to your domain registrar or hosting account so that we can deploy the site and configure DNS on your behalf. Access credentials shared for that purpose are used solely to perform the engagement and are deleted once it is complete, unless you ask us to retain them for ongoing work. Should we introduce a further paid coaching service or Pro, the same principle will apply, and this Policy will be updated to describe any additional category of data before it is collected.
4. Purposes and legal basis for processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing access to the Community and its contents | Performance of a contract (Art. 6(1)(b)) |
| Responding to correspondence sent to us | Legitimate interest in dealing with enquiries (Art. 6(1)(f)) |
| Maintaining server logs for security and abuse prevention | Legitimate interest in the security of our systems (Art. 6(1)(f)) |
| Measuring Website traffic through Google Analytics | Consent (Art. 6(1)(a)), obtained as described in Section 5 |
| Performing a Built engagement, or any future coaching or done-for-you Service | Performance of a contract (Art. 6(1)(b)) |
No processing described in this Policy involves automated decision-making or profiling producing legal effects concerning you or similarly significantly affecting you, within the meaning of Article 22 GDPR.
5. Cookies
The Website uses cookies. Full details of the cookies used, their purpose, duration, and how to withdraw your consent to them, are set out in our cookie policy, adopted pursuant to Article 22(2) of Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce ("LSSICE"). Where a cookie is not strictly necessary for the Website to function, its use is based on your consent, which you are free to withdraw at any time by the means described in that policy.
6. Recipients of personal data
We do not sell, rent, or otherwise disclose your personal data to third parties for their own marketing purposes. The following recipients process personal data on our behalf, or in their own capacity as controller of the platform you access through the Website:
| Recipient | Role | Data processed |
|---|---|---|
| Vercel Inc. | Processor. Hosting of the Website | Server logs: IP address, browser, requested resource |
| Circle Systems, Inc. | Independent controller of the Community platform, processor in respect of the €1/month subscription | Account details, community content, subscription and payment data |
| Google LLC | Processor (Analytics) and independent source (Search Console) | IP address, browser, device and pages viewed (Analytics); search terms and click data from Google's own index (Search Console) |
| YouTube (Google LLC) / Vimeo, Inc. | Independent controller, engaged only once a video is played | IP address and cookies, from the moment of playback |
7. International data transfers
The recipients listed in Section 6 are established in the United States of America, a third country within the meaning of Chapter V GDPR. Each such transfer is safeguarded by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, or an equivalent adequacy mechanism recognised under Article 45 or 46 GDPR, as applicable to that recipient at the time of transfer. A copy of the relevant safeguard can be requested at the address in Section 14.
8. Data retention periods
- Server logs: retained by Vercel for a limited, rolling period, after which they are deleted in the ordinary course of Vercel's own retention practice.
- Community account data: retained for the duration of your membership. Data is deleted upon a substantiated request to close your account, save where its retention is required to comply with a legal obligation.
- Correspondence: retained for as long as reasonably necessary to deal with the matter raised and for such further period as may be required to evidence that it was dealt with.
- Subscription and payment records: held by Circle under its own retention policy in respect of the €1/month subscription. Payment records for Built, or any other Service we take payment for directly, are retained for the periods required by Spanish tax and commercial law (generally, four to six years).
- Analytics data: retained within Google Analytics for the retention period configured for the property, after which it is automatically deleted.
- Access granted for Built, or any coaching or done-for-you work: any credentials or access granted to us for the performance of such an engagement are deleted upon its completion, unless you request that they be retained for the purpose of ongoing work.
9. Rights of data subjects
In accordance with Articles 15 to 22 GDPR and Articles 12 to 18 LOPDGDD, you may exercise, in respect of the personal data we hold about you, the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection, and the right not to be subject to a decision based solely on automated processing.
Where processing is based on your consent (Section 4), you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
Requests may be sent to hello@builtwithskills.com, identifying yourself and the right you wish to exercise. We will respond within the one-month period established by Article 12(3) GDPR, extendable by two further months in cases of particular complexity, of which you would be informed within the first month. No fee is charged for the exercise of these rights, save in the exceptional circumstances contemplated by Article 12(5) GDPR.
10. Security measures
We have adopted the technical and organisational measures reasonably available to an operation of this size to protect personal data against unauthorised access, loss, or alteration, consistent with our obligations under Article 32 GDPR. Data held on third-party platforms (Circle, Vercel, Google) is additionally subject to the security measures adopted by those providers as independent controllers or processors.
11. Minors
The Website and the Community are directed at adults engaged in, or intending to start, a business activity. Consistent with Article 8 GDPR and Article 7 LOPDGDD, they are not directed at, and we do not knowingly collect personal data from, individuals under sixteen years of age. Where we become aware that we have inadvertently collected such data, it will be deleted without undue delay.
12. Amendments to this Policy
We may amend this Policy to reflect changes in our processing activities or in applicable law. Any amendment will be published on this page with an updated revision date. Where an amendment materially affects the processing of your data, we will take reasonable steps to notify you directly, in addition to publishing the revised Policy.
13. Supervisory authority and complaints
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The competent authority in Spain is the Agencia Española de Protección de Datos (AEPD), Calle Jorge Juan, 6, 28001 Madrid. We would however ask that you contact us in the first instance, so that we may address your concern directly.
14. Contact
Any query concerning this Policy or the processing of your personal data should be directed to hello@builtwithskills.com.