Home›Privacy
Privacy notice.
How Potentially looks after your personal data when you use this website, buy from us, deal with us as a supplier or business contact, or use Potentially on your own account.
This notice covers the website, our business contacts, and anyone using Potentially on their own account. If you use Potentially through your university, college or employer, that organisation decides what data is collected and why. Their own privacy notice governs your use of the platform, and this one does not replace it.
For that data we are the processor and your institution is the controller: they decide what is collected and why, and we act on their instructions.
1 Background.
This notice tells you how we look after your personal data when you visit www.potential.ly, when you buy our career readiness and portfolio products, where you are a prospective customer, or where you are another business contact such as a supplier or service provider.
It also covers you where you use Potentially on your own account — for example after leaving an institution, having connected a personal email address and password.
It sets out what we collect, what we use it for, who we share it with, your rights under data protection law, and what to do if you have a concern.
We update this notice when our services change, when our processing changes, or when the law changes. The current version is always published here, and we bring material changes to your attention where it is appropriate to do so.
2 Who we are.
We are Potentially Limited, 86–90 Paul Street, London EC2A 4NE, registered in England and Wales, company number 09101474.
For visitors to this website, for our business contacts, and for anyone using Potentially on their own account once their institution’s agreement with us has ended, we are the controller of your information — we decide what is collected and how it is used.
We are registered with the Information Commissioner’s Office under number ZA313162.
3 Contact.
Questions about this notice, or about how we use information, go to Trevor Bezzina at trevor@potential.ly.
4 What we collect.
- Identity data
- Your first and last name, or title.
- Contact data
- Email address, telephone numbers, postal address.
- Technical data
- IP address, browser type and version, time zone and general location, browser plug-ins, operating system and platform.
- Usage data
- How you use our systems.
- Feedback
- What you tell us in surveys and questionnaires.
- Photo and image data
- Your profile picture and any images you upload.
- Profile data
- Account and login credentials, held securely; username; chat logs; audit trails of systems used and documents opened or downloaded.
- Marketing and communication data
- Your preferences about hearing from us, and how you prefer to be contacted.
Where it comes from
- Directly from you — when you contact us, create an account, complete a form, or buy from us
- Automatically, from your device and your use of the website
- From connected services, such as a learning management system or single sign-on
This website is not directed at children, and we do not knowingly collect children’s personal data through it.
5 Why we use it.
We need a lawful basis for using your personal data. Three apply to us.
Contract
- To administer and perform our contract with you
- To process payment information under that contract
- To send you updates about services you have bought
Legitimate interests
Where it is necessary for our legitimate interests or a third party’s, and those interests are not overridden by your rights. In practice that means improving the website and our services, securing our systems, running the business, communicating with business contacts, appropriate direct marketing, showing content that authors have embedded from other websites, and establishing or defending legal claims.
Consent
Where you have agreed to something specific: hearing from us where the law requires your consent first, or the cookie choices you make on the website or the platform. You can withdraw consent at any time, using the cookie settings on either or by emailing us, and section 10 sets out how.
If we need your data to enter into or perform a contract and you do not provide it, we may not be able to provide what you have asked for.
If we ever want to use your data for a new reason, we update this notice first.
6 Who we share it with.
- Our own people — employees and workers who need access for their role, under access controls and confidentiality obligations
- Suppliers and service providers — the providers that run parts of the platform for us: cloud hosting and storage, the application database, the AI and document-processing services behind our AI-assisted features, transactional email, survey collection, badge issuing, embedded analytics dashboards, error monitoring, protection of public forms against automated abuse, link previews, stock imagery, web fonts, website hosting, website analytics, and cookie consent management. We share only what each one needs, under a data processing agreement
We may also disclose personal data where the law requires or permits it, including a valid court order or a lawful request from a public authority. We assess each request and disclose only what is appropriate.
7 Where it is held.
We store and process personal data on Amazon Web Services in the Republic of Ireland (eu-west-1). Where an institution has asked for its platform to be hosted in a US region, that institution’s data is held there instead.
AI features
Where a feature uses AI, the provider receives the text that feature needs and not your account. Where an institution has switched on anonymisation for free-text analysis, the details that would connect the writing to a person are removed before it is sent. Text sent to an AI provider is not used to train their models.
Our providers
We keep a current list of the providers that process personal data on our behalf, setting out what each one does, what it handles and where. Institutions can request it, and can ask to be told when it changes. Where a provider is outside the UK, the transfer is covered by the safeguards UK data protection law requires.
Our full data protection documentation — the sub-processor list, the security detail and our processing agreements — is available to institutions on request.
8 How we keep it safe.
- Access controls and user authentication, including multi-factor authentication where appropriate
- IT and network security measures
- Testing and review of those measures
- Staff policies, awareness and training
- Incident and personal data breach response processes
- Business continuity and disaster recovery processes
If a personal data breach happens, we investigate it and notify the ICO and the people affected where the law requires us to.
9 How long we keep it.
We keep personal data only for as long as we need it for the purpose we collected it for. When we no longer need it, we delete it or anonymise it so that it can no longer identify anyone.
How we decide
Where a single fixed period is not practical, we decide how long to keep information by reference to:
- Why we collected it, and whether we still need it for that purpose
- Whether the relationship it relates to is still live
- Any legal, accounting, regulatory or reporting requirement that applies
- Whether we may need it to establish, exercise or defend a legal claim
- How sensitive it is, and the risk of keeping it longer than necessary
We review what we hold against those criteria, and delete or anonymise what we no longer need.
In practice
- Data we hold for an institution
- Where a university, college or employer holds the agreement with us, we keep the data for as long as that agreement is live and for two years after the purpose ends, unless the agreement says otherwise. On termination, institutional data is returned or deleted in line with that agreement.
- An account someone has taken with them
- Where a person has connected a personal email address and password, their own work is theirs. We keep it until they delete it or close the account.
- Business contacts and enquiries
- We keep contact details while there is a live enquiry or an active relationship, and for a period afterwards so we can pick a conversation back up. If you ask us to stop contacting you, we keep only the minimum needed to honour that.
- Website and analytics data
- Website analytics are collected only if you allow analytics cookies. HubSpot keeps a record of the pages visited, linked to its cookie. If you send us an enquiry, that record is kept with your contact details and deleted with them, as for business contacts above. Our reports use combined figures.
- Backups
- Data can persist in backups for a short period after it is deleted from the live service. Backups are overwritten on a rolling cycle, and we do not use them to restore data someone has asked us to delete.
If you want to know how long we are holding something in particular, ask and we will tell you.
10 Your rights.
You can ask us to do any of the following. Email trevor@potential.ly.
- Access
- Be told whether we are using your data, and get a copy of it along with how we are using it.
- Correction
- Have inaccurate or incomplete data corrected. We may need to verify the new information first.
- Deletion
- Have your data deleted where there is no good reason for us to keep it. If there is a good reason, we tell you and explain why.
- Restriction
- Have us temporarily limit how we use your data.
- Objection
- Object to processing based on legitimate interests, including profiling on those grounds. You can object to direct marketing at any time, and we must stop.
- Portability
- Where we process data you gave us by automated means under consent or contract, receive it in a structured, machine-readable format, or have it sent to another organisation where that is technically feasible.
- Withdraw consent
- Where we rely on consent, withdraw it at any time. That does not affect processing already carried out, or processing under another lawful basis.
We may ask for information to confirm who you are before acting. We can refuse a request or charge a reasonable fee only where it is manifestly unfounded or excessive — a high threshold we would have to justify. If we refuse or charge, we explain why and tell you about your right to complain to the ICO and seek a judicial remedy.
We respond without undue delay and normally within a month. The law allows an extension of up to two further months for complex requests or several at once; if that applies we tell you within the first month and explain why.
Complaints
If you are unhappy with how we use your data, raise it with us at trevor@potential.ly so we can investigate. We acknowledge complaints within 30 days and tell you the outcome without undue delay.
You can also complain to the Information Commissioner’s Office or another supervisory authority at any time. The ICO will usually ask whether you have raised it with us first, but you do not have to complete our process before contacting them.
11 Profiling and automated decisions.
We do not use the personal data covered by this notice — website visitors and business contacts — for profiling, and we do not make decisions about you by automated means that produce legal or similarly significant effects.
The Potentially platform itself analyses what learners record, in order to produce the reports and insights their institution has asked for. Where that happens the institution decides what is analysed and why, under their own privacy notice. Those analyses inform the people who support a learner; they do not decide anything about them without a person involved.
12 Cookies.
We store small files on your device so the service works. The website measures how it is used with analytics cookies, only if you agree. Some content embedded from other sites sets cookies of its own. This section lists all of it, from an audit of what is actually set. It was last checked in September 2026 and is reviewed quarterly.
Required
These keep you signed in, move you between workspaces, protect the sign-in screens and remember your cookie choices. The service cannot work without them, so they are set whatever you choose.
| Cookie | What it does | Lasts |
|---|---|---|
| CookieControl | Remembers the choices you made in the cookie banner, so we stop asking. | 90 days |
| FolioAccessToken | Carries your sign-in across when you switch between organisations on different addresses. Deleted as soon as the new workspace has read it. | 2 days |
| redirectAfterLogin | Remembers the page you were trying to reach, so we can take you there once you have signed in. | 1 day |
| authorised_client | Remembers which organisation you are signing in to, so that when your institution’s login service sends you back we match you to the right workspace. | Until you close the browser |
| _GRECAPTCHA | Tells human visitors apart from automated abuse on the sign-in, sign-up and password-reset screens. | 6 months |
Website analytics — only if you agree
The website, www.potential.ly, uses HubSpot to show us which pages are visited and where visitors came from. It loads only after you allow analytics cookies in the banner, and it sets its cookies on the shared potential.ly domain, which is why the platform’s banner lists them too. If you later send us the contact form, HubSpot links the pages you visited to your enquiry, so we can see what you read before getting in touch. We rely on your consent for this. The platform itself runs no analytics.
| Cookie | What it does | Lasts |
|---|---|---|
| __hstc | Tells one visitor’s visits apart from another’s, and records when they first and last came. | 6 months |
| hubspotutk | Holds the visitor’s identifier, which is sent with the contact form so an enquiry can be matched to earlier visits. | 6 months |
| __hssc | Counts the pages viewed in the current visit. | 30 minutes |
| __hssrc | Tells HubSpot when the browser has been restarted, so a new visit can be counted. | Until you close the browser |
| __cf_bm | Set by HubSpot’s network provider to tell people apart from automated traffic. | 30 minutes |
Embedded content — on unless you switch it off
Some content is embedded from other websites — YouTube and Vimeo videos, link previews, maps on event pages — and those sites may set their own cookies when the content loads. We rely on legitimate interests for this, so it starts on and content shows as its author intended. Switching it off replaces each embed with a notice naming the source site and a link to open it there. These cookies sit on the other site’s domain, where our banner can name them but not delete them.
| Cookie | What it does | Lasts |
|---|---|---|
| VISITOR_INFO1_LIVE, YSC, CONSENT | Set when a page contains an embedded YouTube video. They measure playback and remember your YouTube preferences. | Session to 6 months |
| player, vuid | Set when a page contains an embedded Vimeo video. They remember playback settings and count views. | 1 to 2 years |
Google Maps may also set cookies on event pages that carry a map. Beyond these, the exact set depends on what authors have embedded in each organisation’s content.
On the website itself, the case-study video is embedded in YouTube’s privacy-enhanced mode (youtube-nocookie.com). YouTube may still store information on your device once you play it. The same setting applies: switch embedded content off and the video is replaced by a link to it on YouTube.
Other storage on your device
The rules on cookies cover any storage on your device, not only cookies. The platform keeps most of its state in your browser’s local storage: the token that keeps you signed in, the page to return you to after signing in, your language and reading direction, which learning management system launched you, and interface preferences such as whether the sidebar is open. All of it is strictly necessary, none of it is shared with anyone, and the sign-in items are cleared when you sign out.
You can change your choices at any time with the Cookie settings link at the foot of every page on the website, or the cookie controls on the platform. Either changes both, as they share the one CookieControl cookie. Withdrawing consent is as easy as giving it.
Every browser also lets you refuse or delete cookies directly, though blocking all of them will stop parts of this site and the platform working.
We review this list quarterly, and whenever we change the tools we use.