1. Who we are
The Crest Guild is a product operated by ArmoFlow Ltd ("ArmoFlow," "we," "us," "our"), a company registered in England and Wales under company number 17081481, with its registered office at 167-169 Great Portland Street, London, England, W1W 5PF.
ArmoFlow is the data controller responsible for your personal data in connection with thecrestguild.com and the application/assessment process described on it (together, the "Service").
This Privacy Policy is specific to The Crest Guild. If you also use FrostDesk, a separate Privacy Policy applies to that product — see armoflow.com/privacy.
Questions about this Policy: hello@armoflow.com.
2. Scope of this Policy
This Privacy Policy explains how we collect, use, share, and protect personal data when you:
- visit thecrestguild.com;
- take the positioning quiz;
- submit an application ("candidatura") to join the Guild;
- communicate with us by email or form.
Unlike FrostDesk, The Crest Guild does not connect to or process your own clients' messages, bookings, or communications — so this Policy does not need the customer/end-client distinction used in our FrostDesk Privacy Policy. Everyone using thecrestguild.com is, for the purposes of this Policy, a visitor or applicant.
3. What personal data we collect
3.1 Data you provide directly
- Quiz: your answers to the positioning quiz, and your email address, if you choose to provide it to receive your result.
- Application ("candidatura"): name, email address, your self-selected current situation (e.g. "In Scuola," "Base Camp," etc.), and any optional message you include.
- Billing data (where a fee applies at a given stage of the programme — see our Terms of Service): billing name and address, payment details. [DA CONFERMARE: quale processore di pagamento verrà utilizzato quando il pagamento sarà attivo, e a quale rango/tappa si applica il costo]
- Communications: messages you send us via email or contact form.
3.2 Data collected automatically
- Usage data and website analytics (pages visited, session duration, approximate location from IP address, device/browser type) via Google Analytics (GA4). Analytics cookies are set only after you give consent through our cookie banner (Google Consent Mode v2).
- Cookies and similar technologies — see our separate Cookie Policy.
We do not currently use product analytics tools like PostHog or error-monitoring tools like Sentry on The Crest Guild — those are used on FrostDesk, not here.
3.3 Special category / sensitive data
We do not ask for or intentionally collect special category data (e.g. health data). The optional message field in the application form is free text — please do not include sensitive information there unless necessary; if you do, we will only use it to process your application.
4. How and why we use personal data (legal bases)
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Evaluate and respond to your application | Application data | Legitimate interests (Art. 6(1)(f)) — running our selection process; steps taken at your request prior to a contract |
| Deliver your quiz result | Email address, quiz answers | Consent (Art. 6(1)(a)) — you choose to provide your email |
| Provide the programme once accepted, including any paid stage | Application data, billing data | Performance of a contract (Art. 6(1)(b)); legal obligation (invoicing/tax) where a fee applies |
| Respond to support/contact requests | Communications | Legitimate interests — supporting our users |
| Website analytics | Analytics/cookie data | Consent (Art. 6(1)(a)), obtained via our cookie banner |
| Marketing communications (if you opt in) | Contact data | Consent |
| Comply with legal obligations (tax, accounting, regulator requests) | Billing/application data | Legal obligation (Art. 6(1)(c)) |
| Prevent fraud and abuse (e.g. fake applications) | Application/usage data | Legitimate interests |
We never sell personal data.
5. Who we share data with
| Recipient | Role | Purpose |
|---|---|---|
| Formspree | Processor | Processes submissions from our application form and quiz email capture (Formspree specifically — Resend is used on armoflow.com/FrostDesk, not here) |
| Google Analytics | Processor | Website analytics (only after consent) |
| Vercel | Processor (hosting) | Hosts and serves thecrestguild.com |
| Payment processor [DA CONFERMARE, presumibilmente Stripe come nel resto di ArmoFlow] | Processor | Payment processing, once a paid stage of the programme is live |
We may also disclose personal data: to comply with a legal obligation, court order, or regulatory request; to protect the rights, property, or safety of ArmoFlow, our users, or others; or in connection with a merger, acquisition, or sale of assets (with notice to affected users where required by law).
6. International data transfers
Some of our processors (including hosting and analytics providers) may process data outside the UK/EEA, including in the United States. Where we transfer personal data outside the UK/EEA, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum / EU Standard Contractual Clauses, or transfers to jurisdictions covered by an adequacy decision. You can request more information by contacting hello@armoflow.com.
7. Data retention
- Application data (candidatura), if not accepted: retained for 12 months to allow you to reapply and for our own process review, then deleted — mirrors ArmoFlow's account-data retention period.
- Application data, if accepted: retained for the duration of your participation in the programme, plus 12 months after you leave, for legal/accounting purposes.
- Quiz email (if provided only to receive your result, no application submitted): retained for 90 days then deleted, unless you separately apply to join — mirrors ArmoFlow's message-data retention period.
- Billing records (once applicable): retained for 7 years to meet UK tax and accounting obligations.
- Analytics data: retained for up to 26 months then deleted or aggregated.
8. Your rights
If you are located in the UK or EEA, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to legal exceptions;
- Restrict or object to certain processing, including direct marketing;
- Data portability for data you provided under a contract or consent;
- Withdraw consent at any time, where processing is based on consent (e.g. analytics, or the quiz email) — this does not affect processing carried out before withdrawal;
- Lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO), ico.org.uk.
To exercise these rights, contact hello@armoflow.com. We will respond within one month, as required by UK/EU GDPR.
9. Data protection complaints procedure
Email hello@armoflow.com with the subject line "Data Protection Complaint." We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days; if we need longer, we will explain why.
10. Security
We implement technical and organisational measures to protect personal data appropriate to the scale and nature of The Crest Guild — see our Security Policy for details. No system is completely secure.
11. Children's data
The Crest Guild is intended for use by professionals aged 18 and over applying to join a business-development programme. We do not knowingly collect personal data from children.
12. Changes to this Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify applicants/Members by email or website notice before the changes take effect. The "Last updated" date at the top reflects the most recent revision.
13. Contact us
Data Controller: ArmoFlow Ltd Product: The Crest Guild Email: hello@armoflow.com Registered address: 167-169 Great Portland Street, London, England, W1W 5PF
If you are unhappy with our response, you can complain to the ICO at ico.org.uk or by calling 0303 123 1113.