Privacy Notice

1. Who We Are

Procure for Impact Ltd ("PfI", "we", "our", "us") is committed to protecting your personal data and respecting your privacy. This notice explains what personal data we collect, how we use it, who we share it with, and the rights you have. PfI is the data controller for the personal data described in this notice.

• Contact: Mark Johnson, Director, privacy@procureforimpact.co.uk
• Company number: 16319846
• ICO registration: ZC201291

2. The Personal Data We Collect

PfI processes a limited amount of personal data, typically:

• Business contact details of clients, prospective clients, suppliers, and associates, such as name, job title, organisation, email address, and telephone number.
• Information needed to deliver our advisory services and manage engagements.
• Information relating to associates we engage, such as details needed to contract with and pay them, including identity documents where we are required to carry out right to work checks.
• Enquiries and correspondence you send to us, including via our website or email.

We do not routinely process special category data, and we do not sell personal data.

3. How We Collect Your Data

• Directly from you, for example when you contact us, work with us, or provide details in the course of an engagement.
• From the organisation you work for, in the course of delivering our services.
• From publicly available sources, such as organisation websites and professional networking platforms.

4. Why We Use Your Data and Our Lawful Basis

We process personal data only where we have a lawful basis to do so under the UK GDPR. The bases we rely on are:

• Performance of a contract: to deliver our services and manage engagements with clients, suppliers, and associates.
• Legal obligation: to comply with our legal, regulatory, and tax obligations, including right to work checks.
• Legitimate interests: to run and develop our business, respond to enquiries, and maintain professional relationships, provided this is not overridden by your rights.
• Consent: where required, for example for certain marketing communications. You may withdraw consent at any time.

5. Who We Share Your Data With

We share personal data only where necessary, and we do not sell it. Recipients may include:

• Associates engaged to deliver work, under terms requiring them to protect personal data.
• Service providers who process data on our behalf, in categories including cloud productivity and file storage, project management, AI tools that support analysis and drafting, and accounting and communication services. All act as our processors under appropriate terms.
• Professional advisers, such as accountants and solicitors, where necessary.
• Regulators, authorities, or other bodies where we are required to do so by law.

Our use of AI tools. We use AI tools to support the delivery of our services, only under commercial agreements that prevent our data being used to train providers' models. Where client information is used within them, this is done in accordance with our terms of engagement with the client concerned and any specific restrictions the client has placed on its information.

6. International Transfers

Some of the service providers we use, including our cloud productivity, project management, and AI platforms, store or process data in the United States or other countries outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. Depending on the provider, this is an adequacy arrangement such as the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge), or approved contractual protections such as the International Data Transfer Agreement or standard contractual clauses with the UK Addendum.

7. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet any legal, accounting, or reporting requirements. When it is no longer needed, it is securely deleted or destroyed.

8. How We Keep Your Data Secure

We take appropriate technical and organisational measures to protect personal data, proportionate to its nature and the size of our business, as set out in our Data Protection and Privacy Policy and Cyber Security Policy. These include holding data in a small number of centrally managed cloud platforms, access controls with access granted per engagement and revoked when no longer needed, multi-factor authentication, and keeping software and devices up to date.

9. Cookies and Our Website

Our website, procureforimpact.co.uk, is an information site. It does not run advertising or sell anything, and we aim to keep its use of cookies to a minimum. The site may set a small number of strictly necessary cookies required for it to function; these do not track you and do not require your consent. We do not currently use analytics or marketing cookies. If that changes, we will update this notice and ask for your consent where the law requires it.

If you contact us through the website, the details you provide are handled as described in this notice.

10. Your Rights

Under the UK GDPR you have the right to:

• Be informed about how your data is used
• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Data portability, where applicable

To exercise any of these rights, please contact us at privacy@procureforimpact.co.uk. We will respond within the timescales required by law.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can address it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk or by calling 0303 123 1113.

12. Changes to This Notice

We may update this notice from time to time. The version number and date above indicate when it was last revised.