Understand what personal information
we collect and how it will be handled.

IMPOWER Consulting Ltd (“IMPOWER”) is the controller for personal data provided to us for the purposes detailed below.

At IMPOWER we are committed to protecting any information you share with us.

We will never sell, distribute or intentionally make your personal information public and have implemented appropriate technical and organisational security measures to protect the data you share with us from loss and preserve its security and confidentiality. All your interactions with our website are protected by strong 256-bit encryption and we aim to collect the minimum of personal information needed to provide an effective service.

We believe in being transparent about what data we are collecting and how it will be handled. The information below sets out our privacy notice in detail. In each case we’ll explain why we are collecting and processing your personal data.

Our Purposes and Legal Bases for Processing

We collect and process information about you only where we have a legal basis for doing so. This legal basis will depend on the individual services you use and how you use them. Additional information is provided below but in general terms we will only collect and use your information where:

• It satisfies a legitimate interest which is not overridden by your data protection interests. In all cases, our legitimate interest is in selling our consultancy services and operating our business in a profitable manner.
• You have given us consent to do so for a specific purpose.

In cases where you have consented to our use of your personal data for a specific purpose you have the right to change your mind at any time.

Third Party Processors

Like most businesses we rely on a number of third-party providers to support our day-to-day operations, for example in areas such as online file storage and email delivery. We may also hire third parties to operate, maintain or improve our website and other digital services. Some of these service providers will by necessity have access to or be directly involved in processing or storing a subset of the personal information you share with us.

All our third-party processors have been carefully chosen as service suppliers who also practice responsible data handling. We make sure that each has in place appropriate protections to ensure the security of the data we store or process with them and have clear policies for how they treat that data.

Transfers outside of the UK
Under certain circumstances we may transfer your information outside of the UK.  Where these transfers take place to countries which are not deemed to have laws providing adequate protection to personal data, we make sure that we put in place appropriate safeguards in our contracts with the providers to whom we are transferring the data.

General Browsing
Our website is hosted in the UK. When you visit our website or access one of the files stored on our web server, information about this request will be automatically stored in our log files to provide usage statistics, enable security features and aid technical troubleshooting. This is on the legal basis of legitimate interests. In these cases, your IP address at the time acts as a unique identifier and is stored along with information about your operating system, browser version and the pages/files you access. These logs are retained on the server for up to 30 days, after which they are automatically deleted.

We use Google Analytics to help understand how our website is being discovered and interacted with, and we use this information to help improve the experience for our visitors and make decisions about future development. Google Analytics presents us with aggregate information about the geographic location, device types and operating systems used by our website visitors, but not in a way that personally identifies you. Additionally, Google will set temporary cookies in your browser to help distinguish you as an individual visitor as you move around our site. In the interests of limiting the amount of data Google collects via our site, we are using Google’s standard Analytics implementation and have not enabled any additional advertising features, such as remarketing tags which would tie your usage of our site in with your broader browsing habits. Any user-level data that is associated with Google’s cookies is retained for up to 26 months from your last activity on our site, after which it is automatically deleted from Google’s servers.

Cookies
Cookies are temporary files stored in your web browser by a website to help track usage and enable services that rely on a persistent identity.

Analytics and customisation cookies

These cookies collect information to help us understand how our website is being used or customise it in order to enhance your experience.

• _ga (Google Analytics) – used to distinguish between users. Expires after 2 years.
• _gat (Google Analytics) – used to distinguish between users. Expires after 24 hours.
• dvmd_accessibility_sidebar_settings – used for functionality related to our accessibility sidebar. Only shows up if you make a selection on the accessibility sidebar.

Email Marketing
We use Microsoft Dynamics for our email marketing. So when you subscribe to our newsletter or download one of our reports the email address and name you submit will be held securely by them and the information also made accessible to us. This data is stored in the UK.

We use a double opt-in process where a confirmation email will be sent to the email address supplied with a link to click. Only after clicking that link will you be opted-in to receive our emails.

By default we will retain your data for as long as you choose to stay subscribed or such time as we consider your account to be inactive (i.e. you are no longer opening or engaging with our emails).

You can update your details or opt-out of our emails at any time using the ‘Unsubscribe’ or ‘Email Preferences’ links found at the bottom of every marketing email we send.

Contacting us by Email

When you send us an email, either to one of the addresses displayed on our website or an individual member of staff, we will collect your email address and any other information you provide within your email.

Microsoft are our email service provider so any emails you send us will be stored on their servers. Therefore your email and any associated personal data may be transferred outside of the UK to servers located in the USA.   As part of its standard agreement with its clients, Microsoft incorporates the EU standard contractual clauses and UK Addendum into that agreement, ensuring that any transfers of personal data outside of the UK are done so lawfully and securely.

The information you provide will only be processed in relation to the purpose of your correspondence with us. We have no fixed retention period for email correspondence, but we are committed to only storing your data for no longer than is necessary to serve our legitimate interests of record keeping.

Children’s Data
Our website and services are not for use by children and we will not knowingly collect or use the personal data of children.

Questions & Access Requests
The UK GDPR gives you a number of rights, including the right to know what personal data we hold, to have it updated if it is inaccurate or removed entirely in some situations.

All rights requests and any questions about this privacy notice should be directed to our Data Protection Officer: [email protected] / IMPOWER, Attn. Data Protection Officer, 8-10 Warner Street, Clerkenwell, London EC1R 5HA.

If you wish to complain about our processing of your personal data, you should contact us in the first instance using the details above.

If you remain dissatisfied after we have investigated your complaint, you have the right to make a complaint to the Information Commissioner’s Office: Make a complaint | ICO