1. Who We Are
Procure for Impact Ltd (“PfI”, “we”, “our”, “us”) is committed to protecting your personal data and respecting your privacy. This notice explains what personal data we collect, how we use it, who we share it with, and the rights you have. PfI is the data controller for the personal data described in this notice.
- Contact: Mark Johnson, Director, privacy@procureforimpact.co.uk
- Company number: 16319846
- ICO registration: ZC201291
2. The Personal Data We Collect
PfI processes a limited amount of personal data, typically:
- Business contact details of clients, prospective clients, suppliers, and associates, such as name, job title, organisation, email address, and telephone number.
- Information needed to deliver our advisory services and manage engagements.
- Information relating to associates we engage, such as details needed to contract with and pay them, including identity documents where we are required to carry out right to work checks.
- Enquiries and correspondence you send to us, including via our website or email.
- Responses to questionnaires and consultations we run, including your views and, if you choose to give them, your name, job title, organisation, and email address (see section 10).
We do not routinely process special category data, and we do not sell personal data.
3. How We Collect Your Data
- Directly from you, for example when you contact us, work with us, respond to a questionnaire, or provide details in the course of an engagement.
- From the organisation you work for, in the course of delivering our services.
- From publicly available sources, such as organisation websites and professional networking platforms.
4. Why We Use Your Data and Our Lawful Basis
We process personal data only where we have a lawful basis to do so under the UK GDPR. The bases we rely on are:
- Performance of a contract: to deliver our services and manage engagements with clients, suppliers, and associates.
- Legal obligation: to comply with our legal, regulatory, and tax obligations, including right to work checks.
- Legitimate interests: to run and develop our business, respond to enquiries, maintain professional relationships, and develop frameworks intended for public benefit through questionnaires and consultation (see section 10), provided this is not overridden by your rights.
- Consent: where required, for example for certain marketing communications, or to contact or quote you about a questionnaire response. You may withdraw consent at any time.
5. Who We Share Your Data With
We share personal data only where necessary, and we do not sell it. Recipients may include:
- Associates engaged to deliver work, under terms requiring them to protect personal data.
- Service providers who process data on our behalf, in categories including cloud productivity and file storage, online forms and surveys, project management, AI tools that support analysis and drafting, and accounting and communication services. All act as our processors under appropriate terms.
- Professional advisers, such as accountants and solicitors, where necessary.
- Regulators, authorities, or other bodies where we are required to do so by law.
Our use of AI tools. We use AI tools to support the delivery of our services, only under commercial agreements that prevent our data being used to train providers’ models. Where client information is used within them, this is done in accordance with our terms of engagement with the client concerned and any specific restrictions the client has placed on its information.
6. International Transfers
Some of the service providers we use, including our cloud productivity, online forms, project management, and AI platforms, store or process data in the United States or other countries outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. Depending on the provider, this is an adequacy arrangement such as the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge), or approved contractual protections such as the International Data Transfer Agreement or standard contractual clauses with the UK Addendum.
7. How Long We Keep Your Data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet any legal, accounting, or reporting requirements. Questionnaire responses have a specific retention period, set out in section 10. When data is no longer needed, it is securely deleted or destroyed.
8. How We Keep Your Data Secure
We take appropriate technical and organisational measures to protect personal data, proportionate to its nature and the size of our business, as set out in our Data Protection and Privacy Policy and Cyber Security Policy. These include holding data in a small number of centrally managed cloud platforms, access controls with access granted per engagement and revoked when no longer needed, multi-factor authentication, and keeping software and devices up to date.
9. Cookies and Our Website
Our website, procureforimpact.co.uk, is an information site. It does not run advertising or sell anything, and we aim to keep its use of cookies to a minimum. The site may set a small number of strictly necessary cookies required for it to function; these do not track you and do not require your consent. We do not currently use analytics or marketing cookies. If that changes, we will update this notice and ask for your consent where the law requires it.
Where a page includes an embedded form from another provider, such as Google Forms, that provider may set its own cookies when the form loads. The form is processed as described in section 10.
If you contact us through the website, the details you provide are handled as described in this notice.
10. Framework Questionnaire and Consultation
PfI runs a questionnaire for the Construction Skills Mission Board’s Social Value and Section 106 Taskforce, to test and improve a proposed framework for construction skills and workforce growth. This section explains how we handle responses.
- What we collect: your answers and, if you choose to give them, your name, job title, organisation, and email address. You can answer anonymously.
- What we use it for: responses are used only to inform the development of the framework, its pilots, and the findings we publish about it. We will not use them for any other purpose, including marketing or promoting PfI’s services, and we will not add your details to any mailing list.
- Lawful basis: legitimate interests, in developing a framework intended for public benefit. Where you agree to be contacted about your answers, or to be quoted anonymously, we rely on your consent, which you can withdraw at any time.
- Who sees it: individual responses are seen only by PfI. The Taskforce and the Construction Skills Mission Board receive anonymised summaries, and we may publish anonymised findings. Responses are collected and stored using Google Forms and, where offered as an alternative, Microsoft Forms, which act as our processors (see sections 5 and 6). We may use AI tools to help analyse responses, on the terms described in section 5.
- How long we keep it: up to two years after the questionnaire closes, after which responses are securely deleted. Anonymised summaries and findings may be kept longer.
- Your rights: you can ask to see, correct, or delete your response at any time while we hold it, as described in section 11. Because anonymous responses cannot be linked to you, we may not be able to find or delete them.
11. Your Rights
Under the UK GDPR you have the right to:
- Be informed about how your data is used
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data
- Restrict or object to processing
- Data portability, where applicable
To exercise any of these rights, please contact us at privacy@procureforimpact.co.uk. We will respond within the timescales required by law.
12. Complaints
If you have a concern about how we handle your personal data, please contact us first so we can address it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk or by calling 0303 123 1113.
13. Changes to This Notice
We may update this notice from time to time. The version number and date above indicate when it was last revised. Version 1.1 (October 2026) added section 10 on questionnaires and consultation, and related references in sections 2 to 7 and 9.
Authorised by: Mark Johnson, Director
Date: 20 October 2026
Next review: July 2027