What we collect, why we hold it and who can see it.

What we collect

• Contact details you submit through the service guide, a service request or the contact form: business name, your name, email address and, if you give one, a phone number.
• The answers you give in the service guide, including what you describe in your own words.
• Evidence you or your named colleagues upload during an engagement, together with its source, period, owner and access class.
• Account and access records for signed-in users, including the role you hold and the records you opened, approved or released.

Why we hold it

• To review your enquiry and decide, with a person, which service is appropriate.
• To produce results that can be traced back to the evidence they came from.
• To keep an audit record of approvals, releases and access, which is a control we cannot switch off for individual records.
• To meet our legal and contractual obligations.

Who can see it

• Only the people assigned to your engagement, plus the reviewers and administrators required to approve and release work.
• Signed-in access is controlled in the database itself, not only by hiding links, and is separated by organisation and by case.
• A specialist receives information only for a referral scope you have consented to, only for the data classes named in that consent, and only for a recorded access period.
• We do not sell your information, and we do not use your engagement evidence as sector or local-economy data unless you separately agree to it.

How long we keep it

• Enquiries and triage answers are kept while the enquiry is open and for the period stated in your engagement terms.
• Engagement evidence, reports and audit records are kept under the retention period recorded against them.
• Released report versions cannot be edited after release. A correction is issued as a new version and the earlier version remains on record.

Your choices

• You can withdraw consent for specialist access at any time. Withdrawal takes effect immediately for future access; it does not erase the audit history of access that already happened.
• You can ask us to correct information that is wrong.
• You can ask what we hold about you and ask for it to be deleted where we are not required to keep it.
• Requests are handled by a person. We confirm your identity before acting on a request about someone's records.

Security

• Uploaded files are held in private storage and are not publicly reachable by link.
• Access to signed-in areas requires an account with an assigned role and is recorded.
• We do not place service-role or administrative keys in anything that runs in your browser.

Contacting us about your information

We publish no email address or phone number that has not been approved for publication, so privacy requests come through the contact form. Use the contact form and describe your request. A person will reply to the email address you provide.

This notice is written in plain terms and describes current practice. It is not legal advice, and it does not replace the terms recorded in a signed engagement.