Privacy Policy

---

Your privacy matters to us. This policy explains how we collect, use, and protect your personal information when you: 

• Visit our website
• Work with us as a client
• Engage with us through business communications
• Receive our marketing communications

Our Approach to Data Protection

We are committed to full compliance with UK data protection legislation, including the Data Protection Act 2018 and UK GDPR. 

Our approach is built on these core principles:

• We process personal data only when we have a clear legal justification
• We implement comprehensive security measures to protect your information
• We never sell or trade your personal data with third parties
• We ensure any partners we work with meet strict data protection standards
• We practice data minimisation - collecting only what we genuinely need

What Personal Information We Collect

Client Services

When providing our professional services, we collect and process names, contact information, job titles, company details, and records of our interactions. This enables us to deliver high-quality services and maintain effective working relationships. 

Marketing Communications

For our marketing activities, we collect contact details and professional information. We only send marketing communications where we have your consent or a legitimate business reason. You can easily opt out at any time using the unsubscribe links in our emails or by contacting us directly. 

Website Visitors

We may collect technical information such as IP addresses and website usage data through cookies and analytics tools to improve our website performance and user experience. 

Business Contacts

We process contact details of business representatives to address queries, complaints, or claims, and to maintain professional relationships. 

Our Lawful Bases for Processing

We rely on several lawful bases depending on the purpose:

• Contract: To provide our services and manage client relationships
• Consent: For marketing communications and optional services
• Legitimate Interests: For business development, networking, and responding to inquiries
• Legal Obligation: To comply with regulatory and tax requirements

Who Has Access to Your Personal Information

We keep your personal information within Step Forward Insights and never sell it to third parties.  We do use trusted service providers (such as IT hosting, email, or professional advisers) who may process data on our behalf. They are contractually required to keep your information secure and use it only for our purposes. 

How Long We Keep Your Personal Information

Retention periods depend on the context in which information was collected:

• Active clients: Duration of engagement plus 6 years
• Prospective clients: 3 years from last contact
• Marketing data: Until consent withdrawn or 3 years of inactivity
• Website analytics: 26 months
• General correspondence: 3 years
• Complaint records: 6 years

Your Rights

As a data subject, you have specific rights regarding your personal data:

• Right of access: Request copies of your personal information
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data in certain circumstances
• Right to restrict processing: Limit how we use your data
• Right to object: Object to processing based on legitimate interests
• Right to data portability: Transfer your data to another organisation
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time

We will respond to requests within one month.

Changes to This Privacy Policy

We may update this privacy policy from time to time. Any changes will be published on our website and, where appropriate, we will notify you directly. 

Contact Information

If you would like further information on how we process your personal data or wish to exercise your subject rights then please contact our Data Protection Officer by email at dpo@stepforwardinsights.com.

Updated: 26th August 2025