Privacy Policy

1. Who We Are

Prestige Commercial Consulting Limited ("we", "us", "our") is a company registered in England and Wales (Company No. 17059746) with its registered office at 124-128 City Road, London, EC1V 2NX.

We are the data controller for the personal information we collect through this website and in the course of our business activities. If you have any questions about how we handle your personal data, you can contact us at requests@prestigecommercialconsulting.co.uk.

We are registered with the Information Commissioner's Office. Registration reference: ZC106918. Date registered: 17 March 2026. Registration expires: 16 March 2027. You can view our Data Protection Registration Certificate here.

This policy explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025.

2. What Information We Collect

Information you provide directly

• Your name, email address, organisation name, and any other contact details you choose to provide when you complete our contact form or correspond with us
• Details of your enquiry or the services you are interested in
• Any other information you choose to share with us in the course of our communications
• Your email address when you sign up to receive updates from us
• Billing and order information if you purchase a paid digital product or enquiry-led resource from us. Card details are processed by our payment provider; PCC does not store card details
• Purchase fulfilment information for paid digital products, such as product and version entitlement records, checkout references, customer email address, and secure download event records where needed to provide access and support
• Learning access information where you use or enquire about the separate PCC Learning Platform

Professional and corporate information

For corporate market research, company verification and relevant business-to-business outreach, we may collect limited professional and corporate information. Some of this will be personal data where it identifies or relates to an individual. Depending on what is relevant, this may include:

• Name, employer or organisation, professional role or job title
• Corporate email address and, where appropriate, corporate telephone number
• Company number, company status and type, SIC codes and business sector
• Registered or trading location, company website and domain
• Public-sector contract, framework or procurement activity
• Publicly stated business services and capabilities
• Source URL, date checked and verification status
• Our outreach, reply, objection and opt-out history

Website analytics and device information

We use Microsoft Clarity only where you choose "Accept analytics" through our cookie controls. Unless you accept, the remote Clarity analytics script is not loaded and Clarity analytics cookies are not set. Our hosting provider, Netlify, may still generate limited server-side request logs and aggregated usage information for security, performance monitoring and site administration.

When you accept analytics, Microsoft Clarity may collect pseudonymous cookie identifiers, approximate location derived from an IP address, browser and device information, referring and visited pages, page performance, and interactions such as clicks, scrolling, mouse movements, selections and window resizing. Clarity uses this information to produce behavioural metrics, heatmaps and session replays. Microsoft states that sensitive input-box content, numbers and email addresses are masked by default. We do not use Clarity's Identify API and do not intentionally send names, email addresses, enquiry content, payment details or secure-download information to Clarity.

We use these analytics to understand which content is useful, identify confusing or broken journeys and improve website performance and usability. You can accept, reject or later change this choice using the Cookie settings control available on every page. More detail is provided in our Cookie Notice.

Browser storage

Our free procurement tools use your browser's local storage to save tool states on your device. This data is not transmitted to us and remains solely on your device.

3. Where Professional and Corporate Information Comes From

We may obtain relevant professional and corporate information from public sources and reputable business-data services, including:

• Companies House
• The Central Digital Platform, Find a Tender and Contracts Finder
• Public procurement notices, contract-award notices, framework and supplier directories
• Company websites and public professional or business profiles
• Public trade and sector directories
• Reputable business-contact discovery, data-enrichment and email-verification providers

We do not treat information as unrestricted merely because it is publicly available. We consider the source, context, reasonable expectations and intended use. We do not seek private information from professional networking platforms, use unauthorised access or scraping, or assume that a public profile amounts to consent to marketing.

4. How We Use Information

We may use personal, professional and corporate information:

• To respond to your enquiry and communicate with you about our services
• To provide the consultancy services you have engaged us to deliver
• To manage our contractual relationship with you or your organisation
• To comply with our legal and regulatory obligations
• To send mailing-list or newsletter updates where you have consented
• To provide access to free reference tools on the Procurement Support Hub
• Where you have consented, to use Microsoft Clarity analytics to understand website usage, diagnose usability problems and improve content and customer journeys
• To process payments, record paid digital tool purchases or enquiry-led resource orders, fulfil secure downloads, and support access issues
• To manage enquiries about, or access to, the separate PCC Learning Platform
• For corporate market research, company verification and conflict-of-interest screening
• To identify organisations likely to benefit from our services, tools or learning resources
• For relevant and proportionate B2B business development, including personalising a communication to the recipient's professional responsibilities
• To avoid duplicate or irrelevant contact and maintain accurate opt-out and suppression records
• To measure the effectiveness and appropriateness of our outreach, including whether it is reaching relevant corporate recipients

5. Lawful Bases for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases for processing your personal data:

• Consent: For mailing-list and newsletter communications, electronic marketing where consent is required, and Microsoft Clarity analytics cookies and associated analytics processing. You may withdraw consent at any time
• Contractual necessity: Where processing is necessary to perform a contract with you or take steps at your request before entering into a contract
• Legitimate interests: To respond to and manage business enquiries, maintain appropriate professional records, develop our business and inform relevant corporate organisations about services, tools or learning resources likely to be useful to them, where the processing is necessary and proportionate and your interests, rights and freedoms do not override ours
• Legal obligation: Where processing is necessary to comply with a legal obligation to which we are subject

Legitimate interests and targeted B2B outreach

Where permitted, relevant and targeted outreach to professional contacts at corporate bodies may rely on our legitimate interests rather than consent. This is not an automatic basis for using every business contact. Before relying on legitimate interests, we conduct and document a legitimate interests assessment which:

• Identifies the specific business-development purpose
• Considers whether the processing is necessary and whether a less intrusive method is reasonably available
• Assesses proportionality, the information's professional context, the person's reasonable expectations and the likely privacy impact
• Limits the information and communication to what is relevant to the person's professional responsibilities
• Balances our interests against the individual's interests, rights and freedoms

We do not rely on legitimate interests where that balancing assessment shows that the individual's interests, rights or freedoms override ours. We respect objections to direct marketing immediately.

6. Direct Marketing and PECR

Mailing lists and newsletters

Our mailing-list and newsletter communications continue to rely on consent. We do not treat acceptance of this privacy policy, a contact-form enquiry or a purchase as consent to receive a newsletter. You can withdraw your consent or unsubscribe at any time.

Corporate B2B communications

PECR distinguishes corporate subscribers from individual subscribers. The PECR consent rule for marketing by electronic mail does not generally apply to corporate subscribers, such as limited companies and limited liability partnerships. Where a named business contact's details are personal data, however, the UK GDPR still applies. We must have a lawful basis, act fairly and transparently, and respect the person's absolute right to object to direct marketing.

Relevant, targeted electronic communications to corporate subscribers may therefore be sent without prior consent where PECR permits and our documented legitimate interests assessment supports the processing. Each message will identify Prestige, will not disguise its commercial purpose and will provide a valid, simple way to opt out.

Individual and uncertain subscriber types

Sole traders, certain partnerships and other unincorporated or individual subscribers receive greater protection under PECR. We intend to exclude them, personal email addresses and contacts whose subscriber type cannot be established from unsolicited electronic outreach unless consent, the soft opt-in or another legally permitted route has been established. Where the subscriber type is uncertain, we will treat the contact as an individual subscriber.

First contact and transparency

Where we obtained personal data from another source, our first targeted communication will identify Prestige, explain why the recipient is being contacted and how the information was obtained, provide direct access to this privacy policy, and give a clear method of objecting or opting out. We will provide this information no later than the first communication and within one month of obtaining the personal data, whichever is earlier, unless a lawful exception applies.

7. Who We Share Information With

We do not sell, rent or trade personal information. We may disclose or allow limited information to be processed only where necessary for the purposes described in this policy, including by:

• Microsoft 365 and Outlook for business communications, and SharePoint or other secure business systems used by Prestige for appropriate record keeping
• Companies House and relevant public-data services used to obtain or verify corporate information
• Business-contact discovery, data-enrichment or email-verification providers used to find or verify limited professional contact information
• Hosting, information-security and professional-advisory providers, such as accountants or legal advisers, where necessary for the operation or protection of our business
• Regulatory bodies or law enforcement agencies where we are required to do so by law
• Netlify, Inc. for website hosting and contact-form processing. See netlify.com/privacy
• Microsoft, through Microsoft Clarity, where you accept analytics. Microsoft processes pseudonymous website-usage and interaction information to provide heatmaps, session replays and behavioural analytics. See the Microsoft Privacy Statement
• Email service or marketing platforms for communications. Mailing-list data is provided to a marketing platform only where the relevant consent or other lawful route applies
• Stripe, Inc. for paid-product or enquiry-led resource payments. We do not store card details. See stripe.com/privacy
• Supabase where needed to record paid digital product purchases, product and version entitlements, webhook events and secure download activity for fulfilment and support
• PCC Learning Platform providers where you access learning services through the separate platform. Relevant access and learner information may be handled by that platform and its supporting providers, with provider-specific privacy information made available through the learning access route

Consent is not required for every use of a service provider. We use providers only where there is an appropriate lawful basis and suitable data-protection, confidentiality and security arrangements are in place. Depending on the service, a provider may act as our processor, as a separate controller, or as a source of public corporate information. Where personal data is transferred outside the United Kingdom, we use an applicable lawful transfer mechanism and appropriate safeguards.

8. Retention

We keep personal data only for as long as it is needed for the purpose for which it was collected, or for an applicable legal, contractual, accounting, complaint, conflict-management or regulatory purpose.

Prospective B2B contact information

We review prospective B2B contact information for accuracy, necessity and continuing relevance at least annually and before further outreach where appropriate. If there has been no meaningful reply, enquiry or business relationship, we normally delete or anonymise the prospect's personal data within 24 months of first collecting it. We will remove it sooner if it is inaccurate, unnecessary, no longer professionally relevant or our legitimate interests assessment no longer supports its use.

We retain prospect information for longer only where reasonably necessary for a legal or contractual record, a complaint, conflict-of-interest management, or a suppression purpose.

Other records

Contact-form enquiries are retained for a maximum of 24 months from the date of your last communication with us, unless a longer retention period is required for contractual or legal purposes. Purchase, entitlement, payment reference and download-support records may be retained for as long as needed for accounting, tax, contractual, access-support, fraud-prevention and legal record-keeping purposes. Client, learner and PCC Learning Platform records are retained according to the relevant service, contractual and legal requirements.

Microsoft Clarity analytics

Microsoft's published Clarity retention schedule states that session playback data is retained for 30 days, while click and heatmap data and sessions that are labelled or favourited may be retained for up to 9 months. See Microsoft Clarity data retention.

Suppression records

When someone objects or opts out, we may retain the minimum information needed to prevent further marketing. This will normally be the corporate email address, organisation, date and reason for suppression. Suppression information is not used for further marketing and is retained for as long as reasonably necessary to honour the objection.

9. How We Store and Protect Information

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration. Personal information collected through our contact form, paid digital tools checkout, secure download flow, or learning access routes is handled in accordance with our data retention practices.

Access to professional contact and outreach records is limited to people and providers who need it for an authorised purpose. We seek to keep records accurate, record their source and verification status, and screen proposed outreach against current suppression information.

10. Your Rights and the Right to Object

Under UK data protection law, you have the following rights in relation to your personal information:

• Right of access: You can request a copy of the personal information we hold about you
• Right to rectification: You can ask us to correct any inaccurate or incomplete information
• Right to erasure: You can ask us to delete your personal information in certain circumstances
• Right to restrict processing: You can ask us to limit how we use your information
• Right to data portability: You can request that we transfer your information to another organisation in a structured, commonly used format
• Right to object: You can object to certain types of processing, including processing based on legitimate interests
• Right to withdraw consent: Where we rely on your consent to process your data, you can withdraw that consent at any time. For Microsoft Clarity analytics, use the Cookie settings control available on every page

You have an absolute right to object to the use of your personal data for direct marketing at any time. You can object or opt out by replying to the communication or contacting requests@prestigecommercialconsulting.co.uk. Direct marketing to you will stop once we receive your objection. We may then add the minimum details to our suppression record so that we continue to respect it.

These rights apply in the circumstances set out in data protection law. To exercise a right, contact the same email address. We will normally respond within one month and will explain if we need to verify your identity, extend the response period as permitted by law, or cannot fulfil all or part of a request.

11. Complaints

You can raise a data-protection complaint with us by contacting requests@prestigecommercialconsulting.co.uk. We will acknowledge the complaint within 30 days, take appropriate steps to investigate it, keep you informed where appropriate and tell you the outcome without undue delay.

If you are unhappy with how we have handled your personal information, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or by calling 0303 123 1113. Our registration reference is ZC106918.

We would appreciate the opportunity to address your concerns before you contact the ICO, but this does not affect your right to complain to the ICO.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.