Privacy Policy

1. Who We Are

Prestige Commercial Consulting Limited ("we", "us", "our") is a company registered in England and Wales (Company No. 17059746) with its registered office at 124-128 City Road, London, EC1V 2NX.

We are the data controller for the personal information we collect through this website and in the course of our business activities. If you have any questions about how we handle your personal data, you can contact us at requests@prestigecommercialconsulting.co.uk.

We are registered with the Information Commissioner's Office. Registration reference: ZC106918. Date registered: 17 March 2026. Registration expires: 16 March 2027. You can view our Data Protection Registration Certificate here.

This policy explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025.

2. What Information We Collect

Information you provide directly

• Your name, email address, organisation name, and any other contact details you choose to provide when you complete our contact form or correspond with us
• Details of your enquiry or the services you are interested in
• The service page used to open the contact form, when applicable, so we can understand which service your enquiry concerns
• Any other information you choose to share with us in the course of our communications
• Your email address when you sign up to receive updates from us
• Billing and order information if you purchase a paid digital product or enquiry-led resource from us. Card details are processed by our payment provider; PCC does not store card details
• For a paid digital product: the email address, buyer capacity, purchasing organisation legal name and authority confirmation where the buyer is a business, UK eligibility/contact address collected for checkout, accepted legal and early-supply acknowledgements, payment reference, entitlement, confirmation, download-token and delivery-event records. These data are required to take payment, issue the durable confirmation, supply the ZIP and provide access support; without the required data PCC cannot complete those steps.
• Purchase fulfilment information for paid digital products, such as product and version entitlement records, checkout references, customer email address, and secure download event records where needed to provide access and support
• A salted, opaque checkout rate-limit value and expiry timestamp used to protect the checkout route. It is not an IP address. The technical expiry/deletion mechanism is not a statement of the retention period for purchase or support records.
• Learning access information where you use or enquire about the separate PCC Learning Platform

Professional and corporate information

For corporate market research, company verification and relevant business-to-business outreach, we may collect limited professional and corporate information. Some of this will be personal data where it identifies or relates to an individual. Depending on what is relevant, this may include:

• Name, employer or organisation, professional role or job title
• Corporate email address and, where appropriate, corporate telephone number
• Company number, company status and type, SIC codes and business sector
• Registered or trading location, company website and domain
• Public-sector contract, framework or procurement activity
• Publicly stated business services and capabilities
• Source URL, date checked and verification status
• Our outreach, reply, objection and opt-out history

Website analytics and device information

Microsoft Clarity analytics is disabled across the PCC website pending an evidence-backed cookie inventory. PCC does not load its Clarity script, create a Clarity consent banner or set a PCC analytics-preference value. Our hosting provider, Netlify, may still generate limited server-side request logs and aggregated usage information for security, performance monitoring and site administration.

Netlify Browser RUM is a hosting-dashboard-controlled performance-monitoring feature. It is disabled for this site, so no Netlify RUM browser agent or collection endpoint is active on the production site or deploy previews. The site's Content Security Policy also does not allow Netlify's off-site RUM collection endpoint. Netlify may still generate limited server-side request logs and aggregated hosting information as described above.

Browser storage

Our free procurement tools use your browser's local storage to save tool states on your device. This data is not transmitted to us and remains solely on your device.

3. Where Professional and Corporate Information Comes From

We may obtain relevant professional and corporate information from public sources and reputable business-data services, including:

• Companies House
• The Central Digital Platform, Find a Tender and Contracts Finder
• Public procurement notices, contract-award notices, framework and supplier directories
• Company websites and public professional or business profiles
• Public trade and sector directories
• Reputable business-contact discovery, data-enrichment and email-verification providers

We do not treat information as unrestricted merely because it is publicly available. We consider the source, context, reasonable expectations and intended use. We do not seek private information from professional networking platforms, use unauthorised access or scraping, or assume that a public profile amounts to consent to marketing.

4. How We Use Information

We may use personal, professional and corporate information:

• To respond to your enquiry and communicate with you about our services
• To provide the consultancy services you have engaged us to deliver
• To manage our contractual relationship with you or your organisation
• To comply with our legal and regulatory obligations
• To send mailing-list or newsletter updates where you have consented
• To provide access to free reference tools on the Procurement Support Hub
• To process payments, record paid digital tool purchases or enquiry-led resource orders, fulfil secure downloads, and support access issues
• To manage enquiries about, or access to, the separate PCC Learning Platform
• For corporate market research, company verification and conflict-of-interest screening
• To identify organisations likely to benefit from our services, tools or learning resources
• For relevant and proportionate B2B business development, including personalising a communication to the recipient's professional responsibilities
• To avoid duplicate or irrelevant contact and maintain accurate opt-out and suppression records
• To measure the effectiveness and appropriateness of our outreach, including whether it is reaching relevant corporate recipients

5. Lawful Bases for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases for processing your personal data:

• Consent: For mailing-list and newsletter communications and electronic marketing where consent is required. You may withdraw consent at any time
• Contractual necessity: Where processing is necessary to perform a contract with you or take steps at your request before entering into a contract
• Legitimate interests: To respond to and manage business enquiries, maintain appropriate professional records, develop our business and inform relevant corporate organisations about services, tools or learning resources likely to be useful to them, where the processing is necessary and proportionate and your interests, rights and freedoms do not override ours
• Legal obligation: Where processing is necessary to comply with a legal obligation to which we are subject

Legitimate interests and targeted B2B outreach

Where permitted, relevant and targeted outreach to professional contacts at corporate bodies may rely on our legitimate interests rather than consent. This is not an automatic basis for using every business contact. Before relying on legitimate interests, we conduct and document a legitimate interests assessment which:

• Identifies the specific business-development purpose
• Considers whether the processing is necessary and whether a less intrusive method is reasonably available
• Assesses proportionality, the information's professional context, the person's reasonable expectations and the likely privacy impact
• Limits the information and communication to what is relevant to the person's professional responsibilities
• Balances our interests against the individual's interests, rights and freedoms

We do not rely on legitimate interests where that balancing assessment shows that the individual's interests, rights or freedoms override ours. We respect objections to direct marketing immediately.

6. Direct Marketing and PECR

Mailing lists and newsletters

Our mailing-list and newsletter communications continue to rely on consent. We do not treat acceptance of this privacy policy, a contact-form enquiry or a purchase as consent to receive a newsletter. You can withdraw your consent or unsubscribe at any time.

Corporate B2B communications

PECR distinguishes corporate subscribers from individual subscribers. The PECR consent rule for marketing by electronic mail does not generally apply to corporate subscribers, such as limited companies and limited liability partnerships. Where a named business contact's details are personal data, however, the UK GDPR still applies. We must have a lawful basis, act fairly and transparently, and respect the person's absolute right to object to direct marketing.

Relevant, targeted electronic communications to corporate subscribers may therefore be sent without prior consent where PECR permits and our documented legitimate interests assessment supports the processing. Each message will identify Prestige, will not disguise its commercial purpose and will provide a valid, simple way to opt out.

Individual and uncertain subscriber types

Sole traders, certain partnerships and other unincorporated or individual subscribers receive greater protection under PECR. We intend to exclude them, personal email addresses and contacts whose subscriber type cannot be established from unsolicited electronic outreach unless consent, the soft opt-in or another legally permitted route has been established. Where the subscriber type is uncertain, we will treat the contact as an individual subscriber.

First contact and transparency

Where we obtained personal data from another source, our first targeted communication will identify Prestige, explain why the recipient is being contacted and how the information was obtained, provide direct access to this privacy policy, and give a clear method of objecting or opting out. We will provide this information no later than the first communication and within one month of obtaining the personal data, whichever is earlier, unless a lawful exception applies.

7. Who We Share Information With

We do not sell, rent or trade personal information. We may disclose or allow limited information to be processed only where necessary for the purposes described in this policy, including by:

• Microsoft 365 and Outlook for business communications, and SharePoint or other secure business systems used by Prestige for appropriate record keeping
• Companies House and relevant public-data services used to obtain or verify corporate information
• Business-contact discovery, data-enrichment or email-verification providers used to find or verify limited professional contact information
• Hosting, information-security and professional-advisory providers, such as accountants or legal advisers, where necessary for the operation or protection of our business
• Regulatory bodies or law enforcement agencies where we are required to do so by law
• Netlify, Inc. for website hosting and contact-form processing. See netlify.com/privacy
• Email service or marketing platforms for communications. Mailing-list data is provided to a marketing platform only where the relevant consent or other lawful route applies
• Stripe, Inc. for paid-product or enquiry-led resource payments. We do not store card details. See stripe.com/privacy
• Netlify Blobs for the current paid-digital-product consent evidence, purchase and entitlement records, webhook replay-protection records, and secure-download token and download-event records used for fulfilment and support
• Supabase only for legacy or historical records where applicable; it is not used by the current paid-digital-product consent, purchase, entitlement, webhook replay-protection or secure-download-token flow
• PCC Learning Platform providers where you access learning services through the separate platform. Relevant access and learner information may be handled by that platform and its supporting providers, with provider-specific privacy information made available through the learning access route

Consent is not required for every use of a service provider. Stripe processes hosted payment data and publishes its DPA/UK transfer information, including the UK Extension to the DPF and UK International Data Transfer Addendum/SCC fallback. Netlify hosts the current commerce records and publishes its privacy information and data-protection information, including its stated UK Extension/SCC safeguards. PCC has not independently audited account-specific provider contracts. You may ask PCC for information about the safeguards relevant to your data.

8. Retention

We keep personal data only for as long as it is needed for the purpose for which it was collected, or for an applicable legal, contractual, accounting, complaint, conflict-management or regulatory purpose.

Prospective B2B contact information

We review prospective B2B contact information for accuracy, necessity and continuing relevance at least annually and before further outreach where appropriate. If there has been no meaningful reply, enquiry or business relationship, we normally delete or anonymise the prospect's personal data within 24 months of first collecting it. We will remove it sooner if it is inaccurate, unnecessary, no longer professionally relevant or our legitimate interests assessment no longer supports its use.

We retain prospect information for longer only where reasonably necessary for a legal or contractual record, a complaint, conflict-of-interest management, or a suppression purpose.

Other records

Contact-form enquiries and support correspondence are retained for 24 months after closure unless incorporated into a contract, dispute or legal record. Paid order, consent, durable confirmation, entitlement, payment-reference and download-event records are normally retained for 6 years from the end of the company financial year to which they relate, reflecting limited-company accounting/tax record needs; they are retained longer only for an active dispute, HMRC query or legal hold. The production record writer stamps the applicable accounting-period retention date from PCC's controlled financial-year-end setting. An explicit active retention-hold record prevents automated deletion of the full linked paid consent, reconciliation and fulfilment record set until the hold is released. Older records without that date are never deleted early by automation: the accountable PCC owner must assign the applicable period and complete the documented deletion review. Abandoned or unpaid checkout/consent records are retained for 30 days. Expired raw download-token records are retained for 30 days after expiry; the corresponding delivery event follows the paid-order schedule. Webhook replay and lease records are retained for 400 days. Client, learner and PCC Learning Platform records are retained according to the relevant service, contractual and legal requirements.

Technical checkout rate-limit records expire after 24 hours. A production maintenance task runs hourly and deletes records it finds expired. Preview-environment records are isolated short-lived test data.

Suppression records

When someone objects or opts out, we may retain the minimum information needed to prevent further marketing. This will normally be the corporate email address, organisation, date and reason for suppression. Suppression information is not used for further marketing and is retained for as long as reasonably necessary to honour the objection.

9. How We Store and Protect Information

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration. Personal information collected through our contact form, paid digital tools checkout, secure download flow, or learning access routes is handled in accordance with our data retention practices. Current paid-digital-product consent evidence, purchase and entitlement records, webhook replay-protection records, and secure-download token and download-event records are stored in Netlify Blobs; Supabase is retained only for legacy or historical records where applicable.

Access to professional contact and outreach records is limited to people and providers who need it for an authorised purpose. We seek to keep records accurate, record their source and verification status, and screen proposed outreach against current suppression information.

10. Your Rights and the Right to Object

Under UK data protection law, you have the following rights in relation to your personal information:

• Right of access: You can request a copy of the personal information we hold about you
• Right to rectification: You can ask us to correct any inaccurate or incomplete information
• Right to erasure: You can ask us to delete your personal information in certain circumstances
• Right to restrict processing: You can ask us to limit how we use your information
• Right to data portability: You can request that we transfer your information to another organisation in a structured, commonly used format
• Right to object: You can object to certain types of processing, including processing based on legitimate interests
• Right to withdraw consent: Where we rely on your consent to process your data, you can withdraw that consent at any time

You have an absolute right to object to the use of your personal data for direct marketing at any time. You can object or opt out by replying to the communication or contacting requests@prestigecommercialconsulting.co.uk. Direct marketing to you will stop once we receive your objection. We may then add the minimum details to our suppression record so that we continue to respect it.

These rights apply in the circumstances set out in data protection law. To exercise a right, contact the same email address. We will normally respond within one month and will explain if we need to verify your identity, extend the response period as permitted by law, or cannot fulfil all or part of a request.

11. Complaints

You can raise a data-protection complaint with us by contacting requests@prestigecommercialconsulting.co.uk. We will acknowledge the complaint within 30 days, take appropriate steps to investigate it, keep you informed where appropriate and tell you the outcome without undue delay.

If you are unhappy with how we have handled your personal information, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or by calling 0303 123 1113. Our registration reference is ZC106918.

We would appreciate the opportunity to address your concerns before you contact the ICO, but this does not affect your right to complain to the ICO.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.