Privacy & Cookie Policy

Last updated:October 2026  |  Supersedes the policy dated May 2018

1. Who we are

This policy explains how Procurement International Ltd (“we”, “us”, “our”) collects and uses personal data through our website www.procurement.ltd.uk, and the rights you have. Our website is informational — it is not a shop and does not process orders or payments online.

For the personal data described in this policy, the data controller is Procurement International Ltd, Victory House, 17 & 19 Marino Way, Finchampstead, Berkshire, RG40 4RF, United Kingdom.

We are registered with the Information Commissioner’s Office, registration number ICO:00012929862.

Questions about this policy or your data? Contact our Data Protection Team at dataprivacy@procurement.ltd.uk, or write to us at the address above.

2. What this policy does not cover

This policy covers our website only.

We operate reward, loyalty and incentive programmes on behalf of our clients, including online reward catalogues and programme platforms. Where you take part in one of those programmes, the organisation running it is the data controller for your personal data, and their own privacy notice applies. In those cases we act as a data processor, handling personal data only on that client’s documented instructions and solely to fulfil and deliver their programme. If you have a question about data held in connection with a specific programme, please contact the organisation that invited you to it.

Where our website links to other websites, those sites have their own privacy policies and we are not responsible for them.

3. The personal data we collect, why, and our legal basis

We only collect personal data you give us, or that is generated automatically when you visit. Under UK GDPR we must have a legal basis for each use — in plain terms, the lawful reason we are allowed to process your data.

Enquiries and contact form

If you contact us by email or by telephone, we collect the details you provide — typically your name, email address, telephone number, company and the content of your message. We use this to respond to you.

Legal basis: legitimate interests — responding to enquiries made to us and operating our business-to-business activity. You can object at any time (see section 7).

Following up about our products and services

Where you have asked us about our products or services, we may keep your contact details and contact you again about related products and services.

Legal basis: legitimate interests (business development). Where the law requires consent for electronic marketing, we rely on your consent, and every message includes a way to opt out. You can object or withdraw consent at any time.

Website analytics

We use analytics cookies to understand how visitors use the site — for example which pages are popular — so that we can improve it. This involves Google Analytics, which sends data including your IP address and an online identifier to Google.

Legal basis: consent. These cookies are set only if you accept them (see section 5), and you can withdraw consent at any time.

Security and technical logs

Our website host and our Wordfence security firewall record technical information such as IP addresses and request details, in order to keep the site secure and available and to detect and block malicious traffic.

Legal basis: legitimate interests — protecting the security of our website and network.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects, and we do not knowingly collect data from children.

4. Who we share your data with

We do not sell your personal data. We share it only with:

• Service providers who help us run the website and communicate with you — currently our website host, Google (analytics and reCAPTCHA) and, for the newsletter, Mailchimp. These act on our behalf under contract.
• Professional advisers, law enforcement or regulators, where we are legally required to disclose information.
• A buyer, if our business or its assets are acquired, in which case customer data may be one of the transferred assets.

5. Cookies and similar technologies

Cookies are small files placed on your device when you visit a website. We group them into strictly necessary cookies, which are needed for the site to work and stay secure and do not require your consent, and non-essential cookies such as analytics, which are set only if you agree.

When you first visit, our cookie banner lets you accept or reject non-essential cookies. Non-essential cookies are not set until you accept. You can change your choice at any time using the cookie settings link in the website footer, or by clearing cookies in your browser.

Cookie or technology	Type	Purpose	Duration
PHPSESSID	Strictly necessary	Maintains your session while you browse, for example so the contact form works.	Session
_ga, _ga_2HYX84X4ND	Analytics — consent required	Google Analytics 4. Distinguishes visitors and remembers analytics session state so we can measure how the site is used. Data is sent to Google.	Up to 2 years
_gid	Analytics — consent required	Legacy Google Analytics cookies, used to distinguish visitors and limit request rates.	1 minute to 24 hours

You can also opt out of Google Analytics across all websites using Google’s browser add-on: https://tools.google.com/dlpage/gaoptout.

6. Sending data outside the UK

Some of our providers, notably Google and Mailchimp, are based in the United States, so using them involves transferring personal data outside the United Kingdom. Where that happens we rely on an approved safeguard — either the provider’s certification under the UK Extension to the EU–US Data Privacy Framework, or the ICO’s International Data Transfer Agreement — so that your data receives an equivalent level of protection.

7. Your rights

Under UK GDPR you have the right to:

• be informed about how we use your data, which is the purpose of this policy;
• access a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing, including processing based on legitimate interests, and to object to direct marketing at any time;
• receive certain data in a portable format;
• withdraw your consent at any time where we rely on consent, such as analytics or the newsletter.

To exercise any of these rights, email dataprivacy@procurement.ltd.uk. We will respond within one month. There is normally no charge.

8. How long we keep your data

We keep personal data only as long as we need it:

• Enquiry and contact data: 12 months after our last contact with you
• Analytics data: [CONFIRM the Google Analytics data retention setting — the GA4 default is 14 months].
• Security logs: a short rolling period for operational and security purposes.

9. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including a web application firewall and access controls. No transmission over the internet can be guaranteed to be completely secure, but we take reasonable steps to safeguard your information. Data we hold through this website is stored [CONFIRM current hosting location and provider].

10. Complaints

If you have a concern about how we handle your data, please contact us first at dataprivacy@procurement.ltd.uk so that we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. www.ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a new last-updated date. This version was last updated in October 2026.