1. Who we are and what this policy covers
Insider Threat Limited® is responsible for the personal information we use to manage this website, respond to enquiries and maintain our business contacts and subscriptions. For these activities, we are the data controller.
Our company registration number is 15547172.
This policy explains how we handle information when you visit our website, contact us, register your interest in CIRM™, subscribe to updates or correspond with us about our services.
Information processed on behalf of clients through contracted services is governed by the relevant service arrangements and privacy information. Our Information Handling page explains our approach to client information.
For questions about this policy or to exercise your privacy rights, please use our enquiry form and state that your message concerns privacy or data protection.
2. Information we collect
Depending on how you interact with us, we may collect:
• Your name, email address and any organisation or professional details you provide.
• Your area of interest, whether you are enquiring for yourself or an organisation, and the information included in your message.
• Information you provide when registering interest in CIRM™, including your professional interests and communication preferences.
• Subscription details, consent records and requests to change or stop communications.
• Correspondence, meeting notes and relevant records needed to respond to your enquiry or manage a business relationship.
• Technical information associated with website use, such as IP address, browser and device information, pages visited and interactions with the website.
• Cookie preferences and records associated with your consent choices.
Most information comes directly from you. We may also receive business contact details from someone enquiring on your organisation’s behalf or introducing you to us.
Fields marked as required help us deal with your request. If you do not provide sufficient contact information or details, we may be unable to respond.
3. Why we use your information
We use personal information for the following purposes and on the following lawful bases.
Responding to enquiries and managing business relationships
We use your information to understand your requirements, respond to questions, discuss services, prepare proposals and maintain relevant contact records.
We normally rely on our legitimate interests in responding to people who contact us and managing our business relationships. We consider those interests alongside your rights and reasonable expectations.
Where you enquire about entering a contract with us personally, we may instead rely on taking steps at your request before entering that contract, or performing it once agreed.
CIRM™ interest registrations and subscriptions
We use registration details to respond to your interest and, where you have opted in, send relevant programme news or other updates you requested.
We rely on consent for subscription communications. You can withdraw that consent at any time.
Operating and protecting the website
We use information to maintain website functionality, prevent misuse and support security. We rely on our legitimate interests in operating a reliable and secure website.
We seek consent for optional cookies and associated analytics through our cookie controls.
Legal obligations and record keeping
We may use information to meet applicable legal obligations, respond to valid requests and maintain necessary compliance records.
Where we retain information to establish, exercise or defend legal claims, we rely on our legitimate interests in protecting our legal rights, unless a legal obligation applies.
4. Where your information is handled
Our website and forms are provided through Wix. Form submissions may be stored in Wix and generate notifications to our Microsoft 365 email environment.
Relevant enquiry details and correspondence may also be recorded in our SharePoint CRM and other Microsoft 365 business records so that we can manage your enquiry and subsequent relationship with us.
We use CookieYes to present our cookie banner and manage cookie preferences.
Subscription communications may be managed and sent through Wix or Microsoft 365. We apply your communication preferences regardless of which platform we use.
5. Marketing and communication preferences
Submitting an enquiry does not automatically subscribe you to general marketing communications.
Where you choose to receive blog updates, insights, CIRM™ news or other subscription communications, we use your details for the purposes explained when you subscribe.
You can unsubscribe using the option provided in a subscription email or ask us to stop through our enquiry form
.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. We may retain a limited record of your preference to help ensure we do not contact you again against your wishes.
We may still send correspondence necessary to deal with an enquiry you have made or administer an existing service relationship.
6. Who receives your information
Access is limited to people who need the information for the relevant business purpose.
Our service providers include Wix for website and form services, Microsoft for business email and records, and CookieYes for cookie preference management.
We may also disclose relevant information to professional advisers, regulators, courts or public authorities where necessary and lawful, including to meet legal obligations or protect legal rights.
We do not sell your personal information or provide it to other organisations for their independent marketing.
7. International processing
Our technology providers operate internationally. Personal information may therefore be stored or accessed outside the UK.
Where a transfer is restricted under UK data protection law, the applicable arrangements must provide a recognised legal basis for that transfer. Depending on the provider and destination, this may include UK adequacy regulations or approved contractual safeguards.
You can ask us for further information about the safeguards relevant to your information through our enquiry form.
8. How long we keep information
We keep personal information for the purpose for which it is needed and do not retain it indefinitely simply because it might be useful.
Ordinary enquiries
Where an enquiry does not develop into an ongoing business relationship, we retain the relevant enquiry record for up to 12 months after our last substantive contact, unless a legal obligation or a specific dispute requires longer retention.
Ongoing business relationships
Where an enquiry leads to continuing discussions, a proposal or a client relationship, relevant information becomes part of that business record. Retention is determined by the relationship, the record’s purpose and applicable contractual, legal and claims requirements.
CIRM™ interest and other subscriptions
We retain subscription details while the subscription remains active and relevant. We review records where a programme or communication activity changes or ends.
When you unsubscribe, we stop the relevant communications. We may retain limited consent and suppression records for as long as necessary to demonstrate and honour your preferences.
Website and cookie information
Cookie lifetimes and information about individual cookies are addressed in our Cookie Policy and cookie preference information. These periods are separate from the retention period for enquiry records.
When information is no longer required, it is deleted or anonymised. Residual backup copies are subject to the relevant provider’s backup lifecycle.
9. How we protect information
We use technical and organisational measures appropriate to the information and the risks involved. These include controlled access, authorised business systems and procedures for handling and sharing information.
Our technology providers also apply security measures to the services they operate. We review our arrangements as our business and processing activities develop.
10. Cookies and website analytics
Our website uses cookies and similar technologies to support its operation and, subject to your choices, help us understand how it is used.
We use Wix website services and analytics, and CookieYes to manage cookie preferences.
You can accept or reject optional cookies or customise your choices through the cookie controls. Strictly necessary cookies support functions such as security and remembering your privacy choices.
Please read our Cookie Policy for further information about the cookies used and how to change your preferences.
11. Your rights
Depending on the circumstances and the lawful basis involved, you may have the right to:
• Ask for access to your personal information and receive a copy.
• Ask us to correct inaccurate or incomplete information.
• Request deletion of information.
• Request restrictions on how we use information.
• Receive certain information in a portable format.
• Withdraw consent where our processing relies on it.
Your right to object
You can object to processing based on legitimate interests, taking account of your particular circumstances. You can also object to the use of your personal information for direct marketing at any time.
To make a request, use our enquiry form and describe what you would like us to do. We may need information to verify your identity and understand the request.
These rights are subject to applicable conditions and exemptions. We will explain our response where a right does not apply or we need to retain particular information.
We do not use information covered by this policy to make decisions based solely on automated processing that produce legal or similarly significant effects on you.
12. Questions and complaints
If you have a concern about how we handle personal information, please contact us through our enquiry form and identify your message as a privacy concern or complaint.
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator.
Information about making a complaint is available at https://ico.org.uk/make-a-complaint/.
13. Changes to this policy
We may update this policy when our activities, systems or legal obligations change. The current version will be published on this page with its last updated date.
Where a change materially affects how we use your information, we will provide further notice where appropriate.