Privacy policy

Policy version: v1.0/14^th October, 2026

1Introduction

This Privacy Policy is provided by AMMONITE INSIGHTS LIMITED, a company registered in England and Wales with company number 17351098 and registered office at 28 Bagdale, Whitby, North Yorkshire, England, YO21 1QL (“we”, “our” or “us”). We provide B2B consultancy services and operate an informational website. We are the controller of the personal data described in this policy.

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data are regulated by law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended from time to time (including by the Data (Use and Access) Act 2025).

We are the controller of personal data used to operate our website, respond to enquiries, develop and provide our consultancy services, manage client and supplier relationships, commission and use professional research contributions, administer contracts and payments, maintain business records, and operate, secure and improve our business.

This policy applies to website visitors and contact-form users; personnel of clients and prospective clients; suppliers and contractors; key opinion leaders (KOLs), experts and research contributors; conference and networking contacts; other business contacts; and our own personnel and staff. Detailed internal operating procedures for our staff are addressed in our separate internal data protection policy.

We use carefully selected service providers to support our website and business operations. We do not name suppliers in this policy because those arrangements may change, but the relevant categories of recipients and processors are described below.

2What this policy applies to

This privacy policy relates to personal data processed when you visit our website, submit a contact form or otherwise contact us; enquire about, negotiate or receive our consultancy services; act for a client or prospective client; supply goods or services to us; work with us as a contractor, KOL, expert or research contributor; meet us at a conference or networking event; or otherwise interact with us in a business context. It also covers technical, communications, payment, invoicing and compliance data processed in operating our business.

Our website may link to websites or services owned and operated by third parties. Those third parties may collect and use information about you as independent controllers under their own privacy notices. Please review those notices as appropriate. For more information, see the section ‘Who we share your personal data with’ below.

3Personal data we collect about you

Category of data	In more detail
Identity and contact data	Name, job title, employer or other organisation, business email address, business address and, where provided or appropriate, a personal email address or occasional personal telephone number, together with contact and communication preferences. Professional background, qualifications, expertise, career history, public professional profile information and details relevant to an engagement, enquiry, conference contact or business relationship. Contract, due-diligence and compliance information, including records needed to manage conflicts, confidentiality, legal obligations and our business relationships. The content of contact forms, emails, calls, meeting notes and other correspondence, including enquiries, feedback, complaints and data protection requests.
Business, research and transaction data	Information about your organisation, role, business needs, project requirements, proposals, instructions, meetings and services. For KOLs, experts and other research contributors, this may include professional background, areas of expertise, availability, opinions, interview or research contributions, recordings or transcripts where agreed, and our related notes and analysis. Contract, billing, bank, payment and invoicing details, including purchase orders, tax information, amounts, dates, payment status and transaction references. We also keep correspondence and records concerning proposals, instructions, deliverables, services, supplier or contractor arrangements, feedback, complaints and disputes.
Technical and usage data collected automatically	Your activities on, and use of, our website, such as pages viewed, form interactions, links followed and times of access, to the extent recorded by our website, hosting and analytics tools. Technical information such as IP address, cookie or similar identifiers, browser type and version, device and operating-system information, session identifiers, referral URLs, approximate location derived from IP address and server or security logs. We use non-essential cookies or similar technologies only as permitted by PECR and as described in our Cookies Policy.
Data collected when you contact or make an enquiry with us	Your name, job title, employer, business email address, telephone number (where provided), enquiry details and the contents of communications with us, including requests, complaints, data protection rights requests and related correspondence, held in our business communications and relationship-management systems.
Marketing and communications data	Your preferences in receiving marketing from us, records of consent or objections, and your communication preferences. We distinguish communications necessary to manage an enquiry or business relationship from optional direct marketing.

We may collect, use and share aggregated or genuinely anonymised information that does not identify any individual and cannot reasonably be used to do so. Clinical-trial and registry patient datasets are intended to be received only in genuinely anonymised form. We prohibit any attempt to de-anonymise these datasets or re-identify an individual from those datasets. If information described as anonymised is later found to be personal data, we will take appropriate steps in accordance with applicable data protection law, which may include restricting access, assessing and documenting a lawful basis, and providing any required transparency information. We will delete, return or further anonymise the information where lawful processing cannot be established.

Automated decision-making: We do not currently make decisions about you based solely on automated processing that produces legal or similarly significant effects. If this changes, we will provide the information and safeguards required by data protection law.

Information about other people: If you give us personal data about another person, such as a colleague, client representative, expert or supplier contact, please ensure that you are entitled to do so and that they are aware of this Privacy Policy before sharing their information with us.

If you do not provide information: Where we need personal data to respond to an enquiry, enter into or perform a contract, make a payment, meet a legal obligation or otherwise provide our services, and you do not provide it, we may be unable to proceed. We will make clear where information is optional.

Children: Our website and services are intended for business users and are not directed at children. We do not knowingly collect personal data directly from children through the website. If you believe a child has provided personal data to us in error, please contact us immediately at contact@ammonite-insights.com.

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.

4Sensitive Data

Sensitive personal data (also known as special category data) means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; and data concerning a person’s sex life or sexual orientation.

We do not ordinarily seek special category data about business contacts. Clinical-trial and registry patient datasets are intended to be genuinely anonymised and therefore outside data protection law. If we need to process special category data in another context, or information thought to be anonymised is found to contain it, we will identify both an Article 6 lawful basis and an Article 9 condition, apply appropriate safeguards and provide any further information required by law.

Please do not provide special category data to us through our website, contact forms, email or other communications unless it is specifically requested and relevant to the stated purpose. If you provide unsolicited special category data, we will delete or restrict it where it is not needed. Where retention is necessary, for example to establish, exercise or defend legal claims or address a serious complaint, we will process it only to the extent required and under an applicable Article 9 condition.

Criminal offence data: We do not ordinarily ask for information about criminal convictions or offences. If such processing becomes necessary, for example for proportionate compliance checks, we will process it only where authorised by UK law and with appropriate safeguards.

Due diligence and compliance: We may carry out proportionate checks on clients, suppliers, contractors, KOLs or experts where necessary to protect our business, manage conflicts or comply with law. We will limit the information collected, use reliable sources and provide additional information where the nature of a check requires it.

5How your personal data is collected

We use different methods to collect data from and about you, including through:

Your interaction with us: We collect personal data from you directly when you use our website or contact form, make or respond to an enquiry, discuss or receive services, enter into a contract, provide professional or research contributions, submit an invoice or payment information, meet us at an event, make a complaint, exercise your data protection rights, subscribe to marketing or otherwise correspond with us by email, telephone or another stated channel.
Automated technologies or interactions: As you interact with our website, online forms, hosting, security and analytics tools may automatically collect limited technical data about your equipment, browsing actions and patterns using cookies, server logs or similar technologies. For further details, see our Cookies Policy.
Other people and third parties: We may receive personal data about you from your employer or colleagues, clients, suppliers, contractors, professional advisers, conference organisers, publicly available professional sources, business databases, payment providers and other service providers. We may also receive your details through a referral or introduction. Where appropriate, we will tell you the source.

6How and why we use your personal data

Under data protection law, personal data may be processed only where there is a lawful basis. We act as controller for the processing needed to manage enquiries and relationships, develop and provide consultancy services, commission and use professional research contributions, administer contracts, payments and records, operate and secure our website and systems, market our services appropriately, establish or defend legal claims and comply with law. Depending on the activity, we rely on one or more of the following lawful bases:

where you have given consent
to comply with our legal and regulatory obligations
for the performance of a contract with you or to take steps at your request before entering into a contract, or
for our legitimate interests or those of a third party

A legitimate interest is a business or commercial reason to use your information, provided it is not overridden by your rights and interests. We carry out and document an assessment where required. Our legitimate interests include developing and providing consultancy services, managing professional relationships, commissioning and using expert contributions, understanding demand, improving our website and services, preventing fraud or misuse, securing systems, maintaining records, resolving complaints and communicating with business contacts. You can obtain further information by contacting us (see ‘How to contact us’ below).

The table below explains what we use your personal data for and why.

What we use your personal data for	Our reasons
Create and manage records for contacts, clients, prospective clients, suppliers, contractors, KOLs, experts and other research contributors	To perform our contract with you or to take steps at your request before entering into a contract (where applicable)
Respond to enquiries; prepare proposals; negotiate, enter into and perform contracts; develop and provide consultancy services and deliverables; manage client, supplier and contractor relationships; identify, engage and pay KOLs, experts and other contributors; conduct interviews and research; administer invoicing and payments; and handle feedback, complaints and disputes.	To perform our contract with you or take steps at your request before entering into it; for our legitimate interests in developing and providing our services, managing professional relationships, obtaining relevant expertise, communicating with business contacts and administering our business; and to comply with legal obligations where applicable. Where consent is the appropriate basis for a particular recording or optional activity, we will ask for it separately.
To enforce legal rights or defend or undertake legal proceedings	Depending on the circumstances: to comply with our legal and regulatory obligations in other cases, for our legitimate interests or those of a third party, i.e. to protect our business, interests and rights or those of others
Sending marketing communications where permitted (see ‘Marketing’ below)	Depending on the circumstances: where required by PECR, consent; otherwise, our legitimate interests to promote and grow our business (subject to your right to opt out at any time).
Carry out proportionate website analytics, service improvement, business development and market research using usage data, voluntary feedback and any consented analytics technologies	Necessary for our legitimate interests in understanding use of our website, markets and services and in improving and developing our business; consent where required for non-essential cookies or analytics technologies.
Communications with you not related to marketing, including responses to enquiries, project and relationship communications, service messages, policy updates and important notices	Depending on the circumstances: to comply with our legal and regulatory obligations; to perform our contract with you (where applicable); or for our legitimate interests in providing customer support and operating our business.
Protect the security of systems and data	To comply with our legal and regulatory obligations and, where appropriate, for our legitimate interests in protecting systems and data and preventing and detecting fraud and other criminal activity.
Operational reasons, such as improving workflows and quality, maintaining audit trails, and handling enquiries, complaints and data protection rights requests	For our legitimate interests or those of a third party, i.e., to be as efficient as we can so we can deliver the best service to you
Statistical analysis to help us manage our business, for example in relation to demand, enquiries, projects, service performance and operational efficiency	For our legitimate interests or those of a third party, i.e. to operate efficiently, deliver high-quality services and improve and develop our business
Keeping business-contact and relationship records accurate and up to date	Depending on the circumstances: to perform our contract with you (where applicable); to comply with our legal and regulatory obligations; or for our legitimate interests in maintaining accurate records and delivering our services.
Comply with our legal and regulatory obligations (including responding to lawful requests and meeting applicable record-keeping requirements)	To comply with our legal and regulatory obligations. To support corporate governance and, where necessary, to share information in connection with a significant corporate transaction or restructuring.
To share your personal data with professional advisers, potential counterparties and other relevant third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale or insolvency. We will require any such recipient to protect the information and use it only as permitted by law. In such cases, information will be shared only where necessary and, where possible, anonymised or aggregated.	Depending on the circumstances: to comply with our legal and regulatory obligations in other cases, for our legitimate interests or those of a third party, i.e., to protect, realise or grow the value in our business and assets

See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.

7Marketing

We may send necessary communications about an enquiry, proposal, contract, project, invoice, payment, professional relationship, policy update or service announcement. We may separately send news, insights, invitations or promotional communications where permitted by law. Necessary business communications are not direct marketing merely because they are sent by email.

Where required by PECR, we will obtain your consent before sending direct marketing by email, SMS or similar electronic means. In other cases, including appropriate business-to-business communications to corporate subscribers, we may rely on our legitimate interests in promoting our services, subject to your right to opt out at any time. We will seek consent where required for non-essential cookies or similar technologies and keep records of your choices. For more information, see our Cookies Policy.

You will have the right to opt out of receiving marketing communications at any time by:

contacting us using the details in ‘How to contact us’ below and asking us to stop
using the ‘unsubscribe’ link included in all marketing emails you may receive from us

We will not sell your personal data to third parties for their own direct marketing purposes.

For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.

8Who we share your personal data with

We share personal data only where necessary for the purposes set out in this Privacy Policy. Recipients may include clients and prospective clients where relevant to a project or proposal; suppliers, contractors, KOLs, experts and other research contributors; banks and payment-service providers; insurers, accountants, lawyers and other professional advisers; website, form, hosting, cloud, email, communications, document-management, relationship-management, analytics, security and IT-support providers; conference or event partners where appropriate; prospective buyers, investors or transaction counterparties; and regulators, law-enforcement bodies, courts or other persons where required or permitted by law. Some recipients act as independent controllers and must provide their own privacy information. Where a service provider acts as our processor, we use a written contract meeting Article 28 of the UK GDPR and require the provider to act only on our documented instructions, keep data secure and assist us with our legal obligations.

We only allow service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to support the purposes described in this policy.

We or the third parties mentioned above may occasionally also need to share your personal data with:

external auditors, for example in relation to the audit of our accounts or company, who will be bound by confidentiality obligations
professional advisers (such as lawyers and other advisers)—the recipient of the information will be bound by confidentiality obligations
law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations
other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. Information will be anonymised or minimised where practicable, but this may not always be possible; in any event, the recipient of the information will be bound by confidentiality obligations

If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).

We do not share your personal data with third parties except as described in this Privacy Policy (as updated from time to time) or where required or permitted by law.

9How long your personal data will be kept

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable UK legal, regulatory, tax, accounting and reporting requirements.

We maintain and review retention criteria rather than setting periods in this public notice that may not apply in every case. We consider the nature, amount and sensitivity of the information; the risk of harm from unauthorised use or disclosure; the purposes of processing; the duration of the relevant enquiry, project, contract or business relationship; applicable limitation periods; legal-hold or dispute requirements; and whether the purpose can be achieved by other means. Enquiry and business-contact records are reviewed when no longer active; contract, project, payment and invoicing records are retained as needed for administration and legal compliance; KOL, expert and research-contribution records are retained for the relevant project and legitimate follow-up needs; security logs are kept only as needed for security and troubleshooting; and marketing opt-outs are retained in minimal form so that we can respect them. Data that is no longer needed is deleted or anonymised securely.

As a general guide, where no longer or shorter period is required, we typically retain personal data for up to 6 years from the end of the relevant enquiry, contract or business relationship, reflecting applicable tax, accounting and limitation requirements. Shorter periods apply to transient data (such as website analytics and security logs), and longer periods may apply where a legal hold, dispute or specific legal obligation requires it.

Following the end of the applicable retention period, we will delete or anonymise personal data in accordance with applicable data protection requirements, unless we are required to retain it (for example, due to legal obligations or a legal hold).

10Transferring your personal data out of the UK

We host personal data on servers located in the UK. It is our policy not to transfer personal data outside the UK, nor to permit access to it from outside the UK, and we will assess the location and access arrangements of service providers before use. If in future it becomes necessary to transfer personal data to, or allow access from, a country outside the UK, we will do so only where this is necessary and lawful and an appropriate UK transfer mechanism is in place. Depending on the circumstances, this may be an applicable UK adequacy regulation, the International Data Transfer Agreement (“IDTA”), the UK Addendum to the EU Standard Contractual Clauses or another mechanism permitted by UK law, together with a transfer risk assessment and supplementary technical, organisational or contractual measures where appropriate. You can contact us for more information about the safeguards we use.

Under UK data protection law, we can only transfer your personal data to a country outside the UK where: the UK government has made regulations approving transfers to that country (known as ‘adequacy regulations’); there are appropriate safeguards in place (such as the IDTA or the UK Addendum to the EU Standard Contractual Clauses), together with enforceable rights and effective legal remedies for you; or a specific exception applies under UK data protection law. For completeness:

The EEA: we may rely on the UK adequacy regulations in respect of EEA countries (where applicable).
Other countries: we will put in place appropriate safeguards (such as the IDTA and, where required, a TRA) and other measures required by UK data protection law.

In the event that we could not continue to rely on either of those mechanisms at any time, we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative mechanism or exception provided by UK data protection law.

11Your rights

You generally have the following rights, which you can usually exercise free of charge. We are the controller of the personal data described in this policy and you can direct any request to us. For more information about these rights, please visit the ICO website at https://ico.org.uk/for-the-public/.

Access to a copy of your personal data	The right to be provided with a copy of your personal data.
Correction (also known as rectification)	The right to require us to correct any mistakes in your personal data.
Erasure (also known as the right to be forgotten)	The right to require us to delete your personal data—in certain situations.
Restriction of use	The right to require us to restrict use of your personal data in certain circumstances, e.g. if you contest the accuracy of the data.
Data portability	The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations.
To object to use	The right to object: at any time to your personal data being used for direct marketing (including profiling) in certain other situations to our continued use of your personal data, e.g. where we use your personal data for our legitimate interests.
Rights relating to automated decision-making	Where a significant decision about you is based solely on automated processing (including profiling), the right to be informed of the decision, to make representations about it, to obtain human intervention and to contest it. Additional restrictions apply where such a decision is based on special category data. We do not currently make such decisions.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR.

Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

If you would like to exercise any of those rights, please use the details under ‘How to contact us’ below. We may need to verify your identity before responding. When contacting us, please:

provide enough information to identify yourself (for example, your full name, email address and telephone number used in your enquiry) and any additional information we reasonably need to verify your identity, and
let us know which right(s) you want to exercise and the information to which your request relates

Please send requests using the details in ‘How to contact us’ below. We will respond without undue delay and normally within one month of receiving your request (or, where we reasonably need to verify your identity or clarify the scope of the request, within one month of receiving the necessary clarification). We may extend the response period by a further two months where permitted because of the complexity or number of requests. If an extension applies, we will tell you and explain why. Where required, we will notify recipients of any correction, erasure or restriction unless this proves impossible or involves disproportionate effort.

12Keeping your personal data secure

We use appropriate technical and organisational measures to protect personal data and keep those measures under review. These include, where appropriate, access controls, authentication measures, secure transfer and storage, supplier due diligence and contracts, data minimisation, confidentiality obligations and incident-response procedures. However, no internet transmission or storage system can be guaranteed completely secure.

We have procedures to deal with any suspected personal data breach. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. We will notify you without undue delay where a breach is likely to result in a high risk to your rights and freedoms.

13How to complain

If you have any questions, concerns or complaints about our use of personal data, please contact us using the details in ‘How to contact us’ below. We will investigate and respond without undue delay. You do not have to contact us before complaining to the ICO.

You have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

The Information Commissioner can be contacted at https://ico.org.uk/make-a-complaint or by telephone at 0303 123 1113.

14Changes to this privacy policy

We may change this privacy policy from time to time to reflect updates in our services, processing activities, suppliers or legal requirements. We will publish the updated version on our website and, where appropriate, bring material changes to the attention of affected individuals. We will obtain fresh consent where required. The updated policy will state its version and effective date.

15How to contact us

You can contact us by post or email if you have any questions about this privacy policy or the information we hold about you, or if you wish to exercise your rights under data protection law or make a complaint.

Our contact details are shown below:

AMMONITE INSIGHTS LIMITED, 28 Bagdale, Whitby, North Yorkshire, England, YO21 1QL
contact@ammonite-insights.com