1. About IHMC Digital

IHMC Digital provides independent, management-led advice to small and medium-sized organisations seeking to strengthen digital governance, prepare for artificial intelligence and make informed technology investments.

This Privacy Notice explains how IHMC Digital collects, uses, stores and protects personal information when you:

• visit our website;
• contact us;
• make an enquiry;
• receive information from us;
• become a client or prospective client; or
• interact with us in the course of our consultancy work.

For the purposes of UK data protection law, IHMC Digital is responsible for determining how and why personal information is processed.

General enquiries: info@ihmcdigital.co.uk
Privacy enquiries: iain@ihmcdigital.co.uk

IHMC Digital currently operates within the United Kingdom.

2. Personal information we may collect

We aim to collect only information that is relevant to our business relationship with you.

Depending on how you interact with IHMC Digital, this may include:

• your name;
• job title and role;
• organisation or employer;
• business email address;
• telephone number;
• information supplied through our website contact form;
• correspondence and enquiries;
• meeting notes;
• proposals and quotations;
• contracts and engagement records;
• consultancy and diagnostic information;
• reports and project documentation;
• invoices and payment-related records;
• records of services provided;
• follow-up correspondence; and
• information about your interactions with our website.

We do not intentionally seek special-category personal information unless it is genuinely necessary for a particular engagement.

3. Information collected through our website

Our website may collect limited technical information when you visit it.

This may include:

• IP address;
• browser and device information;
• pages visited;
• date and time of access;
• referral source; and
• general website usage information.

We may use website analytics to understand how visitors use the website and to improve its structure, content and effectiveness.

Where analytics or similar technologies require consent under applicable law, they will only be used where appropriate consent has been obtained.

The website does not currently operate a newsletter mailing list or use embedded services such as video, mapping or scheduling tools.

4. How we obtain personal information

We may obtain information directly from you when you:

• contact IHMC Digital;
• complete a website contact form;
• telephone or email us;
• attend a meeting;
• request information;
• ask us to provide services; or
• enter into a business relationship with us.

We may also obtain business contact information from publicly available sources, including:

• company websites;
• professional directories;
• Companies House;
• professional networking services; and
• other publicly accessible business information.

Public availability does not remove our responsibilities under data protection law. Where information identifies an individual, we will handle it in accordance with this Privacy Notice.

5. Why we use personal information

Responding to enquiries

To respond to questions, requests for information and initial discussions about our services.

Providing consultancy services

To understand an organisation, conduct assessments, provide advice, prepare reports and deliver agreed services.

Managing client relationships

To maintain appropriate contact with clients, arrange meetings, manage engagements and provide follow-up support.

Preparing proposals and contracts

To develop quotations, proposals, statements of work and contractual documentation.

Administration and finance

To maintain appropriate business, accounting, invoicing and taxation records.

Improving our services

To review how our services and website are used and identify opportunities for improvement.

Business development

We may contact organisations or relevant business contacts where we reasonably believe IHMC Digital's services may be relevant to their professional responsibilities or organisational needs.

We do not purchase bulk mailing lists.

We may identify selected business contacts from publicly available information and may send targeted business-to-business communications or follow-up correspondence where permitted by law.

Anyone receiving direct marketing from IHMC Digital may ask us to stop at any time.

6. Our lawful bases for processing

UK data protection law requires us to have an appropriate lawful basis for processing personal information.

Depending on the circumstances, IHMC Digital may rely upon:

Contract

Where processing is necessary to provide services under a contract with you or to take steps at your request before entering into a contract.

Legitimate interests

Where processing is reasonably necessary for the operation and development of IHMC Digital, provided those interests are not overridden by your rights and interests.

Examples may include:

• responding to business enquiries;
• maintaining client relationships;
• improving our services;
• protecting our business and information systems; and
• proportionate business-to-business marketing.

Legal obligation

Where information must be processed or retained to meet legal, taxation, accounting, regulatory or other statutory requirements.

Consent

Where the law requires consent for a particular activity.

Where processing is based on consent, you may withdraw that consent at any time.

7. Business-to-business communications and marketing

IHMC Digital may occasionally contact organisations or business representatives where there is a reasonable connection between their role and the services we provide.

We may use publicly available business contact information for this purpose.

When personal information is used for business-to-business marketing, we will consider our obligations under UK data protection law and the Privacy and Electronic Communications Regulations.

In particular:

• communications will identify IHMC Digital;
• messages will have a genuine business purpose;
• we will not knowingly disguise the source of a communication;
• recipients will be given a straightforward means of asking us not to contact them again; and
• objections to direct marketing will be respected.

Different legal requirements may apply when contacting sole traders and certain partnerships. Where we are uncertain whether a contact is a corporate or individual subscriber, we will take a cautious approach.

We may maintain a limited suppression or “do not contact” record so that people who have opted out are not inadvertently contacted again.

8. Sharing personal information

IHMC Digital does not sell personal information.

We may share information where reasonably necessary with organisations that support our business, including:

• Microsoft 365 services, including Outlook and OneDrive;
• website hosting and technology providers;
• accounting and financial administration services;
• cloud backup providers;
• professional advisers;
• insurers;
• legal advisers; and
• regulatory, government or law-enforcement bodies where required by law.

Where third-party service providers process personal information on our behalf, we expect them to apply appropriate confidentiality, security and data-protection safeguards.

9. Use of artificial intelligence services

IHMC Digital may use artificial intelligence tools, including services such as ChatGPT, to assist with research, analysis, drafting, administration and consultancy activities.

We aim to use such systems proportionately and responsibly.

We do not intentionally submit unnecessary personal, confidential or sensitive client information to public AI services.

Where client information may be used with an AI-enabled service, consideration will be given to:

• the purpose for which the information is being processed;
• data minimisation;
• confidentiality;
• contractual requirements;
• security;
• the provider's data-handling arrangements; and
• whether human review is required.

AI-generated material used within professional work remains subject to appropriate human judgement and review.

10. International processing

IHMC Digital provides services primarily within the United Kingdom.

Some technology providers used by IHMC Digital may nevertheless process or store information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal mechanism and safeguards are in place in accordance with UK data-protection requirements.

11. How long we keep information

We do not retain personal information indefinitely.

Retention periods depend upon the reason for which the information is held.

As a general working policy, IHMC Digital intends to use the following periods:

These periods are guidelines rather than absolute rules. Information may be deleted earlier where it is no longer required, or retained for longer where there is a legitimate legal, contractual or regulatory reason.

We will periodically review the information we hold and delete or anonymise information that is no longer required.

12. Information security

IHMC Digital takes reasonable technical and organisational measures to protect information against:

• unauthorised access;
• accidental loss;
• inappropriate disclosure;
• alteration;
• destruction; and
• misuse.

Measures may include appropriate access controls, authentication, secure cloud services, backup arrangements and proportionate information-governance procedures.

No internet or information system can be guaranteed to be completely secure. We therefore keep our arrangements under review and seek to apply safeguards appropriate to the nature of the information being handled.

13. Your data-protection rights

Depending upon the circumstances, UK data-protection law may give you rights including the right to:

• be informed about how your information is used;
• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to certain processing;
• object to direct marketing;
• request transfer of certain information where the right to data portability applies; and
• withdraw consent where processing is based upon consent.

These rights are not absolute and may depend upon the circumstances and the lawful basis under which information is being processed.

To exercise a data-protection right, contact: iain@ihmcdigital.co.uk

We may need to verify your identity before releasing or changing personal information.

14. Complaints

If you have concerns about how IHMC Digital uses your personal information, please contact us first so that we have an opportunity to investigate and respond.

Privacy enquiries: iain@ihmcdigital.co.uk

You also have the right to raise a concern with the UK Information Commissioner's Office.

Further information is available from the Information Commissioner's Office .

15. Information Commissioner's Office registration

IHMC Digital is currently reviewing whether registration and payment of the data-protection fee to the Information Commissioner's Office is required.

This Privacy Notice will be updated where appropriate following that review.

16. Changes to this Privacy Notice

We may amend this Privacy Notice as our services, systems or legal obligations change.

The current version will be published on the IHMC Digital website together with its revision date.

Last updated: September 2026