VCM Privacy Notice

Value Chain Management Ltd ("VCM", "we", "us") is the controller of the personal data described in this notice. VCM is registered in England and Wales, company number 12585576, registered office 45 Gatehill Gardens, Luton, LU3 4EZ.

VCM is registered with the Information Commissioner's Office under registration number ZB341943.

If you have any questions about this notice, or about how we handle your personal data, contact us at info@valuechainmanagement.co.uk.

This notice covers the personal data we handle when you:

• visit our website or contact us through it
• complete the VCM Business Readiness Questionnaire
• request a Business Readiness Assessment or any paid diagnostic, training or advisory service
• engage us for services, or correspond with us
• receive marketing from us, or opt out of it

Identity and contact details: first name, last name, business name, business email address, telephone number and business address.

Questionnaire and assessment responses: your answers, the result produced for you, and any free-text you choose to provide.

Follow-up detail: your preferred contact method, and anything you tell us about your requirements.

Marketing: your marketing preference, and any withdrawal of it.

Technical data: a limited amount of technical information collected by our website and by the questionnaire platform, such as device and usage data. See section 9.

Telephone number and business address are optional on the free questionnaire. We ask for what we need for the purpose in front of us, and we do not ask for detailed commercial or operational information at questionnaire stage.

We produce a score and a readiness band from your answers; that output is personal data and is treated as set out in this notice.

Where you have not given us your details directly, for example where a membership organisation or a business contact has provided them to us, we tell you the source when we first contact you.

To administer the questionnaire, produce your result and give it to you: legitimate interests (Article 6(1)(f) UK GDPR). The questionnaire is an initial self-assessment tool. It is not legal, financial, tax, procurement, technical or other professional advice, and taking part does not create any obligation on either side.

To deal with any follow-up you request, and to answer enquiries: legitimate interests (Article 6(1)(f)).

To send you marketing: where you are an individual, for example a sole trader or a partnership, we rely on your consent (Article 6(1)(a)) together with the Privacy and Electronic Communications Regulations. For marketing to a corporate body, we rely on legitimate interests with a working opt-out in every message. Consent is never a condition of taking part in the questionnaire, and both are recorded separately.

To provide paid assessments, diagnostics, training and advisory services, and to administer those engagements: performance of a contract (Article 6(1)(b)).

To keep our records, meet tax, accounting and company law obligations, and run our business: legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)).

To improve our tools, methods and services: legitimate interests (Article 6(1)(f)).

Where we rely on legitimate interests, we have balanced our interests against your rights and expectations, and we do not use your data in ways you would not reasonably expect. You can object at any time (see section 8).

You have an absolute right to object to direct marketing at any time.

We do not collect special category data through the questionnaire or our website. We do not carry out automated decision-making, and we do not use your data to produce legal or similarly significant effects by automated means.

We do not sell your personal data.

We do not share your individual questionnaire responses or your result with buyers, prospective buyers, or any other organisation for its own purposes. That is a commitment, not a default we reserve the right to change quietly.

We may share personal data with:

Service providers who process it on our written instructions: our questionnaire platform provider, our website hosting and analytics provider, our email and IT providers, and our accountants. Each is bound by contract to act only on our instructions.

Professional advisers, such as our legal advisers, where we need advice.

Public authorities, where the law requires us to provide it.

Some of our service providers may process personal data outside the UK. Where they do, we put appropriate safeguards in place before any transfer, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We review those arrangements periodically.

Questionnaire responses and the contact details you give us: 12 months from submission, then securely deleted or anonymised. Nothing is kept “just in case”.

Where you ask for a paid Business Readiness Assessment, or an engagement begins: your data moves to a separate prospect or client record, which has its own retention period as set out next.

Prospect, client, engagement and financial records: 6 years from the end of the relationship, or from the end of the relevant financial year, so that we can meet statutory, tax and accounting requirements.

Marketing preferences and records of withdrawal: kept while your consent stands or your objection applies, and we keep a suppression record for longer so that we can honour your choice.

Enquiries that do not progress: 12 months.

We operate a documented deletion and anonymisation process. Retention is not left to a platform setting alone.

You have the right to:

• access the personal data we hold about you, and receive a copy
• have inaccurate data corrected
• have your data erased where there is no good reason for us to keep it
• restrict how we use your data
• receive your data in a portable format
• object to processing based on legitimate interests, including profiling
• withdraw consent at any time, where consent is the basis
• complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113)

To exercise any of these, contact info@valuechainmanagement.co.uk. We will respond within one month. Withdrawing consent or objecting does not affect the lawfulness of anything done before that point.

Our website and the questionnaire platform use cookies and similar technologies. Some are needed for the site to work. Others measure how the site is used, and those are used only where permitted. You can control cookies through your browser settings. A full cookie list will be published on this page alongside the site migration.

The site itself sets no first-party cookies: the valuechainmanagement.co.uk pages set no cookies of their own.

The questionnaire platform sets three cookies when you use the questionnaire:

• _score — remembers your questionnaire session and result so it is not lost between pages. Set for about 6 months.
• __cf_bm — a security cookie set by the platform's content delivery network to distinguish between humans and bots. Set for about 30 minutes.
• _cfuvid — a security identifier set by the same network for the length of your visit. Session only.

No other cookies are set, and no analytics or tracking technologies are active on the site at this time.

We may update this notice. The date at the top of this page shows the latest version, and we will not apply a change retrospectively.

Contact: info@valuechainmanagement.co.uk. Registered office: 45 Gatehill Gardens, Luton, LU3 4EZ.