TERMS & PRIVACY
Privacy Notice
This notice explains how Thornton & Lowe Limited uses personal information connected with procurementconsultancy.org and the services offered through it. It covers visitors, account holders, clients, prospective clients, professional contacts and delivery partners.
Version 1.0 · Effective 19 October 2026
1. Who are we?
Thornton & Lowe Limited, company number 07600205, is the controller where we decide why and how personal information is used. Our address is The Wellsprings, Howell Croft South, Bolton, Greater Manchester, BL1 1SB. Email hello@thorntonandlowe.com or call 01204 238 046 for privacy questions, rights requests or complaints.
T&L Procurement and Procurement Desk are service names of Thornton & Lowe Limited. We explain any relevant involvement of another group company in the information provided for the service.
Where we process personal information solely on a client’s instructions, that client is the controller and our Data Processing Schedule governs our processor role. We will assist the client with relevant rights requests. The same engagement can involve separate controller activities, such as our own invoicing and security records.
2. What personal information do we collect?
Depending on the service, we use names, professional contact details, employer, role, account identifiers and security information; correspondence, enquiry details, proposals and service records; orders, billing and transaction information; tool inputs, submitted documents and generated outputs; learning answers, scores, completion dates and optional reflections; and technical information such as IP addresses, device and browser details, access logs, preferences and cookie information.
Professional directory information can include a named contact’s role, business contact details and connections with contracts or organisations. Information about an organisation may also be personal information if it identifies a sole trader or a named business contact.
We receive information from you, your employer or authorised colleagues, clients, suppliers and partners. We may also obtain relevant professional information from public procurement notices, company websites, Companies House and licensed information providers. We create service, support and administration records through our dealings with you. Where we obtain personal information indirectly, we provide the privacy information required by law, including its source, unless a documented legal exception applies.
3. Why do we use your information?
We use personal information to provide requested services, manage our business relationships and meet our legal obligations. The table explains our lawful basis for each purpose. Where you act for an organisation, we normally rely on our legitimate interests to manage business contacts.
Accounts and access
Information involved: Identity, contact, account and subscription records
Lawful basis: Contract where you are the contracting individual; otherwise legitimate interests in administering organisational access
Enquiries and service delivery
Information involved: Correspondence, project information and business contacts
Lawful basis: Contract or steps you request before a contract, where applicable; otherwise legitimate interests in responding and delivering agreed services
Learning and member support
Information involved: Answers, scores, dates, reflections and support records
Lawful basis: Contract where applicable; otherwise legitimate interests in providing requested learning and account support
Professional information and matching
Information involved: Relevant public or licensed business contact and contract information
Lawful basis: Legitimate interests in relevant procurement research, supplier discovery and professional introductions, subject to an assessment of the impact on people
Security and improvement
Information involved: Access logs, technical events, feedback and usage information
Lawful basis: Legitimate interests in protecting and improving services; consent for device access where required
Billing and legal records
Information involved: Orders, transactions, invoices and associated contacts
Lawful basis: Contract where applicable, legal obligations and legitimate interests in administration and legal claims
Marketing and events
Information involved: Business contact details, interests and preferences
Lawful basis: Consent where required, or legitimate interests where permitted; electronic marketing rules also apply
Our legitimate interests include operating a professional service, managing client relationships, preventing misuse and making relevant procurement information useful. We assess necessity and the effect on individuals. We do not use legitimate interests to override an applicable consent requirement.
Some information is needed to create an account, answer an enquiry or deliver an order. If it is not provided, the requested feature or service may be unavailable. Optional marketing choices and learning reflections are not a condition of core account access.
4. How do working documents and learning records work?
The feature you use determines whether information is processed on your device, sent to our systems or sent to an external provider. Downloading a working file does not itself mean that the file is stored in your account. The current buyer workbench does not save procurement project documents to your account. A separately enabled upload or commissioned service has its own collection point and handling arrangements.
Learning answers, scores from your first attempt, completion dates and optional reflections are linked to your account. The current challenge history retains the latest 100 challenge records. You can download your learning log. Your own account shows your learning history, and authorised staff may access it for support and administration. We will explain any employer or organisation reporting before enabling it.
Avoid including personal or confidential information in free text reflections. General tools are not intended to collect special category information, criminal offence information or personal information about children. If such information is genuinely needed for commissioned work, agree suitable handling and the required legal conditions first.
5. How do we use AI?
If you use a feature that involves AI, the text you enter and relevant information about the task may be sent to OpenAI to generate a response. The feature explains the information involved before you submit it. Relevant staff may also use approved technology for agreed analysis, drafting or transcription under appropriate arrangements.
Only submit information suitable for the feature. We assess provider terms, permitted purposes, access, retention and transfer arrangements for the use involved. Please contact us about the applicable processing arrangements before supplying restricted material.
We do not use the services to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. Tool suggestions and learning scores support human activities and do not themselves approve a procurement or assess professional competence.
6. Who do we share your information with?
We limit access to staff, consultants and service providers who need information for their work. Relevant recipients can include hosting, IT, cloud, email, CRM, security and backup providers; AI and communications providers; payment providers and banks; advisers, accountants, auditors and insurers; and delivery partners or clients where needed for an agreed service.
We share enquiry information with a proposed delivery partner where necessary to fulfil a request and explain the proposed disclosure. We do not make private account details, project documents or learning reflections available to other members for their own marketing. Professional directory information may be visible through the relevant directory service; the directory information explains its source, visibility and permitted use.
We share information within our group only where there is a defined business need and a lawful basis. We may also disclose information where law requires it, to protect legal rights, or under appropriate confidentiality arrangements for a genuine business restructuring or sale. We remain responsible for selecting and managing processors used on our behalf.
7. Do we transfer information outside the UK?
Some providers may process or permit access to information outside the UK. For a restricted transfer we use a lawful mechanism, such as UK adequacy regulations or appropriate contractual safeguards, and undertake any assessment and supplementary measures required by law.
You can contact us for information about relevant destinations and a copy or explanation of the applicable safeguards, subject to necessary redactions.
8. How long do we keep your information?
We keep your information for as long as it is needed for the purpose it was collected and review it regularly. Our retention periods and review criteria are set out below.
Enquiries that do not become work
Normally up to two years after the last meaningful contact
Client and project records
Normally six years after the engagement ends, subject to the agreement and legal requirements
Financial and transaction records
Normally six years, or longer where law requires
Account and learning information
While the account is active; on closure review for deletion or anonymisation, retaining only what is needed for outstanding support, security, contractual or legal matters
Marketing preferences
While relevant and lawful; retain a minimal suppression record after opt out to respect the choice
Directory and professional contact records
Review for relevance and accuracy; correct, restrict or remove information when no longer justified, taking account of provenance and valid objections
Logs, cookies and backup copies
According to the actual purpose, configured expiry and backup cycle recorded for the system; see the Cookie Notice for device storage
We may retain relevant records longer where a law, agreed obligation, complaint or legal claim justifies it. Where we process client data on instructions, we follow the agreed arrangements for its return, deletion and backup. Downloaded files on your own device are controlled by you and are not removed when an account closes.
9. How can you manage marketing and cookies?
Where permitted, we send relevant information about services, resources, training and events. You can stop direct marketing at any time using the unsubscribe link or hello@thorntonandlowe.com. If you unsubscribe from marketing, we will still send necessary messages about your account, security and purchases.
We explain cookies and similar storage in the separate Cookie Notice. Where consent is required, optional technologies must wait for that choice. You can change the applicable preferences using the website controls. See the service information before following an external link or activating an embedded service.
10. How do we protect your information and respect your rights?
We use appropriate technical and organisational measures and restrict access according to business need. No internet service can promise absolute security. We investigate suspected incidents and notify the ICO, affected people and clients where required by law or the agreement.
Depending on the circumstances, you may ask for access, correction, erasure, restriction or portability of your personal information. You may object to processing based on legitimate interests and may withdraw consent where that is the basis used. The right to object to direct marketing is absolute: tell us at any time and we will stop that use. Other rights have conditions and legal exceptions.
Contact hello@thorntonandlowe.com. We may need proportionate identity information to protect your data. We respond within the applicable legal period and explain any lawful extension or exemption. Where another organisation is the controller, we will explain the appropriate route and assist as required.
11. How can you complain?
To make a data protection complaint, email hello@thorntonandlowe.com with the subject “Data protection complaint”, write to our registered office or call us if you need assistance. We will acknowledge it within 30 days, investigate, keep you informed and explain the outcome without undue delay. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or 0303 123 1113.
We update this notice when practices or law change and show the effective version. We will tell you about any material new use of your information before it begins and identify the relevant lawful basis.
Need help?
Email hello@thorntonandlowe.com or call 01204 238 046.