Privacy Policy

Principal Risk Management is the trading name of Principal Compliance Ltd. This Privacy Policy explains how we collect, use, store and protect personal information when you use our website, contact us, receive communications from us, or use our services.

We are committed to handling personal information lawfully, fairly and transparently.

Who we are

Principal Compliance Ltd is registered in England and Wales under company number 12752368. Our registered office is The Carriage House, Mill Street, Maidstone, Kent, England, ME15 6YE.

For the purposes of UK data protection law, Principal Compliance Ltd is the controller of the personal information described in this notice.

Where we provide services to clients and process personal information only on their written instructions, we may act as a processor. In those circumstances, the relevant client contract or data processing agreement will apply.

If you have any questions about this Privacy Policy or how we use personal information, please contact us:

Privacy Lead Principal Risk Management Email: privacy@principalrisk.co.uk Post: The Carriage House, Mill Street, Maidstone, Kent, England, ME15 6YE

The personal information we collect

We may collect and use the following types of personal information, depending on how you interact with us.

Contact details: Name, email address, telephone number, business address and correspondence details.
Business information: Job title, employer, organisation, industry, professional interests and business relationship with us
Enquiry and service information: Information you provide in website forms, emails, telephone calls, meetings, service enquiries, proposals, contracts, onboarding documents, feedback and other communications.
Marketing preferences: Newsletter subscriptions, marketing preferences, opt-ins, opt-outs, areas of interest and engagement with our communications.
Website and technical information: Internet protocol address, browser type and version, device type, operating system, pages visited, dates and times of visits, referring pages, cookie identifiers and website security logs.
Financial and administrative information Billing details, invoice information, payment status, purchase records and accounting records
Recruitment information: Information you provide if you contact us about working with us, such as your CV, employment history, qualifications, professional experience and related correspondence.

We do not intentionally collect special category personal information through our website, such as information about health, race or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data or sexual orientation. Please do not include this type of information in website forms or general enquiries unless it is necessary for the specific matter you are contacting us about.

How we collect personal information

We collect personal information in the following ways:

Directly from you, when you complete a website form, send us an email, call us, attend a meeting, request information, subscribe to updates, provide feedback, apply to work with us, or otherwise communicate with us.
Through our website, including through server logs, cookies and similar technologies.
From clients, suppliers and business contacts, where they provide your details to us in connection with our services or business relationship.
From publicly available business sources, such as company websites, professional networking platforms and public registers, where relevant to our business activities.

You do not have to provide personal information to browse our website. However, if you do not provide information requested in a form, enquiry, onboarding process or service interaction, we may not be able to respond to you, provide information, or deliver services.

Cookies and similar technologies

Our website may use cookies, pixels, tags, server logs and similar technologies.

Some cookies and technical tools are necessary for the website to work properly, maintain security, remember basic settings and deliver the pages you request. Where we use non-essential cookies or similar technologies for analytics, marketing or preference purposes, we will ask for your consent unless the law allows otherwise.

You can manage your cookie choices using the cookie controls available on our website. You can also control cookies through your browser settings. Blocking some cookies may affect how the website works.

Where we use a separate Cookie Policy or cookie preference centre, it will provide more detailed information about the cookies and similar technologies used on our website, including their purpose and duration.

How we use personal information and our lawful bases

We will only use personal information where we have a lawful basis to do so under UK data protection law. The lawful basis we rely on will depend on the purpose for which we use the information.

We may use personal information to operate, maintain and secure our website. This includes using website and technical information to deliver web pages, monitor website performance, maintain security, prevent misuse, detect suspicious activity and protect our systems. We rely on our legitimate interests in running a secure and effective website. Where we are required by law to keep security or incident records, we may also rely on legal obligation.

We may use personal information to respond to enquiries, requests and communications. This includes using contact details, business information and enquiry information to reply to messages, provide information, arrange calls or meetings, and deal with requests submitted through our website or by email, telephone or other communication channels. We rely on our legitimate interests in responding to enquiries and managing business communications. Where your enquiry relates to services you may buy from us, we may also rely on taking steps before entering into a contract.

We may use personal information to provide services and manage client relationships. This includes using contact details, business information, service information and administrative information to deliver our services, communicate with clients and client contacts, manage projects, provide advice or support, handle service records, and maintain the client relationship. Where we contract directly with an individual, we may rely on contract. Where we deal with business clients, client personnel or other professional contacts, we usually rely on our legitimate interests in providing services and managing business relationships. We may also rely on legal obligation where we need to keep records for tax, accounting, regulatory or other legal purposes.

We may use personal information for billing, accounting and business administration. This includes using contact details, business information, payment information, invoice information and related correspondence to issue invoices, manage payments, maintain accounting records, administer our business and meet financial reporting requirements. We rely on legal obligation where we are required to keep accounting, tax or business records. We may also rely on our legitimate interests in managing our business, finances and administration.

We may use personal information to send service-related communications. This includes sending information about services you have requested or receive from us, changes to arrangements, meeting details, administrative updates, policy updates, contractual notices or other communications relevant to our relationship with you or your organisation. We rely on contract where the communication relates to a contract with you. In other cases, we rely on our legitimate interests in managing our services and business relationships.

We may use personal information to send marketing communications. This includes using contact details, business information, marketing preferences and engagement information to send updates, insights, invitations, newsletters or information about our services. We will only send electronic marketing where the law allows us to do so. We rely on consent where consent is required. Where the law permits business-to-business marketing without prior consent, we may rely on our legitimate interests in promoting our services to relevant business contacts. You can opt out of marketing at any time.

We may use personal information to improve our website, services and communications. This includes using website information, technical information, enquiry information, feedback and marketing preference information to understand how people use our website, assess the effectiveness of our communications, improve content, develop our services and improve user experience. We rely on our legitimate interests in improving our website, services and communications. Where we use non-essential cookies or similar technologies, we will rely on consent where required.

We may use personal information to manage complaints, disputes, legal matters and compliance obligations. This includes using relevant personal information to investigate complaints, respond to legal or regulatory requests, maintain records, obtain professional advice, establish or defend legal claims, enforce our rights, and comply with applicable laws. We rely on our legitimate interests in protecting our business, managing risk and defending legal rights. We may also rely on legal obligation where we are required to process or retain information by law.

We may use personal information to consider recruitment enquiries or applications. This includes using contact details, CV information, employment history, qualifications, professional experience and related correspondence to assess suitability, communicate with applicants and manage recruitment decisions. We rely on taking steps before entering into a contract where you apply for a role or opportunity. We may also rely on our legitimate interests in assessing candidates and managing recruitment. Where employment-related checks or records are required by law, we may rely on legal obligation.

Where we rely on legitimate interests, we consider whether our interests are overridden by your rights, freedoms and interests. You can object to processing based on legitimate interests in certain circumstances.

Where we rely on consent, you can withdraw your consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.

Marketing communications

We may send marketing communications about our services, updates, insights or events where the law allows us to do so.

You can opt out of marketing at any time by using the unsubscribe link in our emails or by contacting privacy@principalrisk.co.uk.

If you opt out of marketing, we may keep limited information on a suppression list so that we can respect your preference and avoid sending further marketing to you.

We may share personal information where necessary and proportionate for the purposes described in this Privacy Policy. This may include sharing information with:

website hosting, IT, security and support providers;
email, customer relationship management and marketing platform providers;
professional advisers, including accountants, auditors, insurers and legal advisers;
payment, billing and accounting service providers;
consultants, contractors or suppliers who support the delivery of our services;
clients, suppliers or business contacts where needed to manage the relevant relationship;
HMRC, courts, regulators, law enforcement agencies or public authorities where required by law or necessary to protect our legal rights; and
parties involved in a business sale, purchase, restructuring or similar corporate transaction, where relevant.

We require service providers to protect personal information and only use it for the purposes for which we provide it to them. We do not sell personal information.

How we protect personal information

We use appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, misuse, unauthorised access, alteration, disclosure or destruction.

These measures may include access controls, password protection, secure systems, staff guidance, supplier checks, confidentiality obligations, backups and procedures for handling data protection incidents.

No method of transmission over the internet is completely secure. However, we take reasonable steps to protect personal information and to keep our security arrangements under review.

How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected. This includes keeping information for as long as needed to provide services, manage our relationship with you, respond to enquiries, maintain business records, comply with legal and accounting obligations, resolve disputes, protect our legal rights and meet regulatory or insurance requirements.

Website enquiries and general correspondence are usually kept for up to 24 months after the last meaningful contact, unless the enquiry becomes part of a client relationship or a longer period is needed for legal, regulatory, insurance or dispute-resolution reasons.

Client and service records are usually kept for the duration of the client relationship and for up to 6 years afterwards. We may keep them for longer where this is necessary to comply with legal or regulatory obligations, respond to a dispute, deal with an investigation, maintain insurance records, or protect our legal position.

Financial and accounting records are usually kept for 6 years from the end of the relevant financial year, unless a longer period is required by law or is necessary for tax, accounting, audit, dispute-resolution or regulatory purposes.

Marketing records are kept for as long as we need them for marketing, relationship management and preference management. If you unsubscribe, object to marketing or withdraw consent, we may keep limited information on a suppression list so that we can respect your preference and avoid contacting you again for marketing purposes.

Website technical, security and analytics information is kept for the period needed to operate, secure, monitor and improve our website. Where cookies or similar technologies are used, the relevant cookie information or cookie preference tool should explain the duration of those technologies where applicable.

Recruitment information is usually kept for up to 6 months after the recruitment process ends, unless we agree a longer period with you or a longer period is needed for legal, regulatory or dispute-resolution reasons.

Complaint, dispute and legal matter records are kept for the duration of the matter and for as long as needed afterwards to protect our legal position, comply with legal obligations, maintain appropriate records, or deal with related proceedings or enquiries.

When deciding how long to keep personal information, we consider the amount, nature and sensitivity of the information, the purpose for which it was collected, the risk of harm from unauthorised use or disclosure, applicable legal and regulatory requirements, limitation periods for legal claims, and whether the information can be deleted, anonymised or securely archived.

When personal information is no longer required, we will delete it, anonymise it or securely dispose of it.

Your rights

Subject to certain conditions and exemptions, you may have the following rights under UK data protection law:

Access: to request a copy of the personal information we hold about you.
Rectification: to ask us to correct incomplete or inaccurate personal information.
Erasure: to ask us to delete personal information in certain circumstances.
Restriction: to ask us to restrict how we use personal information in certain circumstances.
Objection: to object to certain processing, including processing based on legitimate interests and direct marketing.
Portability: to receive certain personal information in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation where technically feasible.
Withdraw consent: to withdraw consent where we rely on consent as our lawful basis.
Complain: to complain to us or to the Information Commissioner’s Office.

These rights are not absolute and may not apply in every situation.

To exercise your rights, please contact privacy@principalrisk.co.uk. We may need to ask for information to confirm your identity before responding. We will usually respond within one calendar month, although this may be extended where a request is complex or you have made multiple requests.

Automated decision-making

We do not use personal information to make solely automated decisions that have legal or similarly significant effects on you.

Children

Our website and services are intended for business users and are not aimed at children. We do not knowingly collect personal information from children through our website.

Our website may contain links to third-party websites, social media pages or external resources. Those third parties are responsible for their own privacy and cookie practices. We recommend that you read their privacy notices before providing personal information to them.

Complaints

If you have a concern or complaint about how we use personal information, please contact us first at privacy@principalrisk.co.uk so that we can investigate and respond.

We will acknowledge data protection complaints within 30 days of receiving them and respond without undue delay. We may ask you for further information where needed to understand or investigate your complaint.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection:

Information Commissioner’s Office Website: https://ico.org.uk/make-a-complaint/ Telephone: 0303 123 1113 Post: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be published on this page with the date it was last updated.