Privacy notice

This notice explains how Impact Allies collects, uses and looks after personal data when you visit our website, get in touch, or work with us. It is written to comply with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

The short version

• We only collect the information you give us through our forms or by emailing us.
• We use it to reply to you, do the work you have asked us to do, and keep records of our conversations.
• We do not sell your data, we do not run marketing profiling, and we currently do not use analytics or advertising cookies on this site.
• You can ask us to see, correct or delete your data at any time.

Who we are

The data controller is Impact Allies Ltd, registered in England & Wales, company number 17422708. You can contact us at hello@impactallies.uk for anything to do with your personal data. We are a small team, so this goes directly to the people who can help.

What personal data we collect

When you use the contact form

• Your name
• Your work email address
• The name and type of your organisation
• The service areas you are interested in
• The challenge you described in the message field

When you request an Impact Check

• Your name
• Your work email address
• Your phone number (optional)
• The name of your organisation
• Your website URL
• The message you sent us about what you need

When you email us directly

Whatever you choose to include: your name, email address, and the content of your message.

When you visit the website

Our host, Vercel, records standard server logs (IP address, browser user-agent, requested URL, timestamp) for security, debugging and abuse-prevention purposes. These logs are held for a short period and are not linked to any account or identity by us.

Why we use it, and our lawful basis

• To reply to your enquiry and deliver the service you have asked for. Lawful basis: performance of a contract, or steps taken at your request before entering into a contract (UK GDPR Article 6(1)(b)).
• To keep records of our client relationships, quotes, invoices and correspondence. Lawful basis: legitimate interests (running our business responsibly, resolving disputes, tax record keeping) and, where applicable, legal obligation (UK GDPR Article 6(1)(f) and 6(1)(c)).
• To keep the website online and secure. Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)).
• To send you information you specifically asked for. Lawful basis: consent, which you can withdraw at any time.

We do not use your data for automated decision-making or profiling, and we do not use it for advertising.

Who we share it with

We use a small number of trusted service providers ("processors") to run the site and communicate with you. They only handle your data on our instructions.

• Vercel Inc. — website hosting and server logs. Vercel is based in the United States; data may be processed in the US and other regions under Standard Contractual Clauses.
• Resend — the service that sends and receives our transactional email (form notifications, confirmations, replies to you). Resend processes data in the United States and the EU under Standard Contractual Clauses.
• Our email inbox provider — the email service where hello@impactallies.uk lives.

We do not share your personal data with anyone else unless we are required to by law (for example, a valid request from a UK regulator or court).

International transfers

Where our processors are based outside the UK or EU (mainly the US), we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent safeguard, to protect your data to UK GDPR standards.

How long we keep it

• Enquiries that do not become clients: we keep the form submission and any related emails for up to 24 months, then delete them.
• Client records, contracts, quotes and invoices: we keep these for up to 7 years after the last engagement, to meet UK tax and accounting record-keeping requirements.
• Server logs (via Vercel): retained for a short period (typically no longer than 30 days) for security and debugging.
• Email: emails you send us are kept in our mailbox for the life of the relationship, or up to 24 months for one-off enquiries.

Cookies

This site sets only the cookies it needs to function. There are no advertising cookies. See the cookies page for the full list, and, where required, we will ask for your consent before setting anything else.

Analytics

We run our own first-party analytics — no Google Analytics, no third-party trackers, no cookies for tracking. To understand what's working on the site we record page requests, the URLs people arrive from, viewport size, country, and clicks on key buttons. To count return visits within a single day we compute a short hash of your IP address and browser string with a salt that changes every 24 hours; the hash cannot be reversed and cannot identify you across days. Your IP address itself is used briefly by our server to derive the hash and detect bots and is not written to the database. Aggregated analytics rows are kept for 12 months and then deleted automatically. You can opt out at any time by visiting impactallies.uk/?ia_no_track=1 — the setting is stored in your browser only.

Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you
• Ask us to correct anything that is wrong
• Ask us to delete your data, where we are not required to keep it
• Ask us to restrict how we use your data
• Object to processing based on our legitimate interests
• Ask us to move your data to another provider (data portability)
• Withdraw your consent at any time, where consent is the basis we are relying on

To exercise any of these rights, email hello@impactallies.uk. We will reply within one month, or tell you if we need a bit longer and why.

How to complain

If you are unhappy with how we have handled your personal data, please tell us first by emailing hello@impactallies.uk with the subject line "Privacy complaint". We will acknowledge your complaint within five working days and give you a full response within 30 days.

If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Security

Personal data is transmitted over HTTPS and stored with providers who meet recognised security standards. Access to your data inside our team is limited to the people who need it to do their work. We review our setup regularly and act quickly on anything that looks off.

Children

This site and the services we offer are aimed at organisations and the people who run them. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, email us and we will delete it.

Changes to this notice

We update this notice whenever the way we handle data changes in a meaningful way. The date at the top of the page always reflects the most recent version.

Contact

Questions about privacy, or want to exercise any of the rights above? Email hello@impactallies.uk. A real person will read it.