Privacy Policy

Last Updated: 11 June 2026

About Us

Investor in Customers Limited (“Investor in Customers”, “IIC”, “we”, “our” or “us”) is registered in England and Wales under company number 5812683.

Registered Office:

c/o Myers & Co
Suite 204A, East Wing
Sterling House
Loughton
Essex
IG10 3TS

Investor in Customers is committed to protecting and respecting your privacy. We take data protection and information security seriously, both in relation to our own records and the personal data we process on behalf of our clients.

Depending on the activity being undertaken, Investor in Customers acts as either:

Data Controller – where we determine why and how personal data is processed for our own business purposes.

Data Processor – where we process personal data on behalf of a client organisation under their instructions.

This Privacy Notice explains how we collect, use, store, share and protect personal data, together with the rights available to individuals.

For complete clarity, Investor in Customers will never sell personal data to third parties.

Data Protection Contact

If you have questions regarding this Privacy Notice, your personal data, or wish to exercise any of your rights under UK GDPR, please contact:

Data Protection Lead
Investor in Customers

Email: dp@investorincustomers.com

Postal Address:

Investor in Customers Ltd
c/o Myers & Co
Suite 204A, East Wing
Sterling House
Loughton
Essex
IG10 3TS

Our Lawful Bases for Processing

We process personal data under one or more of the following lawful bases:

Lawful Basis	Description	Capacity
Consent	We hold clear, informed and freely given consent for a specific purpose.	Data Controller
Contract	Processing is necessary to enter into or fulfil a contract.	Data Controller and Data Processor
Legitimate Interests	Processing is necessary for legitimate business interests, provided those interests do not override the rights and freedoms of individuals.	Data Controller and Data Processor

Where we rely on Legitimate Interests, we undertake appropriate Legitimate Interest Assessments (LIAs) to ensure our processing remains fair, proportionate and reasonable.

Those assessments can be found here:
For IIC Contact and Marketing Purposes
For IIC Assessments and Insight

Personal Data We May Collect

Personal data means any information relating to an identified or identifiable individual.

Depending on the nature of our relationship with you, we may collect:

• Name
• Job title
• Organisation name
• Business email address
• Telephone number
• Postal address
• Correspondence and communications
• Marketing preferences
• Survey responses
• Assessment participation records
• Website usage information
• Technical information relating to website visits

We collect, store and process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and other applicable legislation.

How We Collect Personal Data

As a Data Controller

Website Visitors, Cookies and Analytics

When you visit our website, we may collect information about how you use the site through cookies and analytics tools. We use Google Analytics and other website analytics tools where appropriate

This information may include:

• IP address
• Browser type
• Device information
• Operating system
• Pages visited
• Website activity

We use this information to:

• Improve website performance
• Understand visitor behaviour
• Enhance user experience
• Monitor website security
• Protect against misuse or cyber threats

Where required, cookies are only used with your consent.

Further information is available within our Cookie Policy.

Mailing Lists and Newsletters

If you subscribe to our mailing list, we will collect the information necessary to send communications to you.

This may include:

• Name
• Organisation
• Email address

We use third-party email providers to distribute newsletters, updates, event invitations and other communications.

We may monitor:

• Email delivery
• Open rates
• Link clicks
• General engagement statistics

This helps us improve the relevance and effectiveness of our communications.

You may unsubscribe at any time using the unsubscribe link included in every marketing email or by contacting us directly.

Enquiries

If you contact us regarding our services, we will process your information in order to respond to your enquiry and provide relevant information.

We may also contact you regarding services, events, training opportunities, accreditation programmes, awards or other activities that are similar or related to those you have previously enquired about where we believe there is a legitimate business interest in doing so.

Such communications are sent in accordance with UK GDPR and PECR requirements.

You have the right to object to marketing communications at any time.

Marketing Communications

Investor in Customers undertakes business-to-business marketing activities.

We may communicate with:

• Existing clients
• Former clients
• Previous enquirers
• Professional contacts operating within relevant sectors
• Individuals who have participated in our services, events or programmes

Our marketing activities are conducted in accordance with UK GDPR, PECR and our Legitimate Interest Assessments.

Every marketing communication contains a clear and simple method of unsubscribing.

Partner Organisations

In some circumstances, and only where appropriate, we may introduce you to one of our approved partner organisations in order to provide local support or service delivery.

Where personal data is shared, this will be limited to what is necessary and carried out in accordance with applicable data protection legislation.

As a Data Processor

Investor in Customers provides customer experience, employee experience, accreditation, award and assessment services on behalf of clients.

To deliver these services, we may temporarily process personal data relating to:

• Customers
• Employees
• Managers
• Service users
• Members
• Other stakeholders

We only process such information in accordance with our client’s instructions and contractual agreements.

Customer and Employee Surveys

To deliver our services, we may:

• Distribute surveys and questionnaires
• Collect responses
• Analyse results
• Produce reports
• Benchmark performance
• Identify opportunities for improvement

Survey participation is voluntary. Investor in Customers processes assessment participant information under the instructions of the client organisation acting as Data Controller

Where possible, responses are anonymised or aggregated before reporting.

Investor in Customers does not use personal data collected through client assessments for its own marketing purposes.

AI-Assisted Technologies

Investor in Customers may use AI-assisted technologies to support certain aspects of service delivery, including:

• Analysis
• Reporting
• Administration
• Insight generation
• Content preparation

All AI-assisted outputs remain subject to human review and oversight.

We do not knowingly use client personal data to train public AI models.

All processing remains subject to UK GDPR, and the safeguards outlined within this Privacy Notice.

Investor in Customers does not undertake automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Security Measures

We maintain appropriate technical and organisational measures to protect personal data.

These measures include:

• Role-based access controls
• Password protection
• Encryption
• Secure cloud storage
• Restricted staff access
• Secure transfer methods
• Data minimisation practices
• Secure deletion procedures
• Ongoing monitoring and review

Only authorised personnel are permitted access to personal data where necessary for their role.

Approved Service Providers

We use carefully selected suppliers and technology providers to support our operations.

These may include:

• Email marketing providers
• Survey platforms
• CRM systems
• Cloud hosting providers
• Business software providers

All providers are subject to appropriate contractual and data protection obligations.

Some of the providers used are:

• Microsoft 365
• SmartSurvey
• Surveyi (Feedback Hub)
• Word Press
• HighLevel

How Long We Keep Personal Data

We operate a formal Data Retention Policy and only retain personal data for as long as necessary for the purposes for which it was collected.

Examples include:

Data Type	Typical Retention Period
Marketing contacts	Marketing contacts – reviewed every 24 months and removed where no meaningful engagement exists.
Enquiries	Up to 2 years after last meaningful contact
Client records and contracts	Up to 6 years after contract end
Assessment respondent data	In accordance with client agreements and project requirements
Data protection complaints	Up to 6 years
Subject Access Requests	Up to 3 years
Erasure requests	Up to 3 years

Data may be retained for longer where required by law or where necessary to establish, exercise or defend legal claims.

Personal data is securely deleted or anonymised when no longer required.

Your Rights

Under UK GDPR you may have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request erasure of personal data
• Restrict processing
• Object to processing
• Withdraw consent
• Request portability of data
• Lodge a complaint with the Information Commissioner’s Office

These rights are subject to certain legal exemptions and limitations.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Data Protection Requests

Investor in Customers maintains procedures to support individuals wishing to exercise their rights.

These include:

• Subject Access Requests (Article 15)
• Right to Rectification (Article 16)
• Right to Erasure (Article 17)
• Right to Restrict Processing (Article 18)
• Right to Data Portability (Article 20)
• Right to Object (Article 21)

Requests should be submitted to:

dp@investorincustomers.com

Subject Access Requests

You have the right to request confirmation of whether we process personal data relating to you and, where applicable, obtain access to that information.

Requests should be submitted to:

dp@investorincustomers.com

We may request proof of identity before disclosing information.

We will normally respond within one calendar month of receiving a valid request and any necessary identification.

Right to Erasure

You may request that we erase personal data we hold about you where one of the conditions set out in Article 17 UK GDPR applies.

This right is not absolute and may not apply where we are required to retain information for legal, regulatory, contractual or legitimate business purposes.

Each request will be assessed individually, and we will explain our decision where data cannot be deleted.

Legitimate Interests

Where Investor in Customers relies on Legitimate Interests as a lawful basis for processing, we undertake Legitimate Interest Assessments (LIAs) to ensure our interests are balanced against the rights and freedoms of individuals.

Examples include:

• Business-to-business marketing
• Client relationship management
• Service improvement activities
• Customer and employee feedback surveys
• Assessment and accreditation services

You have the right to object to processing carried out on the basis of Legitimate Interests.

Our Legitimate Interest Assessments (LIAs) are available here:
Investor in Customers
For Assessments and Insight

International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Such safeguards may include:

• UK International Data Transfer Agreements
• UK Addendums to Standard Contractual Clauses
• Adequacy Regulations
• Other approved transfer mechanisms

Data Protection Documentation

Investor in Customers maintains a range of policies and procedures designed to support compliance with UK GDPR and related legislation.

These include:

• Privacy Notice
• Cookie Policy
• Data Retention Policy
• Data Protection Complaints Procedure
• Subject Access Request Procedure
• Data Breach Response Procedure
• Legitimate Interest Assessments
• Data Processing Agreements

Copies of relevant documents may be requested by contacting:

dp@investorincustomers.com

Complaints

If you have concerns regarding how Investor in Customers has handled your personal information, please contact us in the first instance using our Data Protection Complaint Form or by emailing:

dp@investorincustomers.com

We will investigate complaints fairly, promptly and in accordance with our Data Protection Complaints Procedure.

If you remain dissatisfied after we have investigated your concerns, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Information Commissioner’s Office

Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in legislation, regulatory guidance, technology or our business activities.

Any updates will be published on our website and will take effect from the revised date shown at the top of this notice.

We encourage you to review this Privacy Notice periodically.

Download this document