Identity and contact data
Name, organisation, role, professional email address, telephone number, country and preferred language.
This notice explains how Strategic Policy & Risk Advisory collects, uses, shares, protects and retains personal data when people use this website, request advisory services, subscribe to intelligence updates, attend briefings, use the client portal or otherwise interact with SPRA.
SPRA uses personal data to operate the website, respond to enquiries, manage client relationships, deliver advisory and intelligence services, administer subscriptions and events, run the client portal, protect systems, meet legal obligations and maintain appropriate records. SPRA does not sell personal data.
Strategic Policy & Risk Advisory is responsible for personal data where it determines why and how that data is used. This notice applies to personal data processed through the SPRA website, contact forms, consultation requests, newsletter and intelligence updates, client portal, advisory requests, due diligence requests, tender and funding watch requests, events and briefings, support tickets and related business communications.
Where SPRA processes personal data strictly on behalf of a client and under that client’s instructions, the client may be the controller for that processing. In that situation, SPRA will handle the data under the client contract and any applicable data processing terms.
Name, organisation, role, professional email address, telephone number, country and preferred language.
Messages, service interests, sectors, geographies, deadlines, requested deliverables and information submitted through advisory, research, due diligence, media or briefing forms.
Account details, organisation profile, permissions, subscription status, saved searches, alerts, requests, documents, support tickets, notifications and activity logs.
Files uploaded by clients or authorised users, report downloads, document versions, project deliverables and supporting material for advisory or due diligence work.
Billing contact details, plan selection, invoices, payment status and payment-provider references where payment functionality is enabled.
IP address, device and browser information, pages visited, security logs, cookie preferences and analytics information where enabled.
SPRA may receive personal data directly from you, from your organisation, from clients instructing advisory work, from event or service partners, from professional advisers or from publicly available sources where relevant to legitimate advisory, integrity, sanctions, market or policy research.
| Purpose | Examples | Likely lawful basis |
|---|---|---|
| Responding to enquiries | Reviewing requests, contacting you, arranging consultation calls and assessing whether SPRA can assist. | Legitimate interests; steps before entering a contract. |
| Delivering advisory and intelligence services | Managing projects, research, briefings, reports, due diligence requests, tender/funding watch and client communications. | Contract; legitimate interests; legal obligation where applicable. |
| Client portal and subscriptions | Creating accounts, applying permissions, controlling access to reports, tracking downloads, managing alerts and support requests. | Contract; legitimate interests in secure service administration. |
| Integrity, sanctions and due diligence work | Reviewing client-provided data, public records, corporate information, watchlist or risk indicators where relevant to an instruction. | Contract; legitimate interests; legal obligation where applicable. Additional conditions must be confirmed before processing special category or criminal offence data. |
| Marketing, newsletters and events | Sending requested updates, event invitations or relevant professional communications, and managing unsubscribe preferences. | Consent or legitimate interests, depending on the communication and relationship. |
| Security, compliance and records | Protecting the website and portal, preventing misuse, maintaining audit logs, handling disputes and meeting legal/accounting duties. | Legitimate interests; legal obligation; establishment, exercise or defence of legal claims. |
If SPRA relies on legitimate interests, it considers whether the processing is necessary and proportionate and whether individual rights and expectations override those interests. Direct marketing can be objected to at any time.
SPRA may collect data from you directly, from your organisation, from clients who instruct SPRA, from public sources, from event partners and from service providers where this is relevant to the service or communication.
SPRA may share personal data with trusted service providers such as website hosting, email delivery, cloud storage, security, analytics, customer relationship, payment, document management and professional support providers. SPRA may also share data with professional advisers, regulators, courts, law enforcement or client-authorised recipients where necessary and lawful.
Where personal data is transferred outside the UK or the country in which it was collected, SPRA will use lawful transfer mechanisms and safeguards where required by data protection law.
SPRA keeps personal data only for as long as necessary for the purpose for which it was collected, including service delivery, legal, accounting, compliance, audit, dispute-resolution and security purposes. If no fixed retention period is stated, SPRA uses criteria such as the nature of the relationship, the type and sensitivity of data, legal limitation periods, client contract terms, regulatory requirements and whether the data is needed for an active service, enquiry or record.
SPRA applies administrative, technical and organisational safeguards designed to protect personal data against unauthorised access, loss, misuse or disclosure. Sensitive client documents should be submitted only through approved secure channels or the client portal where available.
The website may use cookies and similar technologies for essential site operation, security, preferences and analytics where enabled. More information is provided in the Cookie Policy.
SPRA does not use solely automated decision-making that produces legal or similarly significant effects for individuals through this website. The website and client portal are not directed at children.
Depending on the circumstances and lawful basis, you may have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, objection to processing and withdrawal of consent. You also have the right to object to direct marketing at any time.
To exercise your rights or ask a privacy question, contact SPRA at info@strategicpolicyrisk.com. SPRA may need to verify your identity before responding to a rights request.
If you are not satisfied with how SPRA handles your personal data, you may contact the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Registered office: 4 St. Lukes Yard, London, England, W9 3AN