Privacy Statement for Intentionality Ltd
1. Who We Are
Intentionality(“we”, “our”, “us”) provides software tools and AI-assisted business advisory services designed to support organisations with business-health diagnostics, strategic analysis and reporting.
When Intentionality is the Data Controller
Intentionality acts as a Data Controller for its own operational business data, including:
- client account details
- user login credentials
- billing and payment records
- platform security logs
- support enquiries
- service communications
- platform analytics and audit records
When Intentionality is Only a Data Processor
Intentionality acts solely as a Data Processor where clients upload or enter personal data relating to their own:
- employees
- customers
- suppliers
- contractors
- prospects
- other third parties
In those situations:
- the client remains the Data Controller
Person Responsible for Data Protection:
COLIN CROOKS DIRECTOR / DATA PROTECTION LEAD
Contact Email:
colin@intentionality.co.uk
Registered Office:
77 Herne Hill Road SE24 0AY
ICO Registration Number:
ZB231069
2. Why We Hold Personal Data and Our Lawful Basis
We collect and process personal data to:
- create and manage user accounts
- provide access to our platform and services
- generate reports, diagnostics and AI-assisted analysis
- communicate with users about their accounts and services
- maintain platform security and prevent fraud
- comply with legal and regulatory obligations
- improve and maintain our services
Under UK GDPR, our lawful bases for processing include:
|
Purpose |
Lawful Basis |
|
Providing contracted services |
Contract — Article 6(1)(b) |
|
Security monitoring and fraud prevention |
Legitimate Interests — Article 6(1)(f) |
|
Billing, accounting and tax compliance |
Legal Obligation — Article 6(1)(c) |
|
Marketing communications (where applicable) |
Consent — Article 6(1)(a) |
|
Public website analysis and external reporting |
Legitimate Interests — Article 6(1)(f) |
Where special-category personal data is processed, this will only occur where an additional lawful condition under Article 9 UK GDPR applies, such as explicit consent.
3. What Personal Data We Process
We may process:
- names and work contact details
- login credentials and account information
- billing information
- business strategy and operational information
- uploaded documents and exercise responses
- AI-generated analysis and reports
- technical logs, security records and usage information
Clients may also choose to upload personal data relating to their own employees, customers, suppliers or contractors. In those circumstances, the client remains the data controller and we act as the data processor.
4. Where We Obtain Personal Data From
We obtain personal data from:
- users who register for our services
- clients who upload or input data into the platform
- publicly available websites and business pages
- third-party authentication or login providers
- communications between users and our support team
Some publicly available information may be collected through website analysis tools where users request external business-health reporting.
5. Who We Share Personal Data With
We share data only where necessary to provide our services, maintain security or comply with legal obligations.
This may include sharing with:
- cloud hosting providers
- authentication providers
- AI and analytics providers
- workflow and automation providers
- email delivery providers
- professional advisers and regulators where legally required
6. International Transfers
Some personal data may be transferred outside the United Kingdom, including to the United States and the European Economic Area.
Where international transfers occur, we use appropriate safeguards including:
- UK International Data Transfer Addendum (UK IDTA)
- Standard Contractual Clauses (SCCs)
- contractual confidentiality obligations
- encryption and security controls
We assess international transfers to ensure an appropriate level of protection for personal data.
7. How Long We Keep Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected.
Typical retention periods include:
|
Data Type |
Retention Period |
|
Client account data |
Contract duration + 12 months |
|
Billing and accounting records |
7 years |
|
Reports and exercise responses |
Contract duration + 12 months |
|
Audit and security logs |
12 months |
|
Backup data |
Up to 30 days |
|
Marketing data |
Until consent withdrawn or 24 months inactivity |
Data may be deleted earlier at the request of the client or data subject where legally appropriate.
8. Your Rights
Under UK GDPR, individuals have the right to:
- access their personal data
- request correction of inaccurate data
- request deletion of personal data
- restrict or object to processing
- request portability of their data
- withdraw consent where processing relies on consent
Requests can be made by contacting:
colin@intentionality.co.uk
We will normally respond within one calendar month.
9. Complaints
If you are unhappy with how we process your personal data, you may contact us using the details above.
You also have the right to complain to the UK Information Commissioner’s Office (ICO):
10. Automated Decision-Making and Profiling
We use AI-assisted tools to generate business insights, reports and recommendations.
However:
- we do not make solely automated decisions that produce legal or similarly significant effects on individuals under Article 22 UK GDPR
- human review remains part of all significant business decision-making
- profiling is limited to analytical and reporting functions requested by users
Clients using our platform remain responsible for ensuring any downstream use of AI-generated outputs complies with applicable law.
11. Where This Privacy Information Is Published
- our website
- onboarding materials
- client agreements
- privacy notices
- platform interfaces
- downloadable PDF documents
- client information packs
Printed or digital copies may also appear on business literature, posters or informational materials where appropriate.
12. Contact Us
If you have questions about this Privacy Statement or how personal data is handled, please contact:
Colin Crooks
Data Protection Lead
Email: colin@intentionality.co.uk
Explanatory Note on Controller vs Processor Roles
Under UK GDPR, a “controller” is the organisation that decides the purposes and means of processing personal data. A “processor” processes personal data only on behalf of, and under instructions from, the controller.
For avoidance of doubt:
- Intentionality does not determine the purpose for which clients upload personal data relating to their staff, customers or other third parties.
- Intentionality does not independently decide how that client personal data is used beyond providing the contracted platform services.
- Clients remain legally responsible for ensuring they have an appropriate lawful basis before uploading personal data into the platform.
Where clients choose to input personal data into AI-assisted tools or reporting workflows, that processing remains under the client’s authority and instruction unless expressly stated otherwise in a separate agreement.
Intentionality therefore acts as:
- Controller for its own business administration data; and
- Processor for client-uploaded third-party personal data.
This allocation of responsibility forms part of the contractual relationship between Intentionality and its clients and is reflected in the Data Processing Agreement at Appendix B.