Data & Privacy Notice
People Planet Purpose Ltd — last updated 13/10/2026
1. Important information and who we are
This Privacy Notice explains how People Planet Purpose Ltd uses and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Our details
Company name: People Planet Purpose Ltd
Registered in England and Wales, company number 11388449
ICO registration number: ZA519091
Data Protection Officer: Jo Roy
Email: jo@peopleplanetpurpose.com
This Privacy Notice tells you how we collect and use your personal data when you use this website, sign up to our newsletter, buy a product or service from us, or otherwise interact with us.
This website is not intended for children, and we do not knowingly collect data relating to children.
Controller. People Planet Purpose Ltd ("People Planet Purpose", "we", "us" or "our") is the controller of, and responsible for, your personal data. This means we decide the purposes and means of processing it. We understand that your privacy is important to you. We respect the privacy of everyone we deal with and will only collect and use personal data in the ways described here and in line with our obligations and your rights under the law.
2. The types of personal data we collect about you
Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer the following kinds of personal data. The extent of what we collect depends on how you interact with us.
Identity Data: first name, last name, username or similar identifier, and job title.
Contact Data: billing address, delivery address, email address and telephone numbers.
Financial Data: bank account and payment card details.
Transaction Data: details of payments to and from you and of products and services you have purchased from us.
Technical Data: IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website.
Profile Data: your username and password, purchases or orders you have made, your interests, preferences, feedback and survey responses.
Usage Data: information about how you interact with and use our website, products and services.
Marketing and Communications Data: your preferences in receiving marketing from us and our third parties, and your communication preferences.
Client Project Data: where we provide services to you, you may give us documents and information relevant to the work, which may include personal data about your colleagues, stakeholders, participants or customers. Where you share this with us, you are responsible for ensuring you have a lawful basis to do so.
We do not intend to collect special category data (such as health, racial or ethnic origin, religious beliefs, trade union membership or sexual orientation) or criminal offence data. If it is relevant to a project and you need to share it with us, please speak to us first.
We also collect, use and share aggregated data, such as statistical or demographic data. This is not personal data as it does not identify you. For example, we may aggregate Usage Data to work out the percentage of users accessing a particular website feature.
If you do not provide personal data. Where we need personal data to provide services to you and you do not provide it, this may delay or prevent us from providing those services, and we may have to stop acting for you. You will remain responsible for any unpaid fees incurred up to that point under our terms of business.
3. How is your personal data collected?
We use different methods to collect data from and about you, including through:
Your interactions with us, online or offline, for example by email, phone, forms, meetings or events.
Automated technologies. As you use our website we automatically collect Technical Data about your equipment, browsing actions and patterns, using cookies and similar technologies (see "Cookies" in section 4).
Our IT systems and service providers, for example our customer relationship, accounting and project management systems.
Publicly accessible sources, such as Companies House, LinkedIn or your organisation's website.
Analytics providers, such as Google.
Third parties, such as referrers, partners, associates and professional advisers working with us on your project, and your employer or organisation.
4. How and why we use your personal data
Our use of your personal data is subject to your instructions (where applicable), the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Legal basis
The law requires us to have a legal basis for using your personal data. We rely on one or more of the following:
Performance of a contract: where we need to perform a contract we are about to enter into or have entered into with you.
Legitimate interests: where it is necessary to run our business and pursue our legitimate interests (or those of a third party), for example to prevent fraud and give you a secure and effective service. We consider and balance any impact on you before relying on this basis, and we do not use it where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law).
Legal obligation: where we need to comply with a legal obligation. We will identify the obligation when we rely on this basis.
Consent: only where you have actively agreed to a specific use, for example subscribing to a newsletter.
Purposes for which we use your personal data
To register you as a new client or customer
Type of data: Identity, Contact. Legal basis: Performance of a contract
To carry out identity, due diligence and fraud-prevention checks where required
Type of data: Identity, Contact, Financial. Legal basis: Performance of a contract; legal obligation
To deliver our services, including managing payments, fees and charges, and collecting money owed to us
Type of data: Identity, Contact, Financial, Transaction, Marketing and Communications, Client Project Data. Legal basis: Performance of a contract; legitimate interests (to recover debts due to us)
To manage our relationship with you, including notifying you of changes to our terms or this notice, and dealing with requests, complaints and queries
Type of data: Identity, Contact, Profile, Marketing and Communications. Legal basis: Performance of a contract; legal obligation; legitimate interests (to keep our records updated and manage our relationship with you)
To enable you to take part in a prize draw, competition or survey
Type of data: Identity, Contact, Profile, Usage, Marketing and Communications. Legal basis: Performance of a contract; legitimate interests (to study how clients use our services, develop them and grow our business)
To comply with our legal and regulatory obligations and cooperate with regulators, courts, law enforcement and government authorities
Type of data: All categories as relevant. Legal basis: Legal obligation
To administer and protect our business and website (troubleshooting, data analysis, testing, system maintenance, support, reporting, hosting, and preventing and detecting fraud, cybercrime and misuse of our systems)
Type of data: Identity, Contact, Financial, Transaction, Technical, Profile, Usage, Marketing and Communications, Client Project Data. Legal basis: Legitimate interests (running our business, IT administration, network security, fraud prevention and business reorganisation); legal obligation
To investigate, respond to and defend complaints and legal claims
Type of data: Identity, Contact, Financial, Transaction, Profile, Marketing and Communications, Client Project Data. Legal basis: Legitimate interests (to protect our legal rights and interests)
To deliver relevant website content and online advertising, and measure its effectiveness
Type of data: Identity, Contact, Profile, Usage, Marketing and Communications, Technical. Legal basis: Legitimate interests (to study how clients use our services, develop them, grow our business and inform our marketing strategy)
To use data analytics to improve our website, services, client relationships and experiences
Type of data: Technical, Usage. Legal basis: Legitimate interests (to define types of clients, keep our website updated and relevant, and develop our business)
To send you marketing communications and make personalised suggestions about services that may interest you
Type of data: Identity, Contact, Technical, Usage, Profile, Marketing and Communications. Legal basis: Consent where required by PECR; legitimate interests (including where the soft opt-in applies); legal obligation (to honour objections and opt-outs)
To carry out market research through voluntary surveys
Type of data: Identity, Contact, Profile, Usage, Marketing and Communications. Legal basis: Legitimate interests (to improve and develop our services)
To collect, manage and publish client feedback and reviews and monitor satisfaction
Type of data: Identity, Contact, Profile, Marketing and Communications. Legal basis: Legitimate interests (to improve our services, maintain our reputation and inform prospective clients)
We may process your personal data without your knowledge or consent where this is required or permitted by law.
Special category data and criminal offence data
We do not routinely collect this data. If we do need to process it, we will only do so where we have a lawful basis and one of the conditions in data protection law applies, such as the establishment, exercise or defence of legal claims, substantial public interest, or your explicit consent. Where we rely on consent, you can withdraw it at any time by contacting us using the details in section 10.
Direct marketing
With your permission and/or where permitted by law, we may use your personal data for marketing. We will not send you unlawful marketing or spam, and we will comply with the Data Protection Legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
If you are an individual, we will only send electronic marketing (such as email or SMS):
where you have given your consent; or
where you have bought services from us or asked for information about our services, we obtained your contact details in that process, and you have not opted out (the "soft opt-in"). Where we rely on the soft opt-in, our lawful basis is legitimate interests.
If you are an organisation, we may send you marketing where you have requested information or bought services from us and have not opted out.
You can ask us to stop marketing at any time by clicking the unsubscribe link in any marketing email or by contacting us (see section 10). If you opt out, we will not send you marketing communications, but you will still receive service-related communications that are essential for administrative or client service purposes.
Third-party marketing. We will get your express consent before sharing your personal data with any third party for their own direct marketing.
Cookies
A cookie is a small file placed on your device. Cookies help us analyse web traffic and recognise you when you return to the site. You can accept or decline cookies. Most browsers accept cookies automatically, but you can usually change your browser settings to decline them, although this may stop you using parts of the website.
By law, we may not place cookies on your device without your consent unless they are strictly necessary to operate the website. We use traffic log cookies to identify which pages are being used, so we can analyse web traffic and improve the website. We use this information only for statistical analysis, after which the data is removed from our systems.
We use Google Analytics to monitor how our website is used so we can make improvements. This requires us to pass your IP address to Google, which uses it to prepare site usage reports for us. Google may also share this information with other Google services and may use the data to contextualise and personalise ads in its own advertising network. See Google's privacy policy and its explanation of how Google uses this information.
If you have questions about the cookies we use, please contact us at jo@peopleplanetpurpose.com.
5. Disclosures of your personal data
We may share your personal data where necessary with the following parties, for the purposes set out in the table above:
Service providers and processors who perform services for us, such as IT, hosting, payment, accounting, marketing and analytics providers, and associates or sub-contractors who help us deliver services to you.
Professional advisers, such as lawyers, accountants, auditors and insurers.
Regulators, courts, HMRC and other authorities where we are required or permitted to do so.
Third parties to whom we may choose to sell, transfer or merge parts of our business or assets, or whom we may seek to acquire or merge with. If our business changes, the new owners may use your personal data as set out in this notice.
We require all third parties to respect the security of your personal data and treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes and only permit them to process it for specified purposes and in accordance with our instructions.
6. International transfers
We may transfer your personal data to service providers outside the UK, including to countries whose laws may not give the same level of protection as UK law. Whenever we do so, we make sure appropriate safeguards are in place, such as:
transferring only to countries the UK has recognised as providing an adequate level of protection; or
using standard contractual terms approved for use in the UK, such as the International Data Transfer Addendum to the European Commission's standard contractual clauses.
7. Data security
The security of your personal data is essential to us. Our measures include:
limiting access to your personal data to employees, agents, contractors and other third parties with a legitimate need to know, who are subject to duties of confidentiality; and
procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data), including notifying you and/or the Information Commissioner's Office where we are legally required to do so.
8. Data retention
We will only keep your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy legal, regulatory, tax, accounting or reporting requirements. We may keep it for longer if there is a complaint or we reasonably believe there is a prospect of a dispute relating to our relationship with you.
To decide the right retention period, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, the purposes for which we use it, whether we can achieve those purposes by other means, and applicable legal, regulatory, tax and accounting requirements.
By law we must keep basic information about our clients (including Contact, Identity, Financial and Transaction Data) for six years after they stop being clients, for tax purposes. We keep client project records for six years after the project ends, after which they are securely deleted or destroyed.
In some circumstances you can ask us to delete your data (see section 9).
9. Your legal rights
You have the right to:
Request access to your personal data (a "subject access request"), to receive a copy and check we are lawfully processing it.
Request correction of incomplete or inaccurate data we hold about you, though we may need to verify the accuracy of the new data.
Request erasure of your personal data in certain circumstances, for example where there is no good reason for us to keep processing it, where you have successfully objected to processing, where we may have processed it unlawfully, or where we must erase it to comply with the law. We may not always be able to comply for specific legal reasons, which we will tell you about at the time.
Object to processing where we rely on legitimate interests (including profiling based on them). In some cases we may show compelling legitimate grounds that override your objection. You have an absolute right to object at any time to processing for direct marketing (see section 4).
Request transfer of your personal data to you or a third party, in a structured, commonly used, machine-readable format. This applies only to automated information you originally gave us consent to use, or which we used to perform a contract with you.
Request restriction of processing, to suspend our use of your data: while you want us to establish its accuracy; where our use is unlawful but you do not want it erased; where you need us to keep it to establish, exercise or defend legal claims; or where you have objected and we are verifying whether we have overriding legitimate grounds.
To exercise any of these rights, please contact us using the details in section 10.
No fee usually required. You will not usually have to pay a fee to exercise your rights. We may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.
What we may need from you. We may ask for specific information to confirm your identity and your right to access the data. This is a security measure to make sure personal data is not disclosed to anyone with no right to receive it. We may also contact you for further information to speed up our response.
Time limit to respond. We try to respond to all legitimate requests within one month. It may occasionally take longer if your request is complex or you have made several requests, in which case we will tell you and keep you updated.
10. Contact details
To contact us about anything to do with your personal data and data protection, including to make a subject access request or a data protection complaint, please contact our Data Protection Officer, Jo Roy:
Email: jo@peopleplanetpurpose.com
Telephone: 07824 884 184
Postal address: People Planet Purpose Ltd, 52 Southgrove Road, Sheffield, S10 2NQ, United Kingdom
11. Complaints
You have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). Before doing so, please first raise your complaint with us or ask us for clarification if there is something you do not understand, as the ICO will expect you to have done this.
12. Changes to this Privacy Notice and your duty to inform us of changes
We may change this Privacy Notice from time to time, for example if the law changes or we change our business in a way that affects personal data protection. Any changes will be published on our website.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.
This Privacy Notice was last updated on 13/10/2026.
13. Third-party links
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.