About This Notice
This privacy notice explains how Innotech Recruit Limited ('Innotech', 'we', 'us', 'our') collects, uses, stores, and protects personal data in connection with its Business Intelligence Report service ('BI Report').
It applies to all individuals who subscribe to a BI Report, request a sample report, complete an enquiry form on the BI Report webpage, or correspond with Innotech in connection with the BI Report service.
This notice is separate from Innotech's general candidate and client privacy notice, which governs the recruitment search business.
Innotech Recruit Limited is registered with the Information Commissioner's Office (ICO) under registration number ZA526916.
Data We Collect
When you subscribe, request a sample, or submit an enquiry, we collect:
- Identity and contact data: your name, job title, company name, work email address, and telephone number where provided.
- Subscription and payment data: your geography selection (UK / USA / ROI), therapy area of interest, licence type, and payment confirmation from Stripe. We do not store card details — all payment processing is handled by Stripe.
- Preference and usage data: therapy areas selected, market geography specified, and report personalisation preferences gathered through our subscriber questionnaire.
- Enquiry data: information you provide in a sample request or bespoke enquiry form, including company background, commercial objectives, and timelines.
- Correspondence data: emails and other communications between you and Innotech in connection with the BI Report service.
We do not collect special category data through the BI Report service. Please avoid including sensitive personal information in free-text fields.
How We Use Your Data
Delivering the BI Report service
We use your name, email address, geography, and therapy area preferences to commission, prepare, and deliver your report. Your questionnaire responses are used to personalise subsequent reports.
Lawful basis: Performance of a contract (UK GDPR Article 6(1)(b) / EU GDPR Article 6(1)(b)).
Subscriber questionnaire and personalisation
After your first report is delivered, we may send a short questionnaire. Responses are used solely to improve the relevance of your next report. Participation is voluntary.
Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f) / EU GDPR Article 6(1)(f)).
Subscription management
We process your data to manage renewals, cancellations, invoices, and refunds where applicable.
Lawful basis: Performance of a contract; compliance with legal obligations.
Service communications
We may contact you about changes to your subscription or matters directly related to your BI Report. These are not marketing communications.
Lawful basis: Legitimate interests / performance of contract.
Compliance and record-keeping
We retain financial records as required by applicable law.
Lawful basis: Compliance with a legal obligation (UK GDPR Article 6(1)(c)).
What We Don't Do
- We do not sell your personal data to any third party.
- We do not share subscriber data with competitors in your therapy area.
- We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
- We do not use your BI Report preferences or enquiry content for any purpose other than delivering and improving the BI Report service.
- We do not send unsolicited marketing emails. All communications are directly related to your subscription or enquiry.
Who We Share Your Data With
We share personal data only where necessary. Recipients include:
- Stripe Inc.: payment processing. Stripe acts as an independent data controller in respect of payment card data.
- Grok (xAI): research automation used to compile BI Report intelligence. Subscriber names may appear in report metadata. Grok does not retain subscriber data beyond the processing task.
- Claude AI (Anthropic): research automation used in the production of BI Report content. Subscriber names may appear in report metadata. Data is processed under Anthropic's usage policies and is not used to train AI models where a data processing agreement is in place.
- Perplexity AI: research automation used to source and verify intelligence included in BI Reports. Subscriber names may appear in research queries. Data is processed under Perplexity's usage policies.
- HubSpot Inc.: CRM platform used to manage subscriber records and store questionnaire responses, under a data processing agreement.
- Form handler (Formspree or equivalent): processes form submissions and routes enquiries to Innotech's email. No subscriber data is stored beyond transmission.
- Hostinger: website hosting provider. Standard traffic data may be collected per Hostinger's service terms.
- Professional advisers: solicitors and accountants, where required for legal compliance, subject to obligations of confidentiality.
All third-party processors operate under data processing agreements and may only process your data on our instructions.
How Long We Keep Your Data
| Data Category | Retention Period |
|---|---|
| Active subscriber records | Duration of subscription plus 12 months |
| Cancelled subscriber records | 12 months from cancellation, unless extended by law |
| Financial records (invoices, payments) | 7 years from end of relevant financial year |
| Sample request / enquiry data (non-converting) | 6 months from date of request |
| Questionnaire responses | Duration of subscription plus 12 months |
| Email correspondence | 3 years from end of subscription or last correspondence |
Security
We apply appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. Access to subscriber data is restricted to Blair Anderson and personnel directly involved in producing or administering the BI Report.
In the event of a personal data breach, we will notify the relevant supervisory authority within the required timeframe and will notify affected individuals without undue delay where required.
Jurisdiction-Specific Provisions
The sections below apply to subscribers in each respective jurisdiction. Where there is a conflict between the core provisions above and a jurisdiction-specific section, the jurisdiction-specific section prevails for subscribers in that jurisdiction.
Legal Framework
For UK subscribers, Innotech processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. ICO Registration No. ZA526916.
Your Rights
- Right of access: request a copy of personal data we hold about you.
- Right to rectification: ask us to correct inaccurate or incomplete data.
- Right to erasure: ask us to delete your data where there is no compelling reason to retain it (subject to legal obligations).
- Right to restriction: ask us to pause processing in certain circumstances.
- Right to data portability: request your data in a structured, machine-readable format where processing is based on consent or contract.
- Right to object: object to processing based on legitimate interests.
To exercise any of these rights, contact datacollector@innotechrecruit.com. We will respond within one month.
International Transfers
Where we transfer your data outside the UK (for example, to HubSpot or Stripe in the United States), we ensure appropriate safeguards are in place: the UK-US Data Bridge, an International Data Transfer Agreement (IDTA), or equivalent mechanism.
Supervisory Authority
You may lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113 | Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
Legal Framework
For Republic of Ireland subscribers, Innotech processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Acts 1988–2018 (Ireland).
Your Rights
Your rights under EU GDPR mirror those set out in Section 8A above: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decision-making. Contact datacollector@innotechrecruit.com to exercise any of these rights. We will respond within one month.
International Transfers
Transfers from the Republic of Ireland to the United Kingdom are conducted on the basis of the EU Commission's adequacy decision in respect of the UK. Transfers to the United States (for example, HubSpot and Stripe) are conducted under Standard Contractual Clauses (SCCs) or equivalent approved mechanisms.
Supervisory Authority
You may lodge a complaint with the Data Protection Commission (DPC): dataprotection.ie | 01 765 0100 | 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
Legal Framework
For US subscribers, Innotech processes personal data in compliance with applicable US federal and state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
CCPA / CPRA Rights — California Residents
- Right to know: request disclosure of the categories and specific pieces of personal information we have collected, the purposes for collection, and categories of third parties with whom we share it.
- Right to delete: request deletion of personal information we have collected, subject to certain exceptions.
- Right to correct: request correction of inaccurate personal information.
- Right to opt out of sale or sharing: Innotech does not sell personal information and does not share personal information for cross-context behavioural advertising.
- Right to limit use of sensitive personal information: we do not collect sensitive personal information as defined under the CPRA through the BI Report service.
- Right to non-discrimination: we will not discriminate against you for exercising your rights.
To submit a CCPA request, contact datacollector@innotechrecruit.com. We will acknowledge within 10 business days and respond within 45 days (extendable by a further 45 days with notice).
Shine the Light (California Civil Code § 1798.83)
Innotech does not disclose personal information to third parties for direct marketing purposes.
Other US States
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with applicable privacy legislation may have rights similar to those described above. To make a request, contact datacollector@innotechrecruit.com.
Do Not Track
Our website does not currently respond to Do Not Track signals. We will update this notice if our position changes.
Cookies
Our BI Report webpage uses cookies. Essential cookies are necessary for the site to function and do not require consent. Non-essential cookies (for example, analytics) are only deployed with your consent, obtained via our cookie banner on first visit.
For full details, see our Cookie Policy at innotechrecruit.com/cookie-policy.
Contact and Complaints
If you are dissatisfied with our response, you may contact the relevant supervisory authority for your jurisdiction — see Section 8 above.
Changes to This Notice
We review and update this notice periodically. Where changes are material, we will notify active subscribers by email before the changes take effect. The version number and effective date above indicate the current version.
Innotech Recruit Limited · Stockport, England · Company No. 11930968 · ICO Registration No. ZA526916