Privacy Policy
This Privacy Policy has been created for members of ‘Investing in’ and any subsidiaries, to help you understand the data which we may collect, how we intend to securely process and store that data, and the rights you have in relation to your personal or company data. Along with our Terms and Conditions, this Privacy Policy makes up our agreements with you as a member or user of Investing in Ethnicity.
We are committed to protecting your organisation’s data with enterprise-grade security, strict access controls, and anonymised benchmarking practices.
Key points
- Data Controller: SPM Group Ltd, trading as InvestingIn and its product strands including Investing in Ethnicity.
- We only collect information that is voluntarily provided to us or generated through use of our services.
- We use client and organisational data to deliver InvestingIn products, reports, benchmarking, insights and client support.
- We use aggregated and anonymised data to create Matrix insights, trends, resources and benchmarking outputs.
- We do not identify your organisation in shared outputs unless you have given prior written consent.
- We do not sell, rent or give away your data.
- Client benchmarking and Matrix data is stored securely in Microsoft 365 and not in other cloud storage platforms.
- Access to client data is restricted to authorised SPM Group personnel who need it to deliver services.
- We use WordPress for our website and Clearbooks for accounting and invoicing. These tools are not used to store client benchmarking or Matrix data.
- We retain personal and organisational data only for as long as needed to deliver services, support clients and meet legal obligations.
- You can contact us at admin@investinginethnicity.org if you have questions or want to exercise your data rights.
1. About this policy
This Privacy Policy explains how SPM Group Ltd, trading as InvestingIn, collects, uses, stores and protects personal and organisational information shared with us through our services, products, website and client relationships.
This policy is intended for clients, members, website users and organisations that share information with us for benchmarking, reporting, Matrix submissions, events, resources, workshops or consultancy support.
Please read this policy alongside any relevant terms and conditions, client agreement, participation guidance or product-specific notice we provide.
2. Who we are
SPM Group Ltd is the organisation responsible for determining how and why personal data is processed for InvestingIn products and services.
Registered office: SPM Group Ltd, 142-143 Parrock Street, Gravesend, Kent DA12 1EY.
ICO registration number: ZA798931.
Contact: admin@investinginethnicity.org
For the purposes of UK data protection law, SPM Group Ltd acts as the Data Controller unless a separate written agreement states otherwise.
3. What information we collect
We may collect contact information such as name, job title, organisation, work email address and telephone number.
We may collect organisational information voluntarily shared with us, including survey responses, Matrix submissions, benchmarking information, examples of practice, event participation details and client support information.
We may collect billing and finance information required for accounting and invoicing.
We may collect website information such as cookies or technical usage data where this is generated through use of our website.
We do not intentionally collect personal data that is not needed to provide our services. Where sensitive or special category data is shared with us, we will only use it for the stated purpose and with appropriate safeguards.
4. How we use your information
We use information to deliver InvestingIn products, client reports, benchmarking outputs, Matrix insights, surveys, events, resources, workshops and related support.
We use organisational data to identify trends, share good practice and support clients to improve their approach to inclusion and related workplace priorities.
We use contact details to manage client relationships, provide service updates, respond to enquiries, administer events and manage account support.
We use finance information for accounting, invoicing, payment administration and record keeping.
We will not use your information for unrelated purposes without informing you and, where required, obtaining consent.
5. How we use aggregated and anonymised data
We may use aggregated and anonymised data to produce Matrix benchmarking, industry insights, trend reports, resources, event content and client guidance.
Before information is used in shared outputs, we remove or limit identifying details so that individual organisations or individuals are not identifiable unless written consent has been provided.
We will not name your organisation, publish your identifiable submission or attribute information to you without prior written agreement.
Where data cannot be safely anonymised or aggregated, we will not use it in shared external outputs without consent.
6. How we protect client data
Client benchmarking and Matrix data is stored securely within Microsoft 365. We do not store this data in other cloud storage platforms.
We use access controls so that only authorised SPM Group personnel can access client data where needed to deliver services.
We use role-based permissions, secure user accounts, confidentiality expectations and internal data handling procedures.
Microsoft 365 provides security and compliance infrastructure for the services we use, and SPM Group Ltd remains responsible for how we configure, govern and use the data within our environment.
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, misuse, alteration or disclosure.
7. Third-party systems and service providers
We use Microsoft 365 for secure storage, communication and document management relating to client data.
We use WordPress for our public website. WordPress is not used by us to store client benchmarking or Matrix data.
We use Clearbooks for accounting and invoicing. Clearbooks may hold billing information needed to issue invoices and maintain financial records, but it is not used to store client benchmarking or Matrix data.
We do not use Mailchimp, Salesforce, Google Analytics or other previously listed providers to store client benchmarking or Matrix data unless this policy is updated to say otherwise.
If we need to use any additional service provider that processes client data, we will review the data protection position and update this policy or provide appropriate notice where required.
8. Data sharing
We do not sell, rent or give away personal or organisational data.
We may share information with your organisation’s authorised contacts, with our approved service providers where necessary to deliver services, or where required by law.
We may share aggregated and anonymised insights publicly or with clients where organisations and individuals cannot be identified.
We will only share identifiable organisational information externally where we have your prior written consent or a legal requirement applies.
9. Lawful basis for processing
We process personal data where we have a lawful basis under UK data protection law. This may include contract, legitimate interests, consent, or legal obligation depending on the context.
For client services, our lawful basis will usually be contract or legitimate interests in delivering agreed services, managing client relationships and producing anonymised insights.
Where consent is required, you can withdraw consent at any time by contacting us.
10. How long we keep information
We retain information only for as long as needed to deliver services, support clients, maintain accurate business records and comply with legal, accounting or regulatory obligations.
Client benchmarking and Matrix data is reviewed periodically and deleted, anonymised or archived when it is no longer needed, as per our retention policy (please let us know if you need further information).
Accounting and invoicing records are retained in line with applicable financial and legal requirements, as per our retention policy or UK legal obligations (please let us know if you need further information).
11. International transfers
Our core client data storage is within Microsoft 365. If any personal data is transferred outside the UK, we will ensure appropriate safeguards are in place as required by UK data protection law.
Where service providers process information outside the UK, we will rely on appropriate contractual, legal or technical safeguards where required.
12. Your data rights
You have rights under UK data protection law, including the right to be informed, access your personal data, request correction, request deletion, restrict processing, object to processing and complain to the Information Commissioner’s Office.
You may also have the right to withdraw consent where processing is based on consent.
To exercise your rights, contact us at admin@investinginethnicity.org. We may need to verify your identity or authority before responding.
13. Data breaches
If we become aware of a personal data breach affecting information we control, we will assess the risk and take appropriate action.
Where required by law, we will notify the Information Commissioner’s Office and affected individuals or organisations.
14. Website cookies and tracking
Our website may use cookies or similar technologies to support functionality and understand website use.
15. External links
Our website may link to external websites or resources. We are not responsible for the privacy practices, security or content of external websites.
16. Updates to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, systems, legal requirements or data protection practices.
The latest version will be published on our website with the date it was last updated. Last updated: 3 March 2026.
17. Contact us
If you have any questions about this Privacy Policy, how we use data, or your rights, please contact:
SPM Group Ltd / InvestingIn
Address: 142-143 Parrock Street, Gravesend, Kent DA12 1EY
Email: admin@investinginethnicity.org
Telephone: +44 207 258 1777
