SCP / Legal & information
Privacy Notice
UK operation · International visitors
About this notice
Supply Chain Partners Group Limited (SCP, we, us or our) respects your privacy. This notice explains how we use personal information when you browse our website, contact us, express an interest in working with us or use authorised website services. It applies to our UK-operated website and visitors worldwide. Last reviewed: 16 October 2026. This notice concerns SCP’s own website and relationship administration. Personal information handled for a client under its instructions is governed by the relevant engagement and data-processing terms; the client may be responsible for explaining that processing to the individuals concerned.
Who is responsible
Supply Chain Partners Group Limited is the controller for the uses described here. Our business contact address is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. For privacy questions or to exercise your rights, email compliance@supplychain.partners. This is our privacy contact; we do not describe it as a formally appointed Data Protection Officer.
Information we collect
We receive information you choose to send us, such as your name, business contact details, organisation, enquiry and correspondence. If you contact us about working together, this may include your CV, experience and professional interests. Hosting and security services may process IP addresses, browser and device information, requested pages, timestamps and technical error or security logs. Please only send information relevant to your request.
Where information comes from
Most relationship information comes directly from you through email, messages, professional discussions or documents you send us. Microsoft supplies the account information used when you sign in. Technical information is generated when your browser requests website resources. Where someone introduces you or provides your business details on your behalf, we use those details only for the relevant introduction or business discussion and provide any additional privacy information required. Public availability alone does not remove our data protection responsibilities.
How we use information and our lawful bases
| Purpose | Information involved | Lawful basis |
|---|---|---|
| Responding to enquiries | Name, contact details, organisation and message | Legitimate interests in responding to relevant business enquiries; steps requested before a contract where applicable. |
| Managing consultancy relationships | Business contacts, correspondence and engagement records | Contract where you are personally a party; legitimate interests in administering corporate client relationships; legal obligations for required records. |
| Considering consultants and potential colleagues | CV, professional experience and correspondence | Steps towards a contract where applicable, or legitimate interests in evaluating relevant experience and potential collaboration. |
| Authorised website access | Microsoft account identifiers, basic profile and session information | Legitimate interests in authenticating users, enforcing permissions and protecting restricted resources. |
| Website operation and security | IP address, device/browser information and operational logs | Legitimate interests in delivering, maintaining and protecting the website. |
| Responding to privacy requests | Request details and proportionate verification information | Legal obligations under applicable data protection law. |
Our legitimate interests are limited to the business, operational and security purposes described above and must be balanced against your rights and reasonable expectations. Consent, where required for a separate activity, is requested for that activity and can be withdrawn.
Information you need to provide
You can browse public pages without creating an account. If you contact us, we need enough information to understand your enquiry and reply; without contact details we may be unable to respond. Access to restricted resources requires an authorised Microsoft account. We explain any required information when collecting it. Do not send passwords, unnecessary identity documents, sensitive personal details or confidential client material through an initial enquiry. The current demonstration form does not send or retain entries.
Microsoft sign-in and document access
Authorised users can sign in through Microsoft. We process account identifiers and profile information needed to recognise the user and enforce access permissions. Microsoft handles your password on its own sign-in page; the website does not receive your Microsoft password. Sign-in tokens and related session information are stored in the browser for authentication. Approved document listings are requested from the SCP Consulting SharePoint library under the signed-in user’s permissions. Documents remain in Microsoft 365. Editor access is restricted to authorised accounts.
Articles, forms and other current features
Approved articles are publicly readable. The editor stores article drafts, published content and publication metadata using Cloudflare storage. Public commenting and subscriptions are not enabled. The current enquiry form is a demonstration and does not submit or save your entry; email and WhatsApp links let you contact us through those separate services. Ask SCP currently uses preset answers in page memory and does not send your questions to an external AI service. Social links open external websites; no live social feed is embedded. We will update this notice before introducing materially different processing.
Marketing
We do not currently operate a website newsletter signup or personalised advertising. If we introduce marketing, we will explain the relevant use of your information and apply the consent and electronic marketing rules that apply to the communication. You can object to direct marketing at any time and withdraw any marketing consent.
Who receives information
Information may be handled by providers supporting the relevant activity: Cloudflare for website hosting, functions and article storage; Microsoft for sign-in, SharePoint and Microsoft 365 services; and email or messaging providers when you contact us through them. Access is limited to people and providers who need it for the relevant purpose. We may also disclose information to professional advisers, or where lawfully required by a court, regulator or public authority. Any disclosure connected with a genuine business sale or reorganisation would be limited to what is necessary and subject to appropriate confidentiality and data protection measures. We do not sell your personal information. The Contact page embeds a Google map which loads automatically when the map area is reached. When the map loads, your browser connects to Google, which may receive your IP address, browser information and other technical information and use its own storage technologies. Google and messaging or social platforms may act as independent controllers for their own purposes. See Google’s Privacy Policy and the notices of the external services you choose to use.
International visitors and transfers
Our services are operated from the United Kingdom, but visitors and service providers may be in other countries. Global access does not remove rights that apply under local law. Where our activities fall within the scope of another jurisdiction’s privacy rules, we will address those requirements, including any additional notices or representative obligations that apply. Providers may process information outside the UK. Where a restricted international transfer occurs, the applicable transfer requirements must be met, for example through an adequacy regulation or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with any required assessment and supplementary protections. Where EU GDPR applies, the relevant EU transfer requirements also apply. You may contact us for information about safeguards relevant to your data. Provider locations and contractual transfer arrangements remain to be verified before this draft is published.
How long we keep information
We retain personal information only for as long as needed for its purpose and any applicable legal obligations. For enquiries, this depends on resolving the request and whether an ongoing business relationship develops. For consultant or career enquiries, this depends on completing the discussion or assessment; keeping details for future opportunities requires a justified basis and a defined review period. Contract and business records are assessed against accounting, legal and claims requirements. Account access is removed when no longer authorised; session information follows the relevant browser and authentication lifecycle. Technical logs follow documented security and provider retention settings. We delete or anonymise information when it is no longer required. Specific operational retention periods and provider settings must be confirmed before publication; the old policy’s fixed periods have not been carried forward as if they were statutory UK requirements.
Cookies and similar technologies
Our own website code does not currently load optional analytics, advertising or embedded social-feed tracking. Authentication and hosting may use storage needed to deliver the service, including browser session storage. We will assess and explain actual technologies, their purposes and durations in the Cookies notice. Where prior consent is required, those technologies must not be activated until you agree, and withdrawal must be available. Simply continuing to browse is not treated as consent. The cookie inventory and preferences pages need to be aligned with the current Microsoft and Cloudflare setup before publication. The embedded Google map is an external service and is not covered by the statement about our own optional tracking code. Its loading and storage behaviour must be included in the pre-publication cookie assessment and, where required, controlled by prior consent.
Your rights
Depending on applicable law and the circumstances, you may request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. You have an absolute right to object to direct marketing. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. Some rights have conditions or exceptions. Contact our privacy email with your request; we may need proportionate information to verify your identity. We respond within the time required by applicable law. We do not use the website to make solely automated decisions that produce legal or similarly significant effects about you. You do not need to use a particular form or legal wording to make a request. Explain which information or interaction your request concerns so we can locate it. UK rights requests are normally handled without undue delay and within one month, subject to applicable rules on identity checks, clarification and permitted extensions. We will explain any applicable extension, refusal or lawful fee rather than applying a blanket charge. You may complain to the regulator without first contacting us.
Security and external services
We use appropriate technical and organisational measures to protect personal information and restrict access. No internet service can guarantee absolute security; this does not remove our data protection responsibilities. External websites and messaging services have their own privacy notices. Please read those notices when following a link or using their services.
Questions, complaints and changes
Email compliance@supplychain.partners with a question or concern. You may complain to the UK Information Commissioner’s Office, and to a competent local data protection authority where applicable. We review this notice when our services or practices change, update the review date, and provide additional notice of significant changes where appropriate or legally required.