Legal and governance

Privacy notice

The Commercial Transformation Index (CTI) is a research and benchmarking programme, and research runs on evidence. This notice sets out what information CTI handles, why, on what lawful basis, who else is involved in handling it, how assessment evidence reaches published research, and what you can ask CTI to do about information concerning you.

Effective: 25 September 2026
Last reviewed: 25 September 2026

What this notice covers

This notice covers personal information handled by CTI: information about identifiable people. It applies to this website, to enquiries sent through it, to the published email addresses, and to the personal information handled in the course of a CTI assessment or research programme.

Most of what CTI measures is not personal information at all. A CTI assessment examines how an organisation's commercial systems are built, connected and operated. That evidence is about the organisation. This notice says so where the distinction changes what applies, because treating commercial evidence and personal information as one category is how notices become misleading in both directions.

Assessments are not carried out on this website. They run in a separate CTI assessment environment, operated by the same organisation. This notice explains what an assessment collects and how CTI uses the evidence. The operative detail for a specific assessment is given in that environment at the point you start one.

What crosses between this website and the assessment environment

Starting an assessment is a link, not a transfer. This website sends you to the assessment environment and passes nothing with you: no name, no address you typed, no identifier and no record of what you read here. Everything the assessment needs, you give it there.

In the other direction, research reaches this website only as published output: aggregated findings that have cleared the rules set out below. No individual assessment record and no organisation's own result is sent here for publication.

If you allow Analytics, CTI records that an assessment was started, which one, and the destination's bare host name. That measures the link being used. It carries nothing about you, and it goes no further than the measurement described below.

Where CTI is engaged under a written agreement, for a commissioned audit, a cohort or a programme, that agreement governs the engagement and may set terms that are more specific than this notice. This notice is not a substitute for it.

Who is responsible

CTI is operated by b10. The same organisation publishes this website, operates the assessment environment and is the data controller for the information described in this notice.

Data controller: B10HUB LIMITED, trading as b10
Company number: NI718817
Registered address: Office 1145, 92 Castle Street, Belfast, Northern Ireland, BT1 1HE
Privacy contact: privacy@ctindex.org

Everything about your own information goes to the privacy address: access requests, corrections, erasure, objections, and complaints. It is read by the people who can act on it. General enquiries go through the Contact page, which routes to the right place.

The privacy address is the data protection contact for CTI, and reaches the people responsible for the handling described in this notice.

The information CTI handles

CTI handles personal information from the following main sources.

Information you give directly: What you type into the enquiry form on this website, what you write to a published CTI address, and the contact details and supporting material supplied by the people who take part in an assessment or a programme.
Information generated by using this website: The technical information a website receives in order to serve and protect a request, such as the address the request came from, the browser making it and the response to the security check on the enquiry form. Where you allow it, this also includes the measurement described under cookies and measurement below, which involves Google, Microsoft and Apollo. CTI records no personal information about a visit beyond what that section sets out.
Information from public and permitted external sources: Evidence organisations publish about themselves, principally on their own websites, and published market, sector and economic sources used to frame a finding. Personal information appears in these sources incidentally, and is treated as set out below.

This website has no accounts and no sign in. It asks for no payment details, and it holds none. CTI does not buy contact lists, and does not seek special category information such as health, beliefs or biometric data. Please do not send it in an enquiry.

Enquiries sent through this website

The enquiry form asks for five things, and it asks for nothing else.

Your name.
Your organisation.
Your work email address.
The enquiry type you choose from the published list.
Your message.

There is no field for a telephone number, a postal address, a job title or anything about someone other than you. Any other value sent with the form is discarded by the endpoint rather than used, so an added field cannot smuggle itself into an enquiry.

The form also carries a verification check that distinguishes a person from an automated script. Its purpose is abuse prevention, and it is described under cookies below.

What happens to it

An enquiry crosses three systems on its way to CTI, and each handles a different part of it.

Cloudflare: Serves this website, runs the enquiry endpoint and operates the verification check. Handles the submission in transit, the response to the check, and the network address the request came from.
Resend: Transmits the enquiry to the CTI mailbox. Handles the composed message, the CTI address it is sent to, and your email address, which is set as the reply address so a reply reaches you.
Microsoft 365: The CTI mailbox. Holds the enquiry once it is delivered, and everything that follows from reading and replying to it. This is where an enquiry comes to rest.

What the enquiry process does not do

The enquiry submission process does not store a separate copy of your enquiry in a CTI application database. Your message travels through the contact endpoint, is transmitted by the email provider, and comes to rest as an email in the CTI mailbox.

The network address your request came from is used by the infrastructure to deliver and protect the request and to apply abuse limits. CTI does not store it through this process, does not write it to any record CTI keeps, and it does not appear in the enquiry that reaches us.

Sending an enquiry does not subscribe you to anything. There is no mailing list attached to the form, and CTI sends no marketing in response to an enquiry.

Your enquiry is routed to a CTI mailbox chosen by the enquiry type you selected. The routing is fixed on the server. A request cannot choose where it is sent.

CTI uses service providers to operate its infrastructure. Where a provider processes personal information on CTI's behalf as a processor, the applicable data processing terms govern that processing. A provider may also act as a controller for limited purposes of its own, such as the security and integrity of its own network, and where it does, its own privacy information applies to that processing.

Information handled in an assessment

CTI offers four assessment routes. They differ in what they examine, and therefore in what they collect. The personal information in all four is small: it is the contact details of the people who take part. The substance of an assessment is evidence about the organisation.

Free Website Audit: Started in the assessment environment with a name, company, email address, website address, sector and country. It then reads the public evidence at that website address. No login, no credential and no access to an internal system.
In-Depth Website Audit: The public website evidence, any analytics or search evidence the organisation chooses to provide, and the contact details needed to deliver and discuss the audit.
Commercial Maturity Assessment: Declared answers about how the organisation's commercial systems operate, alongside observed website evidence, and the contact details of the people completing it.
Full CTI Audit: Supporting evidence supplied by the organisation during the audit and reviewed by an assessor, and the contact details of the people involved in it. Material supplied here may include documents and system exports, so what is shared is agreed in advance rather than collected by default.

A result is produced for the organisation that was assessed. CTI does not publish an organisation's individual result, does not sell it, and does not disclose it to another organisation. Taking part in an assessment does not make a result public.

That is a statement about the identifiable result. It is not a statement that the evidence is never used again, and this notice sets out what else it contributes to under research and aggregation below.

Public and external sources

CTI analyses evidence that organisations publish about themselves. That is the point of the website audit routes: a buyer, a search engine and an AI system form a view from the public website before anyone speaks to the organisation, and CTI reads that evidence the same way.

The subject of that analysis is the organisation's commercial evidence: how clearly it explains what it does, who it is for, what it can prove, and how discoverable and machine readable that is. It is not an exercise in finding out about the people named on the page.

Information about identifiable people does appear on public websites, in team pages, author bylines and contact details. Where CTI processes it, three things apply.

Being publicly available does not place information outside data protection law, and CTI does not treat it as though it does.
CTI relies on legitimate interests for it, and the interest is in the organisation's commercial evidence. CTI does not build a profile of a named individual from it, and does not use it to target that individual.
The rights set out below apply to it in the same way as to anything else in this notice.

CTI also uses published market, sector and economic sources to describe the conditions a group of organisations operates in. Those sources are attributed wherever a finding rests on them. How CTI's analysis works is not described here, and the pages describing each assessment route set out what it examines.

Purposes and lawful bases

CTI processes personal information for the purposes below and no others. Each purpose has its own lawful basis, and a basis is not carried across from one purpose to another.

Responding to an enquiry: Your name, organisation, work email address, enquiry type and message, so CTI can answer you and continue the conversation. Legitimate interests: responding to a business enquiry somebody chose to send. Where the enquiry concerns a possible engagement, steps taken at your request before entering a contract.
Delivering an assessment or a programme: The contact details of the people taking part, so the assessment can be run and the result returned. Performance of the contract where the individual is the contracting party. Otherwise legitimate interests: administering an engagement with the organisation the person acts for.
Keeping the website and the enquiry route working and safe: The technical information needed to serve a request, and the verification check on the enquiry form. Legitimate interests: keeping a public service available and preventing automated abuse of it.
Analysing public commercial evidence: Evidence organisations publish about themselves, including personal information that appears in it incidentally. Legitimate interests: conducting commercial research into how organisations present and operate their commercial systems.
Research, benchmarking and developing the methodology: Assessment and research evidence, which is overwhelmingly about organisations rather than people. Legitimate interests, and where assessment evidence is involved, the research use agreed for that assessment. Set out in full below.
Measuring how this website and CTI's published research are used: Aggregate information about pages read, navigation and engagement, through Google Analytics 4 and Microsoft Clarity, so CTI knows which of its research is useful. Consent, under the Analytics category. Nothing is collected and no provider is contacted before you give it, and withdrawing it stops further collection.
Identifying the organisation a visit came from: Your network address, used by Apollo to infer the organisation, so CTI can see which kinds of organisation its research reaches. Organisation level only. Consent, under the Marketing category. Nothing is collected and Apollo is not contacted before you give it.
Meeting legal and regulatory obligations: Records CTI is required to keep, and information needed to answer a rights request or establish, exercise or defend a legal claim. Legal obligation, or legitimate interests in the case of a legal claim.

Where CTI relies on legitimate interests

Legitimate interests requires CTI to weigh what it wants to do against the effect on the people concerned, and to be able to show it did. In the cases above the interest is a commercial research programme and the service that supports it; the information is business contact information or evidence an organisation chose to publish; and the effect on an individual is limited, because the analysis is about the organisation and not about them.

You can object to processing carried out on this basis at any time, and CTI will stop unless it can show compelling grounds that override your interests. The rights section says how.

CTI does not rely on the recognised legitimate interests basis introduced by the Data (Use and Access) Act 2025 for any of the purposes above.

Consent is relied upon for measurement, and only for measurement. It is asked for in two separate categories, Analytics and Marketing, each of which can be granted or refused on its own and neither of which is bundled with anything else. Both can be withdrawn at any time, without affecting anything done before you withdrew them, and withdrawing either costs you no access to anything published here.

Research, benchmarking and commercial intelligence

CTI exists to measure commercial systems across many organisations and to publish what that measurement shows. Evidence accumulates: from website audits, from maturity assessments, from full audits, from permitted external sources, and from research and cohort programmes. That accumulated evidence is what makes a benchmark a benchmark rather than an opinion.

Evidence contributes to four things.

Aggregated benchmarks, so an organisation can see where it sits against a comparable group.
Cohort, sector, regional and market analysis, and the published research and reports drawn from it.
Programme level findings, where CTI is commissioned to measure a group of organisations together.
Development of the CTI methodology and of the analytical systems behind it, so the measurement improves as the evidence base grows.

The working material for all four is organisational and commercial evidence: how commercial systems are set up, connected and operated. Personal information is not treated as generally reusable for these purposes. Where personal information would be involved, it is used only where a purpose and a lawful basis in this notice apply to it.

CTI does not supply personal information collected through this website or through assessments to another organisation for the training of that organisation's models.

What separates an organisation's result from published research

Two rules govern the boundary, and they are published in full on data and sources.

Assessment evidence contributes to published intelligence only where research use has been agreed for that assessment.
Published figures are aggregates. Where a group is too small for an aggregate to describe a population rather than the organisations in it, CTI suppresses the figure and the publication says so. Cohorts are constructed so that a combination of filters cannot narrow a published figure to one participant.

Every published figure states the population it describes, so a reader can judge what it supports.

Aggregation and de-identification

CTI describes the evidence behind its published research as aggregated and de-identified. It does not describe it as anonymous, and the difference is deliberate.

Anonymisation is a legal threshold, not a formatting step. Information is anonymous only where people are no longer identifiable by any means reasonably likely to be used, taking account of everything else that could be combined with it. Removing an organisation's name does not on its own reach that threshold, and it is least likely to reach it in a small cohort or a narrow sector, which is exactly where a benchmark is most interesting.

So CTI states its position plainly. Where it has not established that the threshold is met, it continues to treat the information as personal information and this notice continues to apply to it. Suppression rules and the rule that identifiers are removed before aggregation are controls that reduce the risk of identification. They are not a declaration that the risk has reached zero.

Where CTI does establish effective anonymisation for a defined output, that output falls outside data protection law and this notice will say which outputs those are rather than implying it.

Who information is shared with

CTI does not sell personal information and does not share it for another organisation's marketing. Information is shared in four circumstances.

Service providers. The providers that serve this website, transmit an enquiry, hold the CTI mailbox, run the assessment environment, provide the measurement described below and support CTI's ordinary business systems. Their roles are not identical and this notice does not pretend they are: the table below says which is which.
Within the assessment relationship. A result goes to the organisation that was assessed. Where an assessment forms part of a commissioned programme or cohort, what is reported to the commissioning body is agreed in that engagement before the assessment starts.
Professional advisers. Legal, accounting and insurance advisers, where there is a genuine need.
Where the law requires it. A court, a regulator or a law enforcement body where CTI is legally obliged to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim.

Who acts in which capacity

A provider that processes on CTI's instructions is a processor. A provider that decides for itself what to do with information it collects is a controller in its own right, and its own privacy information governs that. The distinction is not cosmetic, so it is stated per provider rather than averaged into one sentence.

Cloudflare: Serves and protects the site, runs the enquiry endpoint and operates the verification check. Processor, under its data processing terms. It also acts for its own purposes in respect of the security and integrity of its own network.
Resend: Transmits the enquiry notification. Processor, under a data processing agreement.
Microsoft 365: Holds the CTI mailbox. Processor, under Microsoft's data protection addendum. The mailbox workload itself is currently located in the United Kingdom, which is described under handling outside the UK below.
Google, for Analytics and the tag container: Processor, under Google's data processing terms for these products.
Microsoft, for Clarity: Not a processor. Clarity's terms make Microsoft and CTI independent controllers of what Clarity collects, so Microsoft collects it in its own right and there is no processing agreement between them for it. This is a real difference, and it is part of why Clarity sits behind consent.
Apollo: Both. Processor for the visit it resolves for CTI, and an independent controller of its own business database, to which that resolution contributes.

If CTI's business or a part of it were transferred to another organisation, information would transfer with it and this notice would continue to apply until the receiving organisation published its own and notified the people concerned.

Handling outside the UK

CTI is based in the United Kingdom and it would be easy, and wrong, to write that information never leaves it. Several of the providers CTI relies on are established outside the UK or operate infrastructure outside it, and a global content delivery network is part of what keeps a public website fast and available.

Google, Microsoft, Apollo, Cloudflare and Resend are all United States organisations, so information reaching them is transferred outside the UK. Each is certified under the UK Extension to the EU to US Data Privacy Framework, which is the UK's partial adequacy finding for the United States, and each additionally carries standard contractual clauses or the ICO's International Data Transfer Agreement as a fallback if that framework ceases to apply.

One point deserves stating plainly rather than being left to inference. CTI's enquiry transmission is configured to a European sending region, and it would be easy to present that as European data residency. It is not. The provider's own documentation is explicit that the region controls where a message is sent from and not where it is stored, and that account data, message metadata and logs are held in the United States whichever region is selected. This notice says so rather than implying otherwise.

The CTI mailbox is the one place where a residency position can be stated, because Microsoft publishes it for the tenant rather than leaving it to inference. The Exchange Online workload that holds the mailbox is currently located in the United Kingdom, and Microsoft records a United Kingdom data residency commitment for it.

That statement is deliberately narrow, and the narrowness is the point. It is about one workload, not about Microsoft 365 as a whole. Other Microsoft services involved in handling mail, including the filtering and protection layer an enquiry passes through on its way to the mailbox, carry no residency commitment, so processing by them may occur outside the United Kingdom. Where it does, the transfer safeguards described above apply. CTI states the commitment it has and does not extend it to services that do not carry one.

For every other provider this notice makes no claim about which country information is stored in beyond what that provider itself states. An account interface displaying a United Kingdom locale is a display setting rather than a statement about where data lives, and presenting one as the other is a representation CTI is not in a position to make. What protects the transfer is the mechanism named above, which applies wherever the information is held.

You can ask for information about the safeguards in place for a specific provider by writing to the privacy address.

How long information is kept

Two different things govern how long information lasts, and conflating them is how retention sections become meaningless. CTI sets the periods for what CTI holds. A provider sets the periods for what the provider holds, and CTI says what those are rather than implying it controls them.

Information CTI holds

Enquiries: 24 months from the last meaningful interaction, then deleted. If you become a client, or there is a continuing legal or commercial reason to keep the record, it is kept under the contractual rule below instead.
Self-service assessment records: Records from an unpurchased or self-service assessment that contain personal information, or information identifying an organisation and its contacts, are kept for 24 months after the assessment or the last activity on it.
Paid and client records: Assessment and contractual records for paid work are kept for the life of the active relationship, and then for up to 6 years where that is needed for contractual, accounting, tax, regulatory or legal-record purposes.
Security and operational logs: 90 days at most, unless a specific incident has to be investigated or evidenced, in which case the records relevant to it are kept until that is concluded. These logs carry no submitted value: no name, no organisation, no address, no message.
Rights requests and complaints: Kept for as long as is needed to show how the request was handled, and no longer.
Aggregated research and benchmark data: Once information has been aggregated to the point where it is genuinely no longer personal information, it falls outside this notice and may be kept indefinitely as part of the research base. CTI applies the test described under aggregation above before treating anything that way, rather than assuming it.

Information a provider holds

CTI does not set these periods and cannot shorten them. They are stated because you are entitled to know how long information about your visit exists, not only how long CTI keeps it.

Google Analytics: Event-level data 2 months. User-level data 14 months, reset when the same user is active again. These are the values configured on the CTI property.
Microsoft Clarity: Session replay 30 days. Favourited sessions, a sampled selection and heatmap data up to 9 months. After that the data is deleted from Microsoft's systems and cannot be recovered.
Apollo: Apollo publishes retention criteria rather than a fixed period, and applies them to the database it controls in its own right. CTI does not determine how long Apollo keeps that information. Apollo states that it decides by reference to the purposes the information was collected for, its amount, nature and sensitivity, the relationship involved, legal requirements and the risks of keeping it, and that it deletes, anonymises or de-identifies the information once keeping it is no longer appropriate. CTI will not publish a number Apollo has not committed to.
Enquiry transmission: The transmission provider holds its copy of the message and its delivery log for 30 days.
Hosting and security logs: Operational log lines from the enquiry endpoint are held by the hosting platform for up to 7 days.

You can ask what is held about you and ask for it to be deleted at any time. CTI will do so for the information it controls unless it has a reason it can state for keeping it, and will help you reach a provider that controls information in its own right. The rights section explains how, and where the limits are.

Security

This section describes the shape of CTI's safeguards. It deliberately does not publish thresholds, control logic or configuration detail, because publishing those would help the people the controls exist to stop.

Everything on this website is served over an encrypted connection.
The enquiry endpoint accepts requests only from this site's own pages, bounds what it will accept, validates every field against a fixed list, and applies automated abuse controls.
The verification check on the enquiry form is confirmed on the server. A submission that has not passed it is not sent.
No personal information from an enquiry is written to CTI's operational records. Not your name, not your organisation, not your email address, not your message.
Credentials for the services CTI uses are held in the hosting platform's encrypted secret storage. None appears in CTI's source code, in the published website or in anything sent to your browser.
Access to the CTI mailbox and to assessment records is limited to the people who need it.
The tag container that the measurement services run inside is treated as a privileged control surface rather than a marketing tool, because anything placed in it executes on every public page, including the page carrying the enquiry form. Administrative access to it is restricted to a single named authorised administrator.

No safeguard is absolute. If a breach of personal information occurs that is likely to result in a risk to people's rights and freedoms, CTI will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and will tell the people affected where the risk to them is high.

Cookies, measurement and similar technologies

Storage and access technologies are the cookies, local storage and similar mechanisms a website can use to store information on your device or read information from it. CTI groups them into three categories. Which category a technology falls into decides whether your consent is needed, and nothing outside the first category runs until you have given it.

Essential

These deliver the site, keep it secure and make its essential functions work. Technologies that are strictly necessary to provide a service you have requested, including security and fraud prevention, do not require consent under the Privacy and Electronic Communications Regulations, and they cannot be switched off without breaking the site.

Your measurement choice: One first-party cookie, ctindex_consent, records the choice you make below so that it is honoured and you are not asked again. Its whole value is a schema version and two yes or no flags, at most a dozen characters. It holds no name, no identifier and no record of what you looked at. It is not set at all until you make a choice, it lasts 180 days, and changing a preference replaces it rather than adding to it. It is deliberately kept when you refuse, because a refusal has to survive or you would be asked again on every page.
Security and delivery: The verification check on the enquiry form, which tells a person from an automated script by reading signals about the request such as the network address it came from and the browser making it. It is configured without pre clearance, so it issues no clearance cookie. The infrastructure that serves and protects the site may also set identifiers strictly necessary for the security and delivery of a request.

CTINDEX.org uses no local storage, no session storage and no browser database. The consent cookie is the only storage on your device that this site creates.

Analytics

Off unless you turn it on. Analytics consent activates two services.

Google Analytics 4: Aggregate measurement of how CTI research is read: which pages, how people move through them, and the three events described below. Google acts as CTI's processor for this. Google sets its own cookies and processes your network address for approximate location. On CTI's property, event-level data is kept for 2 months and user-level data for 14 months. Google Signals is switched off and user-provided data collection is not enabled, so no cross-device or signed-in Google identity is brought into CTI's measurement.
Microsoft Clarity: Session replay and heatmaps, which show how a page is actually used rather than only how often it is opened. Clarity records interaction such as movement, clicks and scrolling, and the page as it was rendered to you, subject to the masking described below. CTI uses it to understand usage, experience and usability, and so to improve the site. It is optional and it is not necessary to provide this service. Nothing here depends on it, and refusing it changes nothing about what you can read or do. Microsoft is not CTI's processor for this. Under Clarity's terms Microsoft and CTI are each independent controllers, so Microsoft collects this information in its own right and its own privacy statement governs what it then does with it.

What session replay does not capture

Clarity runs in Balanced masking, so text content is masked by default rather than recorded verbatim. The enquiry form is masked harder still, explicitly and by name in the page markup, so what you type into it is not captured in a replay. The unmask directive that would reverse this is prohibited and the build fails if it ever appears.

Marketing

Off unless you turn it on. Marketing consent activates one service.

Apollo, at organisation level only: Apollo uses your network address to work out which organisation a visit came from, so CTI can see which kinds of organisation its research reaches. It is configured to identify the organisation only. Person-level identification is not authorised, is not switched on, and in any event Apollo offers it only for United States contacts. Apollo acts as CTI's processor for the visit, and as an independent controller of its own business database, which the visit contributes to.

CTI's Marketing category means this and nothing else. It enables no advertising of any kind.

Advertising is switched off, and consent cannot switch it on

The Google advertising signals ad_storage, ad_user_data and ad_personalization are denied at all times, whatever you choose. There is no Google Ads integration, no remarketing, no Google Signals, no ads personalisation and no enhanced conversions. Granting Marketing consent does not change any of this, because the Marketing category exists for organisation-level identification and touches no advertising setting.

What is measured, and what never is

Three events are recorded when Analytics consent is given. There are no others.

A page being read: The page address, path and title, and the page you arrived from. The address is rebuilt from the protocol, host and path alone, so the query string and anything after a hash are never read and can never reach Google. A referring address from another site is reduced to that site's name. Campaign values are taken from a fixed list of five standard parameters and every other parameter is ignored.
An assessment being started: Which assessment, which page you started from, and the destination's bare host name. The full destination address is never transmitted.
An enquiry being accepted: Recorded only after the server accepts the enquiry, and carrying one value: which desk it was routed to. Nothing you typed is included. Media and careers enquiries are deliberately not measured at all, so sending one produces no event of any kind.

Your name, your organisation, your email address, anything you write in the enquiry form, your answers to the interactive instruments, and any assessment result, score or band are never included in measurement. That is built into how the events are constructed rather than left to care: there is no field in them that free text could occupy.

Measurement runs only on CTI's public pages. Private and pre-publication research material carries no measurement at all, and neither does the site's internal design fixtures.

Your choice, and changing it

Analytics and Marketing are both denied until you choose. Before you choose, nothing is requested from Google, Microsoft or Apollo at all: the choice is handled entirely on your own device, and no third party is contacted to tell it that you have refused. If you refuse, the container that would load these services is never requested, on that visit or any later one.

Continuing to browse is not consent. You can accept all, reject all, or choose each category separately, from the same panel and with the same effort.

Cookies and measurement, at the foot of every page, reopens that panel at any time. Withdrawing a permission records the refusal, tells Clarity to stop if it is running, deletes the measurement cookies CTI can delete, and reloads the page, because a script already running in a page cannot be unloaded any other way. The new page requests nothing.

Withdrawing costs you no access to anything published here.

Why this notice names providers but does not link to them

Every third-party service named above runs as a tag inside one governed container rather than as a script written into CTI's own pages. A build check enforces that by refusing to ship any page containing a provider's web address or account identifier, which is what stops a tag being quietly added beside the container. The same check would reject a link to a provider's privacy policy. Linking to some providers and not others would be worse than linking to none, so this notice names all of them and links to none, and you can reach each provider's own privacy information by searching for it by name.

Automated decisions and profiling

CTI assessments are substantially automated, and they produce scores. Those scores are about an organisation's commercial systems. They are not decisions about an individual, they produce no legal effect on an individual and no similarly significant effect on one.

CTI does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects on them, and does not profile individuals for marketing. If that ever changes, this notice will say so, and will set out the logic involved and the significance and consequences of it before the processing starts.

Children

CTI's services are for organisations and the people who work in them. This website is not directed at children, offers nothing to them, and CTI does not knowingly collect information about them. If you believe CTI holds information about a child, write to the privacy address and it will be removed.

Your rights

You have the following rights in relation to your own personal information. Some apply only in particular circumstances, and CTI will explain if one does not apply to your request rather than leaving you to guess.

Access. Ask what CTI holds about you and get a copy of it.
Rectification. Have inaccurate information corrected or completed.
Erasure. Ask for information to be deleted where CTI has no continuing reason to hold it.
Restriction. Ask CTI to limit how it uses information while a question about it is resolved.
Objection. Object to processing carried out on the basis of legitimate interests, including the research and public source analysis described above.
Portability. Receive information you provided in a portable format, where the processing is based on consent or a contract and is carried out automatically.
Withdrawing consent. Where CTI relies on consent for something, withdraw it at any time, without affecting what was done before you withdrew it.
Automated decisions. Not be subject to a decision based solely on automated processing that produces a legal or similarly significant effect on you.

Send a request to the privacy address. CTI will respond without undue delay and within one month. Where a request is complex, or where several requests are made, that period can be extended by up to two further months, and CTI will tell you within the first month if that applies and why. There is no charge, unless a request is manifestly unfounded or excessive.

CTI may need to confirm who you are before acting on a request, so that it does not disclose one person's information to another.

Where a right has to be exercised against someone else

Most of what this notice covers is information CTI controls, and CTI answers for it. Two of the measurement services are different, and saying so is more useful to you than a promise CTI could not keep.

Microsoft Clarity: Microsoft is an independent controller of what Clarity collects, so rights over that information are exercised against Microsoft, through the route in its own privacy statement. CTI will help you do that as far as it reasonably can. CTI cannot promise to erase an individual session, because Clarity does not support deleting one person's data: the only deletion it offers is of the whole project. Saying otherwise would be a commitment the service cannot honour. What CTI can do is stop further collection immediately, which withdrawing Analytics consent does.
Apollo: Apollo acts as CTI's processor for the visit it resolves, and CTI answers for that part. Apollo is also an independent controller of its own business database, and rights over that are exercised against Apollo directly. Apollo publishes a route for access, objection and deletion requests, and states that it keeps a minimum suppression record afterwards so that a deletion is not quietly undone by its database being rebuilt.

If you are not sure which applies, write to the privacy address and say what you want done. CTI will tell you which information it controls, deal with that part itself, and point you at the right route for the rest rather than leaving you to work it out.

Complaints

If you are unhappy with how CTI has handled your information, complain to CTI first. Write to the privacy address and say that it is a data protection complaint, so it is recognised as one and handled as one. CTI will acknowledge it within 30 days and respond without undue delay.

You can also complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk. Complaining to CTI first does not take that right away, and you do not have to wait for CTI's response before doing it.

Changes to this notice

This notice is dated and versioned. When it changes, the effective date changes with it, and a change that affects how information is handled is recorded against the version it applies from rather than applied silently.

If the identity of the data controller changes, CTI will update this notice and provide any notification required by applicable data protection law.

The Commercial Transformation Index methodology pages, data and sources and the terms sit alongside this notice and describe the rest of how CTI works.