Privacy Policy

1. Who We Are (Data Controller)

• Company: Howcroft Group Limited
• Registered Address: Unit 9, Brookfields Way, Manvers, Rotherham, S63 5DL
• Telephone: +44 (0)1709 878282
• Email: hello@howcroft.group

As data controller, we determine why and how your personal data is processed. If you have any questions about this policy or wish to exercise your rights, please contact us using the details above.

2. What Personal Data We Collect

We collect the following categories of personal data:

• Identity Data: Full name, job title — collected when you register an account.
• Contact Data: Email address, telephone number — collected via registration, contact forms, and enquiry forms.
• Account & Organisation Data: Company name, industry, employee count, organisation settings — collected during onboarding and account management.
• Procurement Data: Supplier records, spend data, purchase orders, invoices, delivery logs, audit responses, and scorecards that you upload or create within the platform.
• Technical Data: IP address, browser type, pages visited, time on site — collected automatically via cookies and analytics.
• Billing Data: Subscription tier, billing cycle, and payment status — collected when you subscribe. Card details are handled by our payment processor and are not stored by us.
• Marketing Preferences: Newsletter and digest consent — collected via sign-up forms and account settings.

We do not knowingly collect special category data (e.g. health, biometric, or financial data) through our forms. We do not knowingly collect data from individuals under 16 years of age.

3. How We Use Your Personal Data

• Providing and operating the MROiq platform, including supplier audits, scorecards, spend visibility, and delivery tracking — Performance of a contract (Article 6(1)(b)).
• Creating and managing your user account and organisation — Performance of a contract (Article 6(1)(b)).
• Processing subscription payments and managing billing — Performance of a contract (Article 6(1)(b)).
• Sending weekly digest emails and platform notifications — Legitimate interests (Article 6(1)(f)).
• Sending marketing emails and newsletters — Consent (Article 6(1)(a)), which you may withdraw at any time.
• Improving our platform and understanding how users use it — Legitimate interests (Article 6(1)(f)).
• Complying with legal or regulatory obligations — Legal obligation (Article 6(1)(c)).

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider another purpose compatible with the original. We will notify you if we intend to use your data for a materially different purpose.

4. Cookies and Analytics

Our platform uses cookies and similar tracking technologies to enhance your experience and analyse usage. By continuing to use MROiq, you consent to our use of cookies as described in our Cookie Policy.

5. Who We Share Your Data With

We do not sell your personal data. We may share it with trusted third parties only where necessary:

• Cloud hosting & platform providers — Hosting and infrastructure acting as data processors under contract.
• Payment processor — To handle subscription payments. Card details are processed by the payment provider and are not stored by us.
• Email delivery providers — To send digest emails, notifications, and marketing communications.
• Analytics providers — To understand platform usage in aggregate, anonymised form.
• Professional advisers — Solicitors, accountants, or insurers where legally required.
• Regulatory authorities — Where required by law (e.g. HMRC, ICO).

All third-party processors are required to process your data only on our documented instructions and in compliance with applicable data protection law.

6. International Data Transfers

Some of our third-party service providers may be based outside the UK and the European Economic Area. Where data is transferred internationally, we ensure appropriate safeguards are in place, including the use of UK International Data Transfer Agreements (IDTAs) or equivalent Standard Contractual Clauses approved by the ICO.

7. Data Retention

We retain your personal data only for as long as necessary:

• Account and organisation data — Retained for the lifetime of your account, then deleted within 90 days of closure.
• Procurement data (suppliers, spend, audits, scorecards) — Retained for the lifetime of your account.
• Billing records — 7 years (legal / tax obligations).
• Marketing consent records — Until consent is withdrawn, plus 1 year.
• Website analytics data — Up to 26 months.

After the applicable retention period, your data is securely deleted or anonymised.

8. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Ask us to correct inaccurate or incomplete data.
• Right to erasure — Ask us to delete your data where there is no compelling reason to keep it.
• Right to restrict processing — Ask us to pause processing in certain circumstances.
• Right to data portability — Request your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — Withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at hello@howcroft.group. We will respond within one calendar month and may ask you to verify your identity.

9. Marketing Communications

We will only send you marketing emails where you have given explicit consent. You can unsubscribe at any time by clicking the unsubscribe link in any email, emailing hello@howcroft.group, or calling +44 (0)1709 878282. Withdrawing consent does not affect the lawfulness of prior processing.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS/TLS), access controls, regular security reviews, and staff awareness of data protection obligations. In the event of a personal data breach likely to risk your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay where required.

11. Right to Lodge a Complaint

If you are unhappy with how we have handled your personal data, please contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — 0303 123 1113 — ico.org.uk.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date will always reflect the most recent version. Where changes are material, we will notify you by email or by a prominent notice within the platform.

13. Contact Us

For any questions about this Privacy Policy, contact hello@howcroft.group or write to Howcroft Group Limited, Unit 9, Brookfields Way, Manvers, Rotherham, S63 5DL.