Website and assessment privacy
Your information.
Joshua Phillips trading as Phillips Commercial Intelligence is the controller responsible for your information. Contact josh@phillipscommercial.co.uk about your assessment, privacy rights or marketing preferences.
Assessment privacy policy: PCI-ASSESSMENT-PRIVACY-01 v1.0. Adopted 26 September 2026.
Assessment collection remains closed
Assessment submissions are currently closed while we verify restricted storage, access and the operating controls for the approved policy. The assessment notice below describes the handling approved for launch; collection has not opened.
Browsing this website
This website describes the services offered by Phillips Commercial Intelligence. It is served through ChatGPT Sites using Cloudflare hosting. Delivering and securing pages involves technical request information such as your IP address, browser details and requested URLs. Hosting providers may keep operational and security logs under their own data-handling arrangements. We have not verified a product-specific hosting log retention period. OpenAI privacy information.
This site does not have an assessment-response storage backend. We have not added advertising pixels, a newsletter signup or marketing automation. Opening the assessment when it is available loads Tally, whose data-handling information is linked below.
Contacting Josh
If you email us, your address, message and any attachments are processed in our Google Workspace mailbox so Josh can respond and keep the relevant correspondence. Assessment-related emails follow the assessment retention rules below. Please send only information needed for your enquiry, and leave out passwords, customer lists, sensitive personal details and confidential client documents.
What the assessment collects
When assessment collection opens, we will collect your business and role details, delivery email, answers, optional commercial context and public links so Josh can understand your request, clarify relevant points and prepare your personalised assessment. We also retain the submission date, source and form, privacy and consent versions. Please do not include passwords, customer lists, private client documents or sensitive personal information. Required questions provide the minimum context for the assessment; optional financial details and optional marketing consent can be left blank.
Human review and delivery
Josh reviews the assessment before a PDF is emailed manually to your supplied address. The report may recommend improving an existing tool, making no new implementation, further discussion, or an appropriate PCI capability. It does not calculate supplier pricing or make an automatic suitability, purchase or eligibility decision. Our launch process will not send identifiable answers to ChatGPT or another external AI service.
Why we use assessment information
We rely on our legitimate interests in responding to your requested business assessment, keeping an accurate service record and improving this assessment service. Josh needs the business context and delivery route to prepare the requested response. We limit the information requested, keep optional financial details optional, restrict access, retain human review and use the deletion periods below.
We may review recurring needs using limited internal summaries. Identifiable or linkable summaries remain subject to the same restricted access and case retention, including records that omit names but can still be linked to your case. Only genuinely anonymous reviewed totals and themes may be kept beyond that period; identifiers, identifying combinations, free-text quotations and source links are removed. We do not publish your answers as a case study without separate agreement or use this service-improvement purpose for undisclosed sales targeting.
You can object to this legitimate-interests processing at any time by emailing josh@phillipscommercial.co.uk. We stop active assessment work when you ask us to stop the necessary processing; this may mean we cannot finish the requested report.
Optional marketing permission
Marketing permission is separate. If you tick the optional, unticked box, we record your consent to occasional commercial intelligence ideas, product updates, new capabilities and offers from Phillips Commercial Intelligence. At launch we are collecting permission only; no marketing email programme is active. You receive the same assessment whether or not you tick the box.
You can withdraw at any time by emailing josh@phillipscommercial.co.uk; any future marketing message must also give an unsubscribe route. Withdrawal does not affect the lawfulness of earlier processing or your assessment request. We keep a minimal record of the choice and withdrawal to respect your preferences. This uses the applicable legal obligation to respect your rights and limited legitimate interests in necessary evidence of handling.
Storage, access and providers
The approved launch arrangement uses Tally to collect responses and the PCI Google Workspace account for restricted case files, a separate minimal permission and suppression register, and manual email delivery. Operational access is restricted to Josh, with no public or link sharing. The actual account and access controls are being checked before collection opens; approval of the policy does not certify that setup.
Providers and their authorised personnel process information as needed to provide and secure their services. No assessment details are placed in this public website or a public shared folder. Tally says form data is stored in Europe. Tally data handling.
Google may process data outside the UK; its processing terms provide applicable transfer safeguards. You can contact us for information about the safeguards relevant to your data. We do not promise UK-only storage. Google processing terms.
Once collection opens, Josh retrieves responses directly from Tally. Identifiable real responses will not be sent through the ChatGPT Tally connector, other external AI tools, website build prompts or shared build packages. Draft preparation is manual within restricted Workspace or through the deterministic report generator on Josh’s access-controlled device; every PDF still requires Josh’s review.
Retention and deletion
- Tally source responses: delete and empty Trash within 30 days after verifying a complete restricted export that preserves original answers, metadata, consent wording and versions, and the submission timestamp.
- Completed case files and assessment emails: delete within six months after delivery or the last assessment-specific clarification, whichever is later. This includes raw answers, drafts, the reviewed PDF and linkable needs-analysis records. A separately agreed proposal or client purpose needs its own notice and retention basis; it does not automatically extend the assessment record.
- Uncompleted requests: delete within 90 days of submission unless you are actively requesting further work. Any extension has a recorded reason and specific new due date.
- Temporary processing downloads: remove within seven days after a checked restricted copy or report is saved, and before another user receives the device.
- Unused marketing permission: keep suppressed, review within 12 months of capture and expire it if no separately approved marketing programme has started. We do not carry old permission silently into a changed identity or purpose.
- Minimal consent and withdrawal evidence: keep while permission is current and for up to 24 months after it ends. This record does not require your assessment narrative.
- Do-not-contact records: keep only the address or stable matching identifier, restriction, date and minimal evidence while needed to prevent unwanted contact; review annually. This record is for respecting preferences, not marketing.
- Anonymous learning: only genuinely anonymous reviewed totals and themes may remain beyond case retention. Linkable records remain subject to the case deadline.
Josh records case due dates at export and delivery, checks assessment submissions and privacy email each working day, and checks deletion deadlines each week. Deletion is completed before the due date and logged. A withdrawal is recorded when read and remains suppressed before any later sending decision.
Specific legal obligations or disputes may require a limited record to be kept longer; we record the reason and review date. We operate provider deletion controls and reapply deletions after any restoration. Provider recovery copies and backups expire under their terms; deletion from an active folder does not mean every recovery copy disappears immediately.
Your rights and questions
You may request access, correction, deletion or restriction and, where applicable, portability of your personal data. You can object to legitimate-interests processing and withdraw marketing consent as explained above. Email josh@phillipscommercial.co.uk to exercise your rights or ask questions. We do not charge a routine fee for a rights request. You may complain to the Information Commissioner’s Office.