privacy policy

who we are

The data controller is i am your friend, an independent procurement and commercial consultancy. You can contact us at [email protected] with any questions about this policy or how we handle your data.

what data we collect

We collect personal data in the following circumstances:

• Contact enquiries — name, email address, company or organisation name, and the content of your message when you use our contact form.
• Specialist network registrations — name, email address, phone number, location, LinkedIn profile URL, current role, procurement specialisms, industry experience, years of experience, engagement type preferences, work mode preferences, availability, day rate, a personal introduction, and an uploaded CV.
• Opportunity applications — name, email address, and any information you provide when applying for a listed opportunity.
• Website usage — we do not currently use cookies for analytics or tracking. If this changes, this policy will be updated and appropriate consent mechanisms will be put in place.

why we collect it and our lawful basis

We only collect personal data where we have a lawful basis to do so under UK GDPR:

• Legitimate interests (Article 6(1)(f)) — responding to contact enquiries and managing business relationships. We have assessed that our legitimate interest in responding to your enquiry is not overridden by your rights and freedoms.
• Consent (Article 6(1)(a)) — specialist network registrations. You provide explicit consent at the point of submission. You may withdraw this consent at any time by contacting us at [email protected].
• Contract performance (Article 6(1)(b)) — where we are engaged to provide consultancy services, we process data necessary to fulfil that engagement.

how we use your data

We use the personal data we collect to:

• Respond to your enquiry and communicate with you about potential or ongoing work.
• Maintain a network of procurement and commercial specialists and match them to relevant opportunities.
• Fulfil our contractual obligations where we are engaged to provide services.
• Comply with legal obligations where required.

how long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this policy:

• Contact enquiries — up to 2 years from the date of last contact, unless an ongoing relationship develops.
• Specialist network registrations — up to 3 years from the date of registration, or until you withdraw consent. We will contact you periodically to confirm you wish to remain on the network.
• Opportunity applications — up to 1 year from the closing date of the relevant opportunity.
• Client engagement data — up to 7 years from the end of the engagement, in line with standard legal and financial record-keeping requirements.

who we share your data with

We do not sell, rent or trade your personal data. We may share it in the following limited circumstances:

• Service providers — we use GoDaddy's platform to host this website and manage form submissions. GoDaddy acts as a data processor on our behalf and is subject to appropriate data processing agreements.
• Client organisations — where you are a specialist in our network and a relevant opportunity arises, we will ask your permission before sharing your details with a client.
• Legal requirements — we may disclose your data if required to do so by law or in response to valid legal process.

international transfers

We primarily process your data within the UK and European Economic Area (EEA). Where any data is transferred outside the UK or EEA — for example, via third-party platform infrastructure — we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions recognised under UK GDPR.

your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your data where there is no compelling reason for us to continue processing it.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — where processing is based on consent or contract, you can ask us to provide your data in a structured, machine-readable format.
• Right to object — you can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

how to exercise your rights

To exercise any of your rights, please contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.

complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO — please reach out to us at [email protected] in the first instance.

changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page will always show when it was last revised. We encourage you to review this policy periodically.