Section 01
Data Controller
The data controller for all personal data processed through the Direct Intelligence platform (directintelligence.co.uk) is The Contact Institute Limited, trading as Direct Intelligence.
Information
Legal NameThe Contact Institute Limited
Trading AsDirect Intelligence
JurisdictionEngland & Wales
ICO RegistrationRegistered with the Information Commissioner's Office
Primary Contactgary@directintelligence.co.uk
Section 02
Data We Collect
We collect personal data through the following touchpoints on this platform:
Briefing Requests (/contact)Name, organisation, role, seniority, work email, telephone, sector classification, corridor selection, briefing type, and free-text technical requirement.
Vault Access Requests (/briefing-gate)Name, organisation, role, sector, work email, and entity classification type.
Platform UsageStandard server logs including IP address, browser type, pages visited, and timestamps. No individual profiling is conducted from this data.
CommunicationsAny data contained in email or other direct correspondence with our team.
We do not collect sensitive personal data (special category data under UK GDPR Article 9) through this platform.
Section 03
Lawful Basis
We process personal data under the following lawful bases as defined in UK GDPR Article 6:
Processing Activity
Lawful Basis
Briefing requests
Legitimate interests (responding to institutional enquiries)
Vault access
Consent (explicit agreement at point of request)
Server logs
Legitimate interests (platform security and performance)
Direct communications
Legitimate interests / Contract performance
Section 04
How We Use Your Data
Personal data submitted through this platform is used exclusively for the following purposes:
- -Responding to briefing requests and technical enquiries from institutional and sovereign entities.
- -Verifying eligibility for access to restricted intelligence assets (the Dossier Series).
- -Delivering requested dossiers and follow-up communications related to specific engagement requests.
- -Maintaining records of institutional engagement for relationship management purposes.
We do not use personal data submitted through this platform for marketing, advertising, or any form of automated decision-making. We do not sell, rent, or license personal data to any third party.
Section 05
Data Sharing
We do not share personal data with third parties except in the following limited circumstances:
Service ProvidersCarefully selected processors who provide infrastructure services (hosting, email delivery) under data processing agreements compliant with UK GDPR.
Legal ObligationWhere required by law, court order, or regulatory authority with appropriate jurisdiction.
Business TransferIn the event of a merger, acquisition, or asset sale, subject to equivalent privacy protections being maintained.
All third-party processors are required to maintain appropriate technical and organisational security measures and are prohibited from processing data for their own purposes.
Section 06
Retention
Data Category
Retention Period
Briefing request data
3 years from last contact, unless an engagement is initiated
Vault access records
2 years from request date
Engagement records
7 years (statutory accounting requirement)
Server logs
90 days rolling
Data is securely deleted or anonymised upon expiry of the applicable retention period.
Section 07
Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of Access (DSAR)Request a copy of the personal data we hold about you.
Right to RectificationRequest correction of inaccurate or incomplete data.
Right to ErasureRequest deletion of your data where there is no compelling reason for continued processing.
Right to RestrictionRequest that we restrict processing of your data in certain circumstances.
Right to PortabilityReceive your data in a structured, machine-readable format.
Right to ObjectObject to processing based on legitimate interests.
Right to Withdraw ConsentWhere processing is based on consent, withdraw it at any time.
To exercise any of these rights, contact our DPO at gary@directintelligence.co.uk. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office.
Section 08
Gated Content & Vault Access
Access to the Dossier Series (/briefing-gate, /vault-access) requires submission of verification data confirming CNI-designated or sovereign entity status. This data is processed as follows:
- -Entity classification and contact data is used solely to verify eligibility and deliver the requested dossier.
- -Verification records are maintained for audit purposes for 2 years.
- -Dossier content is classified as confidential. Recipients agree not to distribute, reproduce, or share dossier content without written consent from The Contact Institute.
- -Secure download links expire after 24 hours. Re-verification is required for subsequent access.
Section 09
Cookies
This platform uses only technically necessary cookies required for session management and security. We do not use advertising cookies, tracking pixels, or third-party analytics beyond standard server logs.
Cookie
Purpose & Retention
Session Cookie
Maintains secure session state. Expires on browser close.
CSRF Token
Security protection for form submissions. Expires on browser close.
No consent banner is required as we use only strictly necessary cookies.
Section 10
Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
- -TLS encryption for all data in transit.
- -Encrypted storage for personal data at rest.
- -Access controls limiting data access to authorised personnel only.
- -Time-limited secure links for dossier delivery.
- -Regular security assessments aligned to ISO 27001 principles.
In the event of a personal data breach affecting your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware, as required by UK GDPR Article 33.
Section 11
International Transfers
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V. This includes adequacy decisions, Standard Contractual Clauses, or other approved transfer mechanisms.
Our primary infrastructure is hosted within the UK and EEA. Any transfers to third countries are governed by data processing agreements incorporating the relevant transfer mechanism.
Section 12
Contact the DPO
For all data protection enquiries, subject access requests, or to exercise your rights under UK GDPR, contact our Data Protection Officer:
Data Protection Officer - The Contact Institute
Emailgary@directintelligence.co.uk
PlatformSecure Contact Form
Response timeWithin 30 calendar days
Regulatorico.org.uk - Information Commissioner's Office