Innotech Business Intelligence is a division of Innotech Recruit Limited.
This privacy notice explains how Innotech Recruit Limited ('we', 'us', 'our') collects, uses, stores, and shares personal data in connection with Innotech Business Intelligence, our commercial intelligence report service. It applies to:
Our executive search business is covered by a separate privacy notice, available at innotechrecruit.com/privacy. We are committed to handling your personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Innotech Business Intelligence is a division of Innotech Recruit Limited, a company registered in England and Wales (Company No. 11930968) and based in Stockport. We supply bespoke commercial intelligence reports to senior leaders in the medical device sector, compiled entirely from publicly available, named sources. For the purposes of data protection law, Innotech Recruit Limited is the data controller and is registered with the Information Commissioner's Office (ICO) under registration number ZA526916.
We collect personal data directly from you when you submit a brief, place an order, or receive a report:
When you visit intelligence.innotechrecruit.com, we may also collect technical data including IP address, browser type, pages visited, and time spent on site, via cookies and similar technologies.
Our reports are compiled from publicly available sources. We do not require, hold, or process your organisation's confidential or proprietary information in order to produce them.
This section is addressed to individuals whose personal data appears in an Innotech Business Intelligence report, buyer map, or key opinion leader profile. If that is you, we will not usually have collected your data from you directly, so this section provides the information required by Article 14 of the UK GDPR.
What we process and where it comes from. Our reports assess companies and markets in the medical device sector, and in doing so may name individuals in a professional context: your name, job title, employer, professional history, public statements, published work, conference appearances, professional affiliations, and career moves. All of this information is compiled exclusively from publicly available, named sources, such as trade and national press, company announcements, regulatory filings, professional networking platforms, and published conference materials, and every statement in a report is cited to its source. We do not process information about your private life, and we do not process special category data (such as data about health, beliefs, or private relationships).
Why this is lawful. We process this data on the basis of our legitimate interests (Article 6(1)(f) UK GDPR): supplying commercial intelligence, compiled from public sources, that helps subscribers understand markets and the organisations and professionals active in them. We have carried out and documented a legitimate interests assessment. In summary: the data concerns your public, professional role rather than your private life; it is drawn only from sources already in the public domain; reports are supplied to a small number of subscribers under licence terms that prohibit wider circulation, not published generally; and we limit what we include to information that is professionally relevant to the subject of the report.
Who receives it. The subscriber or subscribers who commissioned or purchased the relevant report, under licence terms restricting use to their internal business purposes. We do not sell personal data and reports are not made publicly available.
Why we have not contacted you individually. Because this data is drawn from public sources and may concern a large number of individuals across our reports, notifying each person individually would involve disproportionate effort. We rely on Article 14(5)(e) UK GDPR and, as required by Article 14(7), we make this information publicly available through this notice.
Your rights. You have the right to object to this processing at any time (see Section 10), and the rights of access, rectification, and erasure described in Section 9. If you believe information about you in one of our reports is inaccurate, contact us at datacollector@innotechrecruit.com and we will investigate and correct any inaccuracy without delay. Retention of this data is described in Section 11.
| Purpose | Lawful Basis | Notes |
|---|---|---|
| Responding to a submitted brief, scoping a report, and issuing an order confirmation | Contract (Art. 6(1)(b)) where you are the customer; otherwise legitimate interests (Art. 6(1)(f)) | Brief data is used to shape the focus and depth of the report |
| Producing, personalising, and delivering the report you have ordered | Contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)) | Reports are compiled from publicly available sources |
| Taking payment and issuing invoices and receipts | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | Payments are processed by Stripe; receipts issued automatically on payment |
| Understanding how delivered reports are read, to improve the product | Legitimate interests (Art. 6(1)(f)) | You may object to this processing at any time; see Section 10 |
| Contacting you about further reports or related services | Legitimate interests (Art. 6(1)(f)) | You have an absolute right to object to direct marketing |
| Understanding how our website is used, to improve it | Consent (Art. 6(1)(a)) for non-essential cookies | See Section 12 |
Where limited personal data (such as a subscriber name) is used through AI-assisted research and drafting tools, those tools operate under business or enterprise agreements that do not use such inputs to train their models. All other tooling retrieves publicly available published content only and does not process your personal or confidential information.
We share personal data only where necessary and with appropriate safeguards. Recipients include:
We do not sell your personal data. We do not share it with third parties for their own marketing purposes. A Data Processing Addendum listing the specific processors we use is available on request.
We serve customers in the United Kingdom, United States, and Republic of Ireland, and some of our service providers process data outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. Transfers to the European Economic Area are covered by the UK's adequacy regulations. Transfers to the United States rely on the UK-US Data Bridge, International Data Transfer Agreements (IDTAs), or Standard Contractual Clauses adapted for UK use.
You may request a copy of the relevant transfer mechanism by contacting us at the details above.
Innotech Recruit Limited is a United Kingdom company. Wherever you are located, we process your personal data in accordance with the UK GDPR and this notice, so customers in the United States receive the same transparency and rights described here.
We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and we do not use personal information for cross-context behavioural advertising. Where a US state privacy law applies to our processing and grants you rights (such as access, correction, or deletion), you may exercise them by contacting datacollector@innotechrecruit.com and we will honour them on the same basis as the rights set out in Section 9.
Under UK GDPR, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to request erasure, to restrict processing in certain circumstances, to data portability, and to object to processing based on legitimate interests, including report engagement analytics. You have an absolute right to object to direct marketing. We do not use automated decision-making that produces legal or similarly significant effects.
To exercise any of your rights, contact datacollector@innotechrecruit.com. We will respond within one month. There is no charge in most circumstances. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
You have the right to object at any time to processing based on our legitimate interests, including the collection of report engagement data described in Section 3. If you object, we will stop processing your data for those purposes unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims. You also have an absolute right to object to the use of your data for direct marketing.
To exercise this right, contact datacollector@innotechrecruit.com.
| Data Category | Retention Period |
|---|---|
| Customer contact, brief, and order data | 6 years from the end of the business relationship |
| Brief submissions that do not proceed to an order | 24 months from submission |
| Report engagement data | 12 months from collection |
| Financial records (invoices, payments) | 7 years from the end of the relevant financial year (HMRC requirement) |
| Personal data in reports, buyer maps, and KOL profiles | For as long as the report or profile remains part of our current intelligence archive, reviewed at least every 24 months for continued relevance and accuracy |
| Website visitor data | Typically 13 months for analytics data |
At the end of the applicable retention period, personal data is securely deleted or anonymised.
intelligence.innotechrecruit.com uses cookies and similar technologies. Essential cookies are necessary for the site to function and do not require your consent. Non-essential cookies (including analytics cookies) are only deployed with your consent. Report delivery pages may use strictly necessary cookies to manage password-protected access. Report engagement data collected on those pages is described in Section 3, and your right to object is described in Section 10.
For full details, see our Cookie Policy at innotechrecruit.com/cookie-policy.
We have put in place appropriate technical and organisational measures to prevent accidental loss, unauthorised use, alteration, or disclosure of your data. Access is restricted to those with a genuine need to know. Where third-party providers process data on our behalf, we require appropriate security measures and processing only on our instructions.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay where required.
If you have concerns about how we handle your personal data, please contact us first at datacollector@innotechrecruit.com. You also have the right to lodge a complaint with the Information Commissioner's Office:
We review and update this notice regularly. Where changes are material, we will take reasonable steps to bring them to your attention. The date at the top indicates when it was last updated.
Innotech Business Intelligence is a division of Innotech Recruit Limited · Company No. 11930968 · Innotech House, Beaminster Road, Stockport, Cheshire, SK4 3HT · ICO Registration No. ZA526916