1. Data Controller
Prolo Ltd ("the Company," "we," "us," or "our") (53 King Street, Manchester M1 2WD) is the data controller for personal data processed through prololtd.com and the Prolo procurement platform under the UK GDPR and the Data Protection Act 2018. You can contact us at [email protected].
2. Personal Data We Process
Prolo operates a two-sided procurement coordination service for UK building contractors and building materials suppliers. The personal data we process reflects that operating context.
Contractor account data: name, company name, work email address, telephone number, delivery addresses, and billing and subscription details for your Prolo account.
Supplier contact data: supplier company name, contact person name, work email address, and telephone number submitted when a supplier joins or updates their profile on the Prolo network.
Procurement and order data: the material specifications, quantities, delivery postcodes, and project references you include in each quote request; the price quotes and lead times suppliers submit in response; purchase order confirmations; delivery schedules; and your order history and spend records within the platform.
Procurement correspondence: the content of messages sent through the platform on your behalf to suppliers, and supplier responses relayed back to you. Prolo transmits this correspondence as part of the coordination service; we do not use it for any purpose other than delivering the quote request and aggregating the responses for your review.
Technical data: IP addresses, browser type and version, device type, session tokens, and pages visited on prololtd.com.
Analytics data (with consent only): anonymised and aggregated usage metrics collected after you give prior consent through our cookie banner. We do not collect analytics data by default.
3. Lawful Bases (Article 6 UK GDPR)
We rely on the following lawful bases:
- Performance of a contract: processing your account data, procurement requests, order records, and correspondence to deliver the subscription service you have signed up for.
- Legitimate interests: security monitoring, fraud prevention, preventing misuse of the supplier network, and aggregate service-quality analysis. Our interests do not override your rights in these activities.
- Legal obligation: retaining procurement and financial records as required by applicable UK legislation, including the Value Added Tax Act 1994 and the Companies Act 2006.
- Consent: non-essential analytics cookies and any direct marketing communications. You may withdraw consent at any time.
4. Recipients and International Transfers
We share personal data with service providers acting as processors under Article 28 UK GDPR contracts. These include our cloud infrastructure provider (which hosts the platform and its data) and our transactional email provider (which delivers procurement correspondence to suppliers). We do not sell personal data to any party.
Transfers to processors outside the UK are protected by the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy regulation, as applicable to the relevant processor and destination country.
5. Retention
We retain personal data only as long as necessary for the purpose for which it was collected, subject to the following minimum periods:
- Contractor account data: retained while your account is active, plus 12 months following account closure or cancellation.
- Supplier contact data: retained while the supplier holds an active membership of the Prolo network, plus 12 months following removal or deactivation.
- Procurement and order records: retained for 6 years from the date of the relevant transaction, in line with UK business record-keeping requirements under the Value Added Tax Act 1994 and the Companies Act 2006.
- Quote request and correspondence data: retained for 24 months from the date of the relevant procurement activity.
- Technical and access log data: retained for 90 days.
- Cookie consent records: retained for 3 years from the date consent was given or last updated.
6. Your UK GDPR Rights
- Right of access;
- Right to rectification;
- Right to erasure;
- Right to restriction of processing;
- Right to data portability;
- Right to object, including to direct marketing without further conditions;
- Rights related to automated decision-making. We do not engage in automated decisions that produce legal or similarly significant effects.
Email [email protected] to make a request. We respond within one calendar month, extendable by two further months for complex or numerous requests. We will not charge a fee unless the request is manifestly unfounded or excessive.
7. Right to Complain to the ICO
You have the right to lodge a complaint with the UK Information Commissioner's Office ("ICO"). The ICO's website is ico.org.uk; helpline 0303 123 1113. We would welcome the opportunity to address your concern before you contact the ICO and encourage you to contact us first.
8. Cookies
See our Cookie Policy for full details of the cookies Prolo sets. Non-essential cookies are not placed on your device without your prior consent, in accordance with the Privacy and Electronic Communications Regulations (PECR).
9. Security and Changes
We implement technical and organisational measures appropriate to the risk associated with the personal data we process, including encryption in transit, access controls, and regular security reviews. No internet transmission is completely secure, but we take reasonable steps to protect your data.
We will update this policy when our data handling practices change in a material way. The "Last updated" date at the top of this page reflects when the policy was last revised. We encourage you to review it periodically.
10. Contact
Prolo Ltd53 King Street
Manchester M1 2WD
Email: [email protected]
Phone: +44 (0)161 850 1120