B2B Identity Ltd is the data controller responsible for your personal data. We are a private limited company registered in England and Wales.
| Detail | Information |
|---|---|
| Company name | B2B Identity Ltd |
| Company number | 17068528 |
| Registered address | Darlington, North East England |
| Trading as | B2B Identity, IOD Thinker, FirstPickUp |
| Contact email | hello@b2bidentity.co.uk |
| Website | b2bidentity.co.uk |
We are registered with the Information Commissioner's Office (ICO) as a data controller. For questions about how we handle your personal data, contact us at hello@b2bidentity.co.uk.
When you use the IOD Thinker tool at b2bidentity.co.uk/thinker/, we collect and process the following:
Payments for the Formation Signal Document (£149) are processed exclusively by Stripe, Inc. B2B Identity Ltd does not receive, store, or process your card number, expiry date, CVV, or bank account details at any point. Stripe provides us with a transaction reference and payment status only. Stripe's privacy policy is available at stripe.com/gb/privacy.
Our hosting provider (Fasthosts Internet Ltd, UK) automatically collects standard server access log data, which may include your IP address, browser type, operating system, referring URL, and pages accessed. This data is used for server security, performance monitoring, and fault resolution.
With your consent, we use Google Tag Manager (GTM-T2V5F32G) to load analytics tools that help us understand how visitors use our website. Analytics cookies are only set after you accept them via our cookie consent banner. If you decline, no analytics data is collected about your visit. See our Cookie Policy for full details.
If you contact us by email, we retain your name, email address, and the content of the correspondence for the purpose of responding to your enquiry and maintaining a record of communications.
UK GDPR requires us to have a legal basis for processing personal data. We rely on the following:
| Processing activity | Lawful basis |
|---|---|
| Storing and analysing your session responses to generate your diagnostic output | Legitimate interests (Article 6(1)(f)) — necessary to deliver the service you requested; Contract performance (Article 6(1)(b)) for paid sessions |
| Processing your payment via Stripe | Contract performance (Article 6(1)(b)) |
| Server access logs | Legitimate interests (Article 6(1)(f)) — server security and performance |
| Analytics cookies and tracking | Consent (Article 6(1)(a)) |
| Email correspondence | Legitimate interests (Article 6(1)(f)) — responding to and recording business communications |
We share personal data with the following third-party processors and sub-processors. We have data processing agreements in place with each of them where required.
Your session responses are transmitted to Anthropic's Claude API to generate the diagnostic analysis. Anthropic processes this data as a data processor acting on our instructions. Data is transferred to the United States under Anthropic's standard contractual clauses and their API data processing agreement. Anthropic's API terms state that data submitted via the API is not used to train models by default. Anthropic's privacy policy: anthropic.com/privacy.
Payment processing is handled by Stripe. Stripe operates as an independent data controller for payment data and a data processor for transaction data on our behalf. Data is transferred under Stripe's EU/UK Standard Contractual Clauses. Stripe's privacy policy: stripe.com/gb/privacy.
Our website and database are hosted on servers operated by Fasthosts Internet Ltd, a UK company. All session data and database content is stored in the United Kingdom. No international transfer occurs for hosted data.
With your consent, Google Tag Manager and Google Analytics are used to collect anonymised site usage data. Data is transferred to the USA under Google's EU/UK Standard Contractual Clauses. Google's privacy policy: policies.google.com/privacy. If you decline analytics cookies, no data is sent to Google.
Some of our processors (Anthropic, Stripe, Google) are based in the United States. Transfers to these processors are made under UK-approved Standard Contractual Clauses or equivalent adequacy mechanisms, ensuring your data receives a level of protection consistent with UK GDPR. Where consent-based transfers occur (analytics), you may withdraw consent at any time via our cookie settings.
Session data stored in our database and server logs are held exclusively within the United Kingdom on Fasthosts servers.
| Data type | Retention period | Reason |
|---|---|---|
| Session responses and diagnostic output | 24 months from session date | To enable retrieval if technical issues occur; to support service improvement |
| Payment transaction records | 7 years | HMRC financial record-keeping obligations |
| Server access logs | 90 days | Security monitoring and fault diagnosis |
| Cookie consent records | 13 months | Demonstrating compliance with consent obligations |
| Email correspondence | 3 years from last contact | Record of communications and dispute resolution |
After the applicable retention period, personal data is securely deleted or anonymised so it can no longer be associated with you.
You have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact us at hello@b2bidentity.co.uk. We will respond within one calendar month.
Because the IOD Thinker uses an auto-generated session ID rather than your name or email, we may need you to provide your session ID to locate your data. This is displayed in the browser during and after your session. If you cannot locate it, contact us and we will assist.
We use cookies on this website. For full details of the cookies we set, their purpose, duration, and how to manage them, please read our Cookie Policy.
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These measures include:
No method of transmission over the internet is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR.
Our services are directed at business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.
We may update this Privacy Policy from time to time. Where changes are material, we will update the version number and date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after a change is posted constitutes acceptance of the updated policy.
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
We would, however, welcome the opportunity to resolve your concern directly before you contact the ICO. Please email us first at hello@b2bidentity.co.uk.