Privacy

Privacy and Data Policy

Effective date: 21 September 2026

Last updated: 21 September 2026

Who controls your information

Triumph B2B Ltd is the data controller for the information described in this policy. Company number 15306752, registered in England and Wales. Registered office: 9 Park Lane Business Centre, Park Lane, Langham, Colchester, England, CO4 5WR. The business and its data are controlled from the United Kingdom.

How to contact us about privacy

For any question about this policy, or to exercise your rights, email michael.baker-mosley@triumphb2b.com.

What the contact form collects

When you use the contact form we collect and store:

• Your name
• Your email address
• Your phone number, if you choose to give one
• Your company
• Your role, if you choose to give one
• Your message
• Whether you asked to receive marketing emails, and when
• Whether the notification email was sent successfully

Your enquiry is stored in our private database and emailed to Michael Baker-Mosley so it can be answered. Contact form information is not sent to any AI service.

What the Health Score collects

When you complete the B2B Brand and Marketing Health Score we collect and store:

• Your name
• Your email address
• Your company name
• Your job title
• Your company website address
• Your answers to the thirty questions
• Any free-text notes you add, up to 600 characters each
• Your dimension scores, total score and overall band
• A record of the report generated for you, and whether it was delivered
• Your acknowledgement of this policy, with the date and time
• Whether you asked to receive marketing emails, with the wording, version, date and time
• A one-way hashed form of your IP address, used only to limit abuse of the form

While you are part way through the assessment your answers are held in your browser's session storage so you do not lose them. They disappear when you close the tab.

What the website field is used for

The company website you give us is used as an additional evidence source for your report. We read publicly available, unauthenticated pages on that website: normally the home page and up to two obvious pages such as "About" or "Services". We do not attempt to reach gated content, password protected areas, account areas, private portals, private APIs or any non-public document. If the website cannot be read, your report is still produced from your answers and says that the website review could not be completed.

The website review never overrides your own answers. Where the public website and your answers differ, the report says so. The report distinguishes between what you reported, what was observed on the public website, what is interpretation and what is recommendation. It does not claim to verify revenue, pipeline, conversion rates, customer data, internal systems or commercial results, because none of those can be seen.

What is sent for AI processing, and what is not

Your report is written with the help of an AI service. Only the following is included in that request:

• Your thirty assessment answers and their scores
• Your dimension scores, total score and overall band
• Your free-text notes, after automatic removal of email addresses, phone numbers, links, postcodes and long numbers
• Your company website address
• Publicly available text retrieved from that website for this purpose

The following is never included in that request:

• Your name
• Your email address
• Your job title
• Your IP address or its hashed form
• Your private report access token
• Your acknowledgement or marketing consent records
• Anything from the contact form
• Database identifiers or any application secret

Your name, company, job title, website and the report date are added by our own software after the analysis has been written, when the PDF is produced. They do not enter the AI request.

Analytics

We use Google Analytics 4 to understand how the site is used. It does not load, set any cookie or send any data until you actively choose "Accept analytics". If you reject analytics, nothing is loaded and the site and the Health Score work exactly as normal.

When analytics is accepted, Google Analytics records page views and a "lead submitted" event when the contact form is used. That event carries no personal information: only the form name, the page the enquiry came from, and the page title. Google Analytics sets its own cookies and derives an approximate location from your IP address.

You can change or withdraw your choice at any time using Privacy and cookie settings in the footer of every page.

Cookies and browser storage

No other cookies or storage are used. Fonts are served from this website, so no font request is made to any third party.

Why we process your information, and on what basis

We rely on our legitimate interests in running and developing a professional services business, and, where relevant, on taking steps at your request before entering into a contract, for:

• Receiving and responding to your enquiry
• Processing a Health Score assessment you have voluntarily asked for
• Generating the report you requested
• Delivering that report to you
• Keeping proportionate security and anti-abuse records
• Keeping essential operational records of what was sent and when

None of this depends on marketing consent. We rely on your consent only for sending marketing emails, and on our legal obligation to keep evidence of that consent.

Marketing

We only send marketing emails if you actively ticked the optional box: "I would also like to receive occasional marketing emails and insights from Triumph B2B." It is never pre-ticked, it is never bundled with anything else, and neither the assessment, the report nor the contact form depends on it.

Emails required to deliver a report or answer an enquiry are not marketing emails and are sent regardless.

You can withdraw marketing consent at any time here or by emailing us.

Who else is involved

• Lovable: website hosting and platform services
• Lovable Cloud, built on Supabase: database, server functions and private file storage
• Resend: delivery of transactional emails, such as your report and our enquiry notifications
• OpenAI: AI-assisted writing of Health Score report content from the minimised data listed above
• Lovable AI Gateway: fallback AI processing route where the primary route is unavailable
• Google Analytics 4: website analytics, only after you accept analytics

International transfers

We are based in the United Kingdom, and our database, private file storage and server functions are hosted in the European region. Some of the providers listed above are based outside the UK, or use support and infrastructure outside the UK, so some information may be transferred internationally.

Where that happens, the transfer is made under the terms each provider publishes for this purpose: a data processing agreement incorporating the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum, or, where it applies, a UK adequacy decision. We do not transfer your information to a provider that does not offer one of these safeguards. You can ask us for details of the safeguards that apply to a particular provider.

How long we keep information

• Contact form enquiries: deleted 24 months after submission
• Health Score submissions, including your details, answers, free text, scores and report access records: deleted 12 months after submission
• Generated PDF reports: deleted 30 days after generation. The report can be produced again from the assessment while the assessment is still held
• Hashed rate-limiting records: deleted after 24 hours
• Part-completed assessment answers in your browser: gone when you close the tab
• Marketing consent evidence, including withdrawal: kept as the minimum record required to show what you agreed to and when, separately from the enquiry or assessment it came from

Deletion is automatic. A scheduled job runs every hour, removes expired database records and queues the associated files, and the files are then deleted from private storage. Every run is logged, and failed file deletions are retried.

Security

Information is held in a private database that is not readable by website visitors. Reports are stored in a private file area and are only reachable through a short-lived link. Access tokens are required to retrieve a report. IP addresses are never stored in plain form; only a one-way hash is kept, and only briefly. Credentials for our email, database and AI services are held server-side and never appear in the website code.

Your rights

You have the right to ask for a copy of your information, to have it corrected, to have it deleted, to restrict or object to how we use it, to ask for it in a portable form, and to withdraw consent where we rely on it. Email michael.baker-mosley@triumphb2b.com and we will respond within one month.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.