Privacy Notice - Performance Improvement Activities

Important details

Established in 1995, Winning Moves Ltd undertakes business support and digital activities, for government, publicly funded and other organisations. We may operate as a Data Controller, Joint Data Controller, or Data Processor – depending on the nature of our work.

  • Company number | 03069806
  • Address | Winning Moves at 102 Colmore Row, Birmingham, B3 3AG
  • Phone | 0121 285 3800
  • Email |
  • Information Commissioner Office Registration no | Z6399957

Our commitment to your Privacy

Winning Moves Ltd takes your privacy very seriously and we are committed to protecting your personal information and the information you provide. Please read this Privacy Notice carefully and contact us with any questions.

We are committed to meeting the following laws, codes and standards:

  • The UK General Data Protection Regulation (GDPR)
  • Data Protection Act 2018

Your personal information will be treated with respect, and it will only be used for the purposes that we have informed you about.

This Privacy Notice covers how we use personal data when you use our websites and our systems. The terms governing your use of our systems and services are outlined in our licence agreements with you and our published terms and conditions of use.

From time to time we may develop new services and/or may give you access to additional services that we already have. If not otherwise stated, this Notice will continue to apply. However, if our actions result in a change to the way we deal with personal data, we’ll tell you about it.

Processing Purposes

Winning Moves Ltd processes personal data for the purposes of providing our ‘performance improvement’ services which covers our business support offer and our benchmarking and diagnostics.

Information we collect
We will only collect or store personal data about you that is relevant to the purpose of providing our performance improvement service that you have opted in to, or are participating in.

  • Personal data includes your name, address, email address or telephone number.
  • Personal data could also include (but is not limited to) where you work, information about your age and gender, image and / or voice (if captured through photography, filming, audio recording) and health.
  • Personal data could also include (but is not limited to) information you provide relating to your opinions, attitudes, experiences, perceptions, ratings, preferences and use of specified products of services.
  • Personal data could also include (but is not limited to) financial information.

How we look after your information

We will protect the confidentiality of your information in accordance with our normal data handling procedures and all legal requirements. We will not use it for any purposes other than those which are set out in the surveys and in this Notice. We are committed to keeping personal data secure and take all reasonable technical and organisational measures to protect personal data from loss, misuse or alteration. Only authorised Winning Moves employees and contractors or partners carrying out authorised business functions are allowed to access data held by us.

How we use your information

We only retain your personal data for as long as we need to, to perform our contract of service with you, for legitimate business reasons or to comply with other legal requirements. We do not sell or share your data with third parties, though our systems may provide the functionality for our users to share data with third parties for the purposes of allowing others to contact you to offer direct business support that you have asked for.

Personalised output reports are deleted within 30 days of them being produced however we do retain the aggregated, anonymised performance data.

No data is publicly available through our systems, though we may use publicly available information to help populate your details in our systems e.g. Companies House data.

We may share your data with a third party purely for the purpose of delivering a function on our behalf. They will have access to personal information to perform the function, but will not use it for any other purpose. They must also process the personal information as set out in this Privacy Policy and as permitted by the UK’s Data Protection Act/laws.

The legal bases used for processing your personal information

The GDPR requires us to rely on one or more lawful bases to process your personal information. This will vary on a service by service, and a project by project basis, but we consider the bases below to be relevant:

  1. Where you have provided your consent for us to use your personal information in a specific way. For example: you have consented to take part in a benchmarking activity; or you have consented to us providing advice through a business support activity; or you have consented to us storing your data for ERDF purposes. Informed consent is always collected by way of an affirmative action such as selecting ‘next’ to continue with a survey, a recorded verbal agreement when taking part in an interview, or an agreement in writing indicating that you would like to proceed with the research.
  2. Where there is a legitimate interest in us doing so if it is reasonably necessary to achieve ours or our clients’ legitimate interests (as long as that processing is fair, balanced and does not unduly impact on your rights). For example: there might be a legitimate interest in our client using us to conduct research with you where they have an interest in making sure their services and policies are effective.

Where do we process and store your information?

We mainly store and process your information within the UK or the European Economic Area (EEA), unless you are invited to participate in an online survey, for which we sometimes use SurveyMonkey. SurveyMonkey operates storing information outside of the UK and the European Union in the United States of America. Previously the USA was certified under and complied with the EU-US Privacy Shield programme which legalised the collection, use, transfer and retention of personal data from Europe to the US. This method for transfer of personal data has been invalidated by the European Court of Justice ruling in July 2020. Instead Winning Moves now has in place Data Processing Agreements (DPA) which include the EU approved Standard Contractual Clauses/Model Clauses referred to in the GDPR. In any other occasions where your information needs to be transferred outside of the EEA, we will only do so to countries which have been determined by the European Commission to have adequate levels of data protection.

How long do we keep your personal information for?

The length of time we hold your personal information varies depending upon the type of information and its use. We will hold your personal information on our systems only for as long as necessary to provide research services to our clients, and will anonymise data where possible, securely deleting personal data associated with it at the earliest possible point.

What are your rights?

Co-operation in research is voluntary at all times regardless of what the survey is about or who our client is. You are entitled at any stage to ask that your personal data, or part or all of the record of your survey responses, be destroyed or deleted and we will carry out such a request. This can be requested during the interview itself or afterwards. You have the right to access any personal data that we process relating to you. We may ask for verification of your identity before releasing any information to you.

You also have the right to lodge complaints about data protection issues with the information Commissioners Office –

Our EU Representative

In accordance with requirements under Article 27 of GDPR, Winning Moves has appointed an EU Representative. Our EU Representative is Fitzen consulting LTD t/a The Discovery Partnership, Floor 2 @IBM, The Atrium Building, Blackpool Business Park, Blackpool, Cork, Ireland.

Our privacy Notice

We may revise or update this Notice from time to time to reflect changes in our activities, or for other purposes. Any updates will be posted on this page. Please revisit this policy each time you consider providing us with personal information. This Notice was last updated in October 2023.

To contact us about any aspect of this Notice, or to exercise your data rights, please write to