Privacy policy

Made Tech Group plc is committed to protecting and respecting your data privacy. We are registered with the Information Commissioner’s Office (ICO) under the UK Data Protection Act of 2018, registration number ZA490749. This Privacy Policy (together with any documents or linked content referred to herein) sets out the basis upon which the personal data we collect from you, or which you provide to us, will be processed and stored.

Please note that Made Tech provides a separate privacy notice for its recruitment activities, which will be relevant if you are applying for a position with us.

Personal data we collect

• Your personal information, including your name, email address, phone number and organisation name if you contact us.
• Your IP address, and details of which version of the web browser you use.
• Information on how you use the site, the pages you visit and how you interact with it, your use of cookies, and other page tagging techniques.

Careers and jobs pages

The careers and jobs pages of our website use activity tracking which collects high-level non-personal data to analyse the number of impressions, visits and clicks it gets. We don’t collect any personal data of any kind and it isn’t possible to identify individual people. We share these anonymous statistics with a partner agency to help us make these pages more useful to our users.

Sensitive personal data

The UK Data Protection Act 2018 specifies a set of personal data categories which are considered to be “sensitive”, and which require special consideration by Data Controllers. This website, and any services available from this website, do not knowingly collect or process any sensitive personal data.

Children’s personal data

This website, and any services available from this website, are not directed to children. If you learn that a child has provided us with their personal information without having parental consent, please contact our Data Protection Officer (see below) immediately so that we can take appropriate action.

International data transfers

Personal data may be transferred to and processed in countries outside the UK and European Economic Area (EEA), including the USA. Where we transfer your personal data outside the UK or EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the UK Information Commissioner’s Office
• Adequacy decisions by the UK Government or European Commission
• Binding corporate rules or codes of conduct approved by supervisory authorities

You can obtain a copy of the safeguards we have in place by contacting our Data Protection Officer using the details provided below.

Where we process and store this information

We securely store your personal data on secure servers, located within the UK, European Union or the USA. Please be aware that personal data may be processed outside the UK or European Union as detailed in the International data transfers section above.

Your contact and organisation details may also be stored on our secure, customer relationship management (CRM) systems – we use both Salesforce and HubSpot. These third-party services have been assessed as providing effective data security for all personal data: Salesforce Privacy Notice, HubSpot Privacy Notice.

Transmitting information over public internet connections is not secure, and Made Tech cannot guarantee or be responsible for the security of personal data you provide to us until the point at which it is securely stored within our systems. Any personal data you transmit is at your own risk.

Made Tech has ISO27001 certification for its Information Security Management System, which requires us to operate a framework of security policies and procedures to ensure the secure, responsible processing and storage of your personal data.

Data retention

We retain your personal data in accordance with the following criteria and periods:

• General contact and marketing data: Up to 2 years from last interaction, unless you have given specific consent for longer retention
• Customer data: For the duration of our contractual relationship plus 7 years for legal and accounting purposes
• Unsubscribed email addresses: 2 years after unsubscription to ensure compliance with opt-out requests
• Website analytics data: 2 years from collection
• Legal basis: Data may be retained longer where required by law or for the establishment, exercise or defence of legal claims

You can request information about our specific retention schedule by contacting our Data Protection Officer.

How we use your personal data

We may use your personal data to:

• Help us improve our website, and any services available via our website, by monitoring how you use it.
• Respond to any specific feedback or questions you send to us, if you’ve asked for us to reply.
• Provide you with general information about our products and services where you’ve asked us to, or to proactively inform you about new, existing or changing services where you’ve indicated your consent for this.
• Analyse the effectiveness of our marketing campaigns and help us improve the quality and content of marketing materials which we create.
• Tailor our services to meet your requirements.

Legal basis for processing personal data

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are required to confirm the “legal basis” for processing your personal data, as follows:

• Consent: if you have provided us with your consent to process and store your personal data for specific purposes – for example, to receive marketing communications. You have the right to withdraw your consent at any time by contacting marketing@madetech.com. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
• Contract: where processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract – for example, responding to business enquiries or delivering agreed services.
• Legal obligation: where processing is necessary to comply with a legal obligation to which Made Tech is subject – for example, retaining financial records for tax and accounting purposes.
• Legitimate Interest: we have a legitimate interest in processing certain personal data to operate and improve our business, including: ensuring our website delivers accurate and secure content; analysing how visitors use our site to improve user experience; and maintaining records of business contacts for relationship management purposes. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms.

Mandatory provision of data

The provision of personal data is not mandatory by law or contract, nor are you required to provide personal data to enter into a contract with us. However, if you choose not to provide certain personal data:

• We may not be able to respond to your enquiries or provide you with information you have requested
• You may not be able to access certain features or services on our website
• We may not be able to provide you with marketing communications about our services (if you have consented to receive them)

Automated decision-making and profiling

We do not engage in automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.

We do not share your personal information with any other organisations for marketing, market research or commercial purposes, or with any other websites without having your prior and express consent to do so.

If you unsubscribe from our marketing emails we aim to process your request within 24 hours of opt-out during the work week or the following work day if opted out during the weekend or bank holiday. Your email will automatically be removed from our marketing lists and your personal data will be deleted. Only your email address will be stored for 2 years after unsubscription, to ensure that we continue to comply with your opt-out request at which point it will be automatically deleted from HubSpot.

Your rights

Under the UK General Data Protection Regulation (UK GDPR) you have a number of important rights which can be exercised free of charge. In summary, those include rights to:

• Access your personal data and to certain other supplementary information that this privacy policy has recorded (Article 15).
• Rectification: Require us to correct any mistakes or correct any omissions in any of the personal information which we hold (Article 16).
• Erasure: Require the erasure of personal data concerning you in certain situations (Article 17).
• Data portability: Receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit such data to a third party in certain situations (Article 20).
• Object to processing: Object at any time to the processing of your personal data for direct marketing activities (Article 21).
• Object to automated decision-making: Object to decisions being taken by automated means (where applicable) which could produce legal effects concerning or affecting you (Article 22).
• Restriction of processing: Request that we restrict the processing of your personal data in certain circumstances – for example, while we verify the accuracy of data you have disputed (Article 18).
• Withdraw consent: Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time (Article 7).

For further information on each of those rights, including the circumstances in which they apply, see guidance on the ICO website.

If you would like to exercise any of your rights, please:

• Contact us using our contact details below.
• Provide us with sufficient information to properly identify you.
• Provide us with proof of your identity/address, when we request it.
• Provide us with the specific information to which your request relates.

We will respond to your request within one calendar month of receipt. If your request is complex or you have submitted a number of requests, we may extend this period by a further two months, in which case we will notify you within the first month.

National data opt-out

For services related to the National Health Service (NHS), Made Tech adheres to specific governance obligations, including those related to the national data opt-out mechanism. This allows patients to opt out of their confidential patient information being used for research and planning. You can find out more about the national data opt-out programme and how to opt out at www.nhs.uk/your-nhs-data-matters. Please note that this opt-out does not apply to Made Tech’s direct processing of your personal data through this website.

Website Cookies

This website uses cookies and similar tracking technologies. Non-essential cookies (including analytics and marketing cookies) are only placed with your active consent, which you can provide or withdraw at any time via our cookie preference centre. Please see our separate Cookie Policy for full details of the cookies we use and how to manage your preferences. By continuing to browse this website, only strictly necessary cookies will be set until you have made your cookie choices.

Cookies are small text files sent by us to your computer, or from your computer or mobile device to us each time you visit our website. They are unique to you or your web browser. Session-based cookies last only while your browser is open and are automatically deleted when you close your browser. Persistent cookies last until you or your browser delete them, or until they expire.

If you decide to disable some or all cookies, you may not be able to use some of the functions on our website.

External Links

This website may include relevant hyperlinks to external websites not controlled by Made Tech. Whilst all reasonable care has been exercised in selecting and providing any such links, you are advised to exercise caution before clicking any external links. We cannot guarantee the ongoing suitability of external links, nor do we continually verify the safety or security of the contents which may be provided to you. You are advised, therefore, that your use of external links is at your own risk and we cannot be responsible for any damages or consequences caused by your use of them.

Changes to this Privacy Policy

We may change this Made Tech Privacy Policy from time to time, and if we do we will post any changes on this page. We review and update this privacy policy at least annually or upon material changes to our processing activities. The date of the last update is shown at the top of this policy. If you continue to access this website or use services available from this website after those changes have come into effect, you will have agreed to the revised policy.

How to complain

We take privacy concerns seriously and aim to resolve any query or complaint promptly. If you have a concern about how we handle your personal data, please complete this Complaints Form.

We will acknowledge your complaint within 5 working days and aim to provide a full response within 30 calendar days. If we require additional time, we will notify you.

If you are not satisfied with our response, or if we have not responded within 30 days, you have the right to escalate your complaint to the ICO (see below).

The UK GDPR also gives you the right to lodge a complaint directly with the applicable supervisory authority. The supervisory authority in the United Kingdom is the Information Commissioner’s Office (ICO) who may be contacted online at ico.org.uk or by telephone on 0303 123 1113.

Contacting us

All questions, comments and requests regarding this Privacy Notice should be addressed to our Data Protection Officer by email at compliance@madetech.com or by post to:

Data Protection Officer, Made Tech Group plc, FORA, 35-41 Folgate Street, London, E1 6BX

This version last updated: May 2026