How CPM handles personal information.
A concise explanation of the information we collect through the website, why we use it and the choices available to you.
Last updated: 19 August 2026
Who we are
ClinProtocol Management Limited ("CPM", "we", "us" or "our") is a private limited company registered in England and Wales under company number 13263808. This notice explains how we handle personal information collected through this website and during initial business enquiries.
Information we may collect
We may collect information you provide directly, including your name, business email address, company, area of support, enquiry details and any other information you choose to include in a message. If you book a call through Calendly, scheduling information may also be processed by Calendly and the connected video-conferencing provider.
How we use personal information
We use personal information to respond to enquiries, arrange introductory calls, assess whether CPM may be able to support your organisation, take steps at your request before entering into a contract, maintain appropriate business records and meet legal or regulatory obligations.
Our lawful bases
Depending on the circumstances, we may rely on steps taken at your request before entering into a contract, performance of a contract, our legitimate interests in operating and developing our business, and compliance with legal obligations.
Service providers
We use selected service providers to operate the website and communications workflow. These may include Cloudflare for website hosting, security and Turnstile verification; Resend for delivery of website enquiries; Calendly for scheduling; Zoom for booked video calls; and Microsoft 365 or other email infrastructure for business correspondence. These providers process information according to their own terms and privacy arrangements.
International processing
Some service providers may process information outside the United Kingdom. Where this occurs, we expect the relevant provider to use appropriate safeguards for international data transfers as required by applicable data protection law.
How long we keep information
General enquiries that do not lead to an engagement are normally retained for up to 24 months so that we can respond to follow-up contact and maintain an appropriate record of business discussions. Where an engagement is established, relevant records may be retained for longer where required for contractual, legal, tax, insurance or legitimate business purposes.
Security
We use proportionate technical and organisational measures to protect information. The website enquiry form uses Cloudflare Turnstile to reduce automated submissions and a server-side processing workflow to deliver valid enquiries.
Your rights
Depending on the circumstances, UK data protection law may give you rights to access, correct, erase or restrict the use of your personal information, object to certain processing and request data portability. You may also withdraw consent where processing is based on consent.
Contact and complaints
To ask a privacy question or exercise a data protection right, please contact CPM through the website contact page. You also have the right to raise a concern with the UK Information Commissioner's Office.
Changes to this notice
We may update this notice as the website, services or legal requirements change. The latest version will be published on this page.