Legal
Privacy policy
What we collect from businesses in the United Kingdom and the United States, why, who sees it, and how to use your rights. Written to be read, not skimmed past.
Effective date: · Version 1.0
Who we are
YMEQUITY LTD, trading as GrantFlow Intelligence, is the data controller for the personal information described in this policy. We are registered in England and Wales, company number 16550886.
- Legal entity
- YMEQUITY LTD, trading as GrantFlow Intelligence
- Company number
- 16550886
- Registered office
- 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
- info@ymequity.com
- Phone
- +44 7903 315080 (UK)
We are a UK-registered business. Our service is delivered remotely from the United Kingdom; call times and delivery arrangements are agreed for each engagement.
This policy is written to meet the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). It applies to this website, our free scans, our enquiry and booking forms, client accounts, and the work we do for clients.
What we collect
We collect only what the service in front of you needs. In practice that means:
- Free opportunity scan and enquiry forms. What you type: your name, work email, phone number if you give it, company name, website, and the business details the form asks for. For UK businesses that is your Companies House number, region, sectors, turnover band, employee count and accreditations. For US businesses it is your state, NAICS codes, employee count, small-business certifications and set-aside status, and your SAM.gov UEI and CAGE code if you provide them. Any notes you add, and your consent choices with your consent choices.
- Instant UK grant scan. Your sector, size, location and funding goals, plus contact details for the emailed summary. No documents are needed to run it.
- Contact and booking. Your name, email, phone number, the topic, preferred times and your message.
- Accounts. If you create one: your email address and sign-in credentials, managed by our authentication provider, together with the grants you save, drafts, monitoring preferences and any reports prepared for you.
- Paid engagements. The business information, documents and evidence you choose to share so we can prepare a bid, proposal or application.
- How you found us. The page you arrived on, the site that referred you, and any campaign tags in the link you clicked.
- Website analytics, only if you allow it. Aggregated visits, device category, acquisition source and broad actions such as starting a scan or viewing pricing. We never send form answers, names, email addresses or client activity to our analytics provider.
- Your country preference. A first-party cookie named
gf_countryremembers whether you chose the United Kingdom or the United States. It is set only when you choose, never from your location. - Security and operations. Our hosting provider records request logs (IP address, browser type, time) as part of running the site. Our own rate limiting stores a one-way hash of your IP address, not the address itself.
- If you call or message us. Your number and what we discuss, so we can follow up.
Why we use it, and the lawful basis
- To run your scan, answer your enquiry, deliver paid work and run your account. Lawful basis: performing a contract with you, or taking the steps you ask for before one.
- To follow up business enquiries and scan requests, keep the site secure and improve the service. Lawful basis: our legitimate interests as a business. You have the right to object at any time, and we will stop unless we have a compelling reason not to.
- To send marketing email where we ask your permission, and to use analytics cookies. Lawful basis: your consent. You can withdraw it at any time.
- To keep accounting and tax records for paid work. Lawful basis: our legal obligations.
Some scan results are produced by automated matching against published criteria. They are indicators of potential fit, not decisions, and do not establish eligibility or suitability for a final submission. Paid deliverables are subject to review. No decision with a legal or similarly significant effect on you is made automatically.
International transfers
We are based in the United Kingdom and that is where the work is done. Several of the providers above are US companies and may process data outside the UK. Where that happens we rely on the safeguards those providers offer their UK customers, such as approved standard contractual terms, and on UK adequacy decisions where they apply. Ask us if you want detail about a specific provider.
How long we keep it
We keep personal information only for as long as we need it for the purpose we collected it for, and then delete or anonymise it. Retention depends on the enquiry, engagement, accounting obligations and any dispute. Contact us for the retention position that applies to your records.
If you ask us to delete your data we will assess and action your request, except where we need to keep a record for a legal or accounting reason, for example invoices for paid work.
Your rights
Under the UK GDPR you have the right to:
- access the personal information we hold about you
- have inaccurate information corrected
- have your information erased
- restrict how we use it
- receive a copy in a portable format
- object to processing based on our legitimate interests, including any direct marketing
- withdraw consent at any time, where consent is the basis
To use any of these rights, email info@ymequity.com from the address you used with us. A person answers data questions. We normally respond to rights requests within one month, subject to any lawful extension or identity checks, which we explain where needed. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would welcome the chance to put it right first.
If you are in the United States
We honour access and deletion requests from anyone, wherever you are. We do not sell personal information and we do not share it for targeted advertising. Rights can vary by location and circumstances; we consider applicable rights when handling your request. Send requests to info@ymequity.com.
Marketing email
We send marketing email in two situations only: when you have opted in on one of our forms, or to business contacts about services relevant to their business, where UK law allows that for corporate subscribers. Every marketing message carries a working unsubscribe link, and you can also reply "unsubscribe" to any email from us.
You can opt out at any time at ymequity.com/unsubscribe. Requests are honoured within 10 business days and usually immediately. Opting out does not stop the emails a service you asked for needs, such as the results of a scan you requested or notices about your account.
Changes to this policy
We update this policy when our practices or the law change. The effective date and version at the top tell you which version you are reading. For a significant change we will say so on this page.
Contact
Data questions go to info@ymequity.com and are answered directly. You can also call +44 7903 315080 or write to YMEQUITY LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.