Privacy Policy

Last updated: 08 May 2026

This Privacy Policy explains how Benchmarq360, operated by Whonify, a company within the WHO2 Group, collects, uses, stores and protects personal information that you provide when using our website, digital tools, assessment tools, forms, applications, reports or related services.

In this Privacy Policy, references to “Benchmarq360”, “Whonify”, “we”, “our” or “us” mean the organisation responsible for operating Benchmarq360 and providing related digital products, assessment services and technology solutions.

We are committed to protecting your privacy and handling personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

1. Who We Are

Benchmarq360 is a benchmarking, maturity assessment and insight platform operated by Whonify, a company within the WHO2 Group.

Benchmarq360 is designed to help businesses assess capability, maturity, performance, operational effectiveness, technology adoption, regulatory readiness and strategic improvement opportunities.

For privacy-related queries, you can contact us at:

Email: [email protected]

2. What Information We Collect

We collect personal data that you choose to provide to us, or that is necessary for us to operate Benchmarq360, provide our services and support the use of our digital tools.

This may include:

your name;
your email address;
your phone number, where provided;
your job title or role;
your company or organisation name;
information you submit through contact forms, enquiry forms, assessment tools, benchmarking questionnaires, calculators, surveys, digital applications or related services;
information provided during meetings, workshops, correspondence or project discussions;
responses, scores, comments, evidence, documents or other information submitted as part of a Benchmarq360 assessment;
technical information such as submission dates, system activity, diagnostic logs, error logs, usage information and security records where needed to operate, secure or improve our services.

An email address may be personal data where it identifies, or can reasonably be linked to, a living individual.

Benchmarq360 is primarily intended to collect business, operational and organisational information. However, some information submitted through the platform may include personal data, particularly where individuals are named, identifiable from job roles, or included in supporting evidence.

Unless we specifically request it and confirm that the channel is suitable, you should not submit sensitive personal information, special category data, policyholder data, customer records, employee files, third-party personal data, confidential client information or commercially sensitive information.

3. How We Use Your Information

We use the information you provide to:

provide access to Benchmarq360 tools and services;
operate benchmarking, maturity assessment, scoring and reporting functionality;
respond to enquiries and provide support;
prepare assessments, reports, recommendations, dashboards, benchmarks or related outputs;
manage client relationships and business communications;
operate, test, secure and improve our digital tools, applications and online services;
analyse usage, performance and improvement opportunities;
maintain internal records;
comply with legal, regulatory, accounting and administrative obligations;
protect our business, systems, users and clients from misuse, fraud, cyber risk or unauthorised access.

We will not sell your personal information.

We will not distribute or lease your personal information to third parties for their own marketing purposes unless we have your permission or are required by law to do so.

4. Lawful Basis for Processing

We process personal data based on one or more of the following lawful bases:

Consent, for example where you submit information through a form or specifically ask us to contact you.
Legitimate interests, for example where we respond to business enquiries, operate Benchmarq360, provide business-to-business services, improve our tools or protect our systems.
Contract, where processing is necessary to provide services to you, your organisation or a client, or to take steps before entering into a contract.
Legal obligation, where we need to retain or process information to comply with applicable laws, tax, accounting or regulatory requirements.

Where we rely on legitimate interests, we will consider whether our interests are overridden by your rights, freedoms or interests.

5. Use of AI, Automation and Digital Tools

Benchmarq360, Whonify and other WHO2 Group companies may use technology platforms, development tools, automation tools, cloud services and artificial intelligence tools to help operate our business, provide services, develop systems, analyse information, draft documents, improve productivity, support software development and enhance internal processes.

These tools may include, but are not limited to:

AI assistants and large language model services;
code generation and software development tools;
cloud hosting and infrastructure providers;
automation and workflow platforms;
productivity, document and collaboration tools;
email, CRM, analytics, monitoring and support systems.

Examples of the types of tools we may use include services such as Microsoft Copilot, OpenAI, Claude, Codex, Google, Microsoft, development platforms, cloud platforms and other similar services. The specific tools we use may change over time.

Where we use these tools, we will take reasonable steps to limit the personal data submitted to them and to configure them appropriately where controls are available. This may include:

restricting access;
avoiding unnecessary personal data in prompts, files or uploads;
disabling training on customer content where available;
using business or enterprise settings where appropriate;
reviewing supplier terms;
applying appropriate security controls;
limiting retention where settings allow;
avoiding the submission of sensitive or special category data unless suitable safeguards have been confirmed.

We do not intentionally use personal data submitted through Benchmarq360 to train public AI models. However, where we use third-party AI, automation, software or cloud services, those providers may process personal data on our behalf in accordance with their own contractual terms, data processing agreements, technical controls and infrastructure arrangements.

6. International Transfers and Third-Party Processing

Benchmarq360 is operated from the United Kingdom. However, some of the third-party technology platforms, AI services, cloud providers, software tools, development environments, email services, hosting providers, analytics tools and support services we use may process, store, support or access personal data from locations outside the United Kingdom.

This may include personal data submitted through Benchmarq360 tools, contact forms, assessment forms, prototype applications, digital products, email communications, file uploads, system logs, diagnostic records or business correspondence.

Where personal data is transferred outside the UK, we will take reasonable steps to ensure that appropriate safeguards are in place. These may include:

using providers located in countries covered by UK adequacy regulations;
using appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses;
reviewing supplier terms, privacy documentation and data processing arrangements where appropriate;
limiting the personal data collected or submitted to third-party tools;
restricting access to personal data;
applying security controls such as access permissions, authentication, encryption where available, retention controls and audit records;
avoiding the submission of sensitive or special category data into general-purpose AI tools unless suitable safeguards have been confirmed.

Where a third-party platform acts as a processor on our behalf, we will take reasonable steps to ensure that appropriate contractual and data processing terms are in place.

7. Data Minimisation and Responsible Use

We aim to collect and process only the personal data that is reasonably necessary for the relevant purpose.

Benchmarq360 is intended to support organisational benchmarking, capability assessment and business improvement. Users should therefore avoid submitting unnecessary personal data.

Unless we specifically request it and confirm that the relevant channel is suitable, you should not submit:

special category personal data, such as health information, ethnicity, religious beliefs or trade union membership;
criminal offence data;
personal data about third parties;
policyholder, customer or employee records;
confidential client information;
passwords, credentials or financial account details;
commercially sensitive documents or datasets that are not required for the assessment;
information that you are not authorised to share.

Where possible, users should provide business-level, aggregated, anonymised or non-identifiable information rather than naming specific individuals.

8. Benchmarking, Aggregated Data and Insights

Benchmarq360 may use information submitted through assessments to generate benchmarking, maturity scoring, comparative insights, recommendations and trend analysis.

Where we use data for benchmarking or market insight purposes, we will seek to use aggregated, anonymised or pseudonymised information wherever reasonably possible.

We will not intentionally disclose identifiable personal data or confidential client-specific information in external benchmark outputs unless we have a lawful basis to do so and appropriate permission or contractual authority.

Aggregated or anonymised insights may be used to improve Benchmarq360, develop future products, enhance scoring models, refine assessment frameworks and support wider market analysis.

9. How Long We Keep Your Data

We will retain personal data only for as long as necessary to fulfil the purpose for which it was collected, including for the purposes of operating Benchmarq360, providing services, responding to enquiries, managing business relationships, preparing reports, maintaining records, resolving disputes and complying with legal, regulatory, tax or accounting requirements.

Retention periods may vary depending on the nature of the information and the context in which it was provided.

Where data is submitted through a Benchmarq360 assessment, prototype tool or digital service, we will aim to delete, anonymise or archive it when it is no longer needed for the purpose for which it was collected, unless a longer retention period is required for legal, contractual, operational or legitimate business reasons.

10. Your Rights

Under UK GDPR, you have rights in relation to your personal data. These may include the right to:

access the personal data we hold about you;
request correction of inaccurate or incomplete personal data;
request deletion of your personal data;
object to our processing of your personal data;
request restriction of processing;
withdraw consent, where we rely on consent;
request transfer of your personal data, where applicable;
lodge a complaint with the Information Commissioner’s Office.

To exercise any of your rights, please contact:

[email protected]

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection matters.

11. Data Security

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

access controls;
password protection;
secure email handling;
restricted user permissions;
authentication controls;
encryption where available;
supplier due diligence;
data minimisation;
retention controls;
periodic review of the systems and tools we use.

However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of personal data transmitted through Benchmarq360, online forms, email, digital tools, prototype applications or third-party platforms.

You should avoid submitting sensitive personal information, third-party personal data or confidential information unless we have specifically requested it and confirmed that the relevant channel is suitable.

12. Sharing Your Information

We may share personal data with trusted third parties where necessary to operate Benchmarq360, provide services, support users, manage our business or comply with legal obligations.

These third parties may include:

companies within the WHO2 Group;
IT, hosting and cloud service providers;
AI, automation and software providers;
email and communication platforms;
analytics, monitoring and security providers;
professional advisers;
payment, accounting and administrative providers;
regulators, public authorities or law enforcement bodies where required by law.

We will only share personal data where there is a lawful basis to do so and, where appropriate, subject to confidentiality, contractual or data processing obligations.

13. Links to Other Websites

Benchmarq360, Whonify or WHO2 Group websites and digital tools may contain links to other websites or third-party services.

We do not have control over those websites or services and are not responsible for the protection and privacy of any information you provide while visiting them.

You should review the privacy policy of any third-party website or service you use.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in Benchmarq360, Whonify, WHO2 Group, our services, technology, legal obligations or data protection practices.

The latest version will be made available on our website or within the relevant Benchmarq360 service.

You should check this page periodically to ensure that you are happy with any changes.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle personal data, please contact:

Benchmarq360

Suite G18, Genesis Centre
Innovation Way
Stoke-on-Trent
Staffordshire
ST6 4BF

Email: [email protected]