Who we are
Sidra Advisory Ltd ("we") is registered in England and Wales, company number 17199320. Registered office: 83 Winterfold Close, London, England, SW19 6LF. Contact: hello@sidraadvisory.com. We are registered with the Information Commissioner's Office, registration number ZC291429. We are the data controller for personal data about you and the people who contact us, and a data processor for personal data inside the business records you upload (see our terms, section 9).
What we collect
- The free check: the file you choose is read only inside your own browser and is never uploaded. To build benchmarks the page sends us only anonymous totals: the number of lines, a spend size band, the share of lines that are possible duplicates and the sector you choose. No names, invoice details or amounts are sent.
- Emailed results: if you ask us to email you a free-check result, your email address, company (optional), the totals shown on screen (never your file), whether you asked for our three follow-up emails, and where you arrived from.
- File list requests: your name, work email, company, phone number (optional), your answers to the six questions and your chosen currency.
- Full reviews: your name, work email, company details, sector, the date and version of the terms you accepted, a shortened form of your IP address, and the business records you upload. Those records may contain names and contact details of your staff, suppliers and customers.
- Payment monitoring: if you connect Xero, the bills and supplier contact details we need for the checks (supplier names, invoice numbers, dates, amounts, VAT and company numbers, and a one-way fingerprint of supplier bank details used only to spot changes). Access tokens are stored encrypted.
- Supplier savings service: if you ask for it, your name, work email, phone number (if given), company, your answers to the short questions (postcode, sites, staff numbers, renewals, who decides), the documents you upload, the result of a Companies House check on your company, the payment method you save with Stripe (we never see full card or bank details), any note you add, the spend analysis (including supplier names, items, prices and spend), the supplier offers and your decisions, and a record of your signature (name, time, IP address and browser).
- Procurement associates: if you apply to work with us, your name and contact details, how you contract (including your company or trading details, VAT number and address), insurance, experience, any interests you declare in suppliers, your signatures on agreements and work offers (name, time, IP address and browser), and your work records on the platform.
- Referral partners: if you sign up as a referral partner, your name, firm, contact details and the reviews made through your link. If you arrive through a partner's link, we note that partner's code against your enquiry so we can pay their fee.
- Postcode lookup: to apply the right local rates in a savings assessment, we send the postcode you give us, and nothing else, to the free public service postcodes.io.
- Register checks: supplier VAT and company numbers are checked with HMRC and Companies House.
- Payments: Stripe processes card payments. We receive confirmation of payment, the amount and your email address, never your card details.
- Technical data: our hosting provider receives your IP address and browser details when you visit, to deliver the site and keep it secure. Fonts and scripts are served from our own site; the only outside script is Google's advertising tag, and only if you accept it (see Cookies below).
Why we use it, and our lawful basis
- To provide the full review and report and take payment: performance of our contract with your business, and our legitimate interest in dealing with the people who act for it.
- To provide the supplier savings service you ask for: performance of our contract with your business. To assess associate applications, contract with associates and pay them: steps before entering into a contract, performance of that contract, and our legal obligations.
- To send you the file list or free-check result you asked for and reply to enquiries: our legitimate interest in responding to requests.
- To send the three follow-up emails after a free check: your consent, given by ticking the box. Every email has an unsubscribe link, and unsubscribing deletes your details. To improve these emails we record which links in them you click and whether you later start a review; we do not track whether you open them.
- To confirm findings, we may use an AI service to flag findings that need a closer look and to draft the summary. A person confirms every finding; AI never creates or changes a figure.
- To create anonymised benchmarks from review results: our legitimate interest in improving and comparing our analysis. Benchmarks contain only rates, counts and bands, never names, references or amounts, and none is shown unless it combines at least five businesses.
- To send occasional updates about our services: only if you tick the box to agree. You can withdraw at any time.
- To send up to two reminders after a file list request, and up to two after a free payment check, if you haven't gone ahead: our legitimate interest in following up a request you made. Every reminder has a link to stop them.
- To ask paying clients for a one-click rating of our service, and record any reason they add: our legitimate interest in improving our service.
- To meet legal, tax and accounting obligations: legal obligation.
Who we share it with
We do not sell personal data. We use these service providers, under contracts that protect your data: Netlify (website hosting and secure storage), Stripe (payments), Zoho (email), Xero (only if you connect it), HMRC and Companies House (register checks), Anthropic (AI assistance in confirming findings and drafting summaries, where used), and Google (advertising measurement, only if you accept the cookie described below). Under the supplier savings service, the procurement specialists working for us on your engagement see the information needed to do it, under contracts that make them our processors and bind them to confidentiality; and we share with your suppliers only what is needed to ask for better prices. Some of these providers process data outside the UK. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement or Addendum.
How long we keep it
- Unpaid findings and the records behind them: deleted 30 days after the findings are ready.
- Paid reports: uploaded records deleted 30 days after payment; the report deleted 90 days after payment.
- Reviews where no findings are confirmed: deleted within 7 days.
- Records never reviewed: deleted after 60 days.
- File list requests and emailed results: deleted after 12 months, or straight away if you unsubscribe.
- Supplier savings engagements: the spend analysis is deleted 90 days after the engagement ends; the record of offers, decisions, signatures and fees is kept for 6 years, for our accounts and in case of dispute. Requests that do not go ahead are deleted after 12 months.
- Associate applications that do not go ahead: deleted after 12 months. Associate agreements and work records: kept for 6 years after the last assignment.
- Payment monitoring: kept while monitoring is active; deleted within 30 days of cancelling, or 30 days after the free check if you do not subscribe.
- Client feedback: deleted after 2 years.
- Payment and accounting records: kept for 6 years, as UK law requires.
- Anonymised benchmark figures: kept indefinitely, as they do not identify anyone.
Deletion runs automatically every day.
Your rights
You can ask us for a copy of your data, or to correct it, delete it, restrict or object to how we use it, or move it to another provider. Email hello@sidraadvisory.com and we will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live.
Cookies and storage
We ask before setting any cookie that is not essential. If you accept, the site loads Google's advertising tag, which sets a Google Ads cookie (named _gcl_au, and _gcl_aw if you arrived from one of our adverts) for up to 90 days, so we can see which of our Google adverts led to a free check or an enquiry. Google receives your IP address and browser details when the tag loads. We do not use it for remarketing or to personalise adverts, and we use no other analytics or advertising cookies. If you reject, nothing is loaded. You can change your choice at any time with the Cookie settings link at the foot of every page; your choice is remembered in your browser. Google's own use of the data is described at policies.google.com/technologies/ads.
Your browser may also remember your chosen currency, your cookie choice, and the file you used for the free check during your visit, on your own device; that file is not sent to us.
To learn which adverts and links bring people here, your browser keeps, for the length of your visit only, where you arrived from (the referring website or the campaign tags in the link, such as utm_source). We count visits, free checks and enquiries by that source as anonymous totals. We do not record your IP address, identity or what you do on other sites for this. If you submit a review or enquiry, its source is stored with it so we know which campaign it came from.