Policies

How we protect information and use AI.

Plain-language policies for our information security, how long we keep data, and how we use AI.

Last updated 20 October 2026

These policies follow the principles of ISO/IEC 27001 and ISO/IEC 42001. We do not currently hold certification to these standards. See our standards and privacy notice.

Aligned with ISO/IEC 27001

Information security policy

Premier Change Consulting Ltd protects the confidentiality, integrity and availability of the information clients and participants entrust to us. This policy applies to all Studio staff, associates and the systems we use.

Responsibility

The Director is accountable for information security and reviews this policy at least once a year, or after any significant change or incident.
Everyone working with Studio information must follow this policy and report any concern immediately.

Access control

Administrative access is limited to named Studio staff and reviewed every quarter; access is removed promptly when no longer needed.
Admin accounts use strong, unique passwords, and two-step sign-in wherever it is available.
Organisation sponsors and participants reach their areas through private, high-entropy links. We store only scrambled (hashed) versions of these links and of sponsor passwords.

Protecting data

We collect only what each service needs, as described in our privacy notice.
Data is held with reputable cloud providers, encrypted in transit and at rest, with access rules enforced on the server.
Individual assessment answers are never shown in team or organisation reports, and combined results stay hidden until at least three people have completed.
Downloads from our systems are protected against spreadsheet formula injection and kept only as long as needed.

Suppliers

We use only suppliers that offer appropriate security commitments, and we review them when our use of them changes.

Incidents

Suspected incidents are logged, contained and investigated as soon as they are found.
Where personal data is affected and there is a risk to people's rights, we notify the Information Commissioner's Office within 72 hours and inform those affected without undue delay.
Every incident is reviewed afterwards so the cause can be fixed.

Data retention rules

How long we keep information

We keep personal information only for as long as we need it for the purpose it was given, then delete it or make it anonymous. You can ask us to delete your information sooner at any time.

Retention periods

Enquiries that do not lead to work: 24 months from the last contact.
Free Five Spans assessment results: 24 months from completion, unless you ask us to keep them longer in your client portal.
Team, project and enterprise assessment answers: for the length of the engagement plus 12 months. Anonymous combined results may be kept longer to show progress over time.
Invited to the Table registrations: 12 months after the event.
Client contracts, invoices and payment records: 6 years after the end of the financial year, as UK law requires.
Marketing preferences: until you unsubscribe; we keep a record of the unsubscribe so we don't contact you again.
Security and email delivery logs: up to 12 months.

Deletion

We review stored information every six months and delete anything past its retention period.
Deletion requests are completed within one month.
Exported files are deleted once they have served their purpose.

Aligned with ISO/IEC 42001

AI use policy

We use artificial intelligence carefully, only where it adds value for the person using it, and never in place of professional judgement.

Where we use AI

Optional written reflections on a completed free Five Spans assessment. These are generated through the Lovable AI service, which uses large language models such as Google Gemini and OpenAI GPT.
We do not use AI to score assessments, make decisions about people, or produce team and organisation reports.

Safeguards

AI reflections are only created when you choose to request one and agree to it.
Only your scores are sent to the AI service. Your name, email address and organisation are never included.
Your scores are always calculated by our own fixed method, and the reflection is presented as a prompt for thinking, not a verdict.
Each completed assessment can request one reflection, and use is limited to prevent misuse.

Oversight

The Director reviews how AI is used, its outputs and any feedback at least once a year, and before introducing any new AI use.
If you have a concern about an AI reflection, contact us and we will review it.

Questions or requests: hello@theleadershipandtransformationstudio.com