Privacy Policy 

Last updated: 28/07/2026
Version: 1.0 

1. About this Privacy Policy

Consenna Ltd (“Consenna”, “we”, “our” or “us”) respects your privacy and is committed to protecting your personal information. 

This Privacy Policy explains how we collect, use, share, retain and protect personal information when you use our websites, programme portals and services, or participate in a programme administered by us. 

It also explains your rights under applicable UK data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. 

2. Who Is Responsible for Your Information?

Consenna Ltd is normally the data controller responsible for personal information collected through our websites, services and programme portals. 

Some programmes are operated on behalf of, or jointly with, a programme sponsor, manufacturer, distributor or other commercial partner. Depending on the arrangements for a particular programme: 

• Consenna may be the data controller; 

• Consenna and the programme sponsor may be joint controllers; 

• the programme sponsor may be a separate controller; or 

• Consenna may process personal information on the programme sponsor’s behalf. 

Where another organisation is a controller, or where different arrangements apply, we will explain this in the relevant programme terms, registration page or programme-specific privacy notice. 

Our details are: 

Consenna Ltd
Registered office: Unit C Houston Road, Inchinnan, Renfrew, Scotland, PA4 9LS
Company number: SC357063
Email: info@consenna.com
ICO registration number: ZA799507 

3. Personal Information We Collect

Depending on the website, service or programme you use, we may collect: 

• your name; 

• job title; 

• organisation, employer or school; 

• business or personal email address; 

• telephone number; 

• billing or delivery address; 

• school or organisation details; 

• programme registration information; 

• account details, usernames and authentication information; 

• product, order, claim, purchase, reward or redemption information; 

• product serial numbers or other product identifiers; 

• proof of purchase and supporting documentation; 

• eligibility information; 

• payment or transaction information; 

• records of correspondence between you and Consenna; 

• enquiries, complaints and customer-support records; 

• marketing preferences; 

• information used to detect or prevent fraud; 

• IP address, browser type, device information and website usage information; and 

• any other information you choose to give us. 

Please avoid providing personal information that is not needed for your application, claim or enquiry. 

Special-category information 

We do not normally ask for sensitive or “special category” personal information, such as information about health, disability, racial or ethnic origin, religious beliefs or sexual orientation. 

However, we may occasionally need to process limited special-category information where this is necessary to provide an appropriate service, make a reasonable adjustment, meet an accessibility requirement, establish or defend a legal claim, or comply with the law. 

Where this applies, we will identify an appropriate lawful basis and an additional condition for processing special-category information. 

4. How We Obtain Your Information

We may collect personal information: 

• directly from you when you register, submit a claim, place an order, contact us or use our services; 

• automatically when you use our websites or programme portals; 

• from a programme sponsor, manufacturer or distributor; 

• from your employer, school or other organisation; 

• from an authorised reseller or fulfilment partner; 

• from payment, delivery or identity-verification providers; 

• from fraud-prevention or security providers; 

• from publicly available sources; or 

• from another person acting with your authority. 

Where we obtain your information from another source, we will provide relevant privacy information within the period required by law, unless an exemption applies. 

5. How andWhyWe Use Your Information 

We process personal information only when we have a lawful basis for doing so. 

The purposes for which we may process your information and the lawful bases we normally rely upon are set out below. 

Programme registration and administration 

We use registration, contact, organisation and eligibility information to: 

• register you for a programme; 

• assess or confirm eligibility; 

• administer your participation; 

• provide programme-related communications; and 

• respond to questions about your registration. 

We normally process this information because it is necessary to enter into or perform a contract with you. Where the programme is arranged through your employer, school or another organisation, we may instead rely on our legitimate interests and those of the programme sponsor in administering the programme effectively. 

Claims, orders, rewards and redemptions 

We use purchase, claim, order, delivery and supporting information to: 

• validate claims and proof of purchase; 

• process orders, rewards or redemptions; 

• arrange delivery or fulfilment; 

• provide status updates; and 

• resolve problems or disputes. 

We normally process this information because it is necessary to perform a contract with you or because we have a legitimate interest in administering the relevant programme and ensuring that valid claims are fulfilled. 

Customer service and communications 

We use contact details, correspondence and account information to: 

• answer enquiries; 

• provide technical or customer support; 

• investigate complaints; 

• manage our relationship with you; and 

• maintain records of our communications. 

We process this information where necessary to perform a contract or because we have a legitimate interest in providing effective customer service and maintaining appropriate business records. 

Fraud prevention and programme security 

We may use registration, claim, purchase, technical and identity-related information to: 

• verify the accuracy of applications and claims; 

• identify duplicate or fraudulent claims; 

• protect our systems, websites and programme portals; 

• enforce programme rules; and 

• investigate suspected misuse. 

We process this information because we and our programme partners have legitimate interests in preventing fraud, protecting programme funds, maintaining system security and ensuring that programmes operate fairly. 

Legal, accounting and regulatory requirements 

We may use and retain information to: 

• maintain financial and accounting records; 

• comply with tax and other legal obligations; 

• respond to lawful requests from regulators or public authorities; 

• establish, exercise or defend legal claims; and 

• demonstrate compliance with our obligations. 

We process this information where necessary to comply with a legal obligation or, where appropriate, because we have a legitimate interest in protecting our legal rights. 

Improving our services 

We may analyse service, support and website-usage information to understand how our services are used and to improve our websites, portals, programmes and internal processes. 

We normally rely on our legitimate interest in operating and improving our services. Where consent is legally required for the technology used to collect this information, we will request consent. 

Marketing 

Where permitted by law, we may use your contact details and marketing preferences to send information about programmes, products or services that may be relevant to you. 

We will obtain consent where consent is required. In other circumstances, we may rely on our legitimate interests, provided that applicable electronic-marketing rules permit us to do so. 

You can opt out at any time by using the unsubscribe link in a message or contacting us using the details in section 16. 

6. Our Legitimate Interests

Where we rely on legitimate interests, those interests may include: 

• administering programmes efficiently; 

• providing customer support; 

• improving our websites, portals and services; 

• maintaining accurate business records; 

• protecting our systems and information; 

• preventing fraud and misuse; 

• enforcing programme rules; 

• protecting our legal rights; and 

• supporting the legitimate interests of programme sponsors and commercial partners. 

Before relying on legitimate interests, we consider the necessity of the processing and balance our interests against your rights, interests and reasonable expectations. 

7. When You Must Provide Information

Some personal information is required so that we can register you for a programme, validate a claim, fulfil an order, deliver a reward, comply with the law or perform our agreement with you. 

We will indicate when information is required. If you do not provide required information, we may be unable to: 

• register you for a programme; 

• assess your eligibility; 

• validate or fulfil a claim; 

• process an order, reward or redemption; 

• provide a requested service; or 

• respond fully to your enquiry. 

Information identified as optional does not have to be provided. 

8. Sharing Your Information

Where necessary for the purposes described in this Privacy Policy, we may share personal information with: 

• programme sponsors, manufacturers and participating vendors; 

• authorised distributors, resellers and fulfilment partners; 

• delivery and logistics providers; 

• payment service providers; 

• website, hosting, cloud-storage and software providers; 

• communications and customer-support providers; 

• identity-verification, security and fraud-prevention providers; 

• analytics providers, where permitted; 

• professional advisers, including lawyers, accountants and insurers; 

• auditors; 

• regulators, courts, law-enforcement agencies and public authorities; 

• a buyer, seller or adviser involved in a proposed business sale, restructuring or transfer; and 

• other organisations where you have authorised the disclosure or where it is required by law. 

We will not sell your personal information. 

Where another organisation processes information on our behalf, we require it to protect the information, follow our instructions and use the information only for authorised purposes. 

Some recipients, including programme sponsors, may process your information as separate or joint controllers. Where applicable, further information will be provided in the relevant programme notice or terms. 

9. International Transfers

Some of our suppliers, programme sponsors or service providers may process personal information outside the United Kingdom. 

When personal information is transferred to a country that has been recognised by the UK government as providing an adequate level of protection, we may rely on the relevant UK adequacy regulations. 

In other cases, we will use an appropriate safeguard, such as: 

• the UK International Data Transfer Agreement; 

• the UK Addendum to the European Commission’s Standard Contractual Clauses; or 

• another safeguard permitted by UK data protection law. 

Where required, we will also undertake an appropriate transfer risk assessment. 

You may contact us using the details in section 16 to request further information about the safeguards used for a particular transfer, including how to obtain a copy of the relevant safeguard. 

10. Data Security

We use appropriate technical and organisational measures designed to protect personal information against: 

• unauthorised access; 

• accidental or unlawful loss; 

• misuse; 

• alteration; 

• destruction; and 

• unauthorised disclosure. 

These measures may include access controls, authentication measures, staff training, security monitoring, backups, contractual controls and encryption where appropriate. 

Access to personal information is restricted to employees, contractors and authorised third parties who require it for legitimate purposes. 

No online service or storage system is completely secure. You should therefore take appropriate care when sending information over the internet and keep account credentials confidential. 

11. How Long We Keep Your Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, accounting, regulatory and reporting requirements. 

Our normal retention periods are: 

• programme registration information: for the duration of the relevant programme and for two years after it ends; 

• unsuccessful or rejected claims: for two years after the final decision; 

• successful claims, orders, rewards and delivery records: for six years after completion; 

• invoices, payment information and accounting records: for six years after the end of the financial year to which they relate; 

• routine customer-service correspondence: for two years after the matter is closed; 

• complaints and disputed claims: for six years after final resolution; 

• fraud-prevention and investigation records: normally for three years after the investigation is closed, or for up to six years where fraud is confirmed or continued retention is reasonably necessary; 

• account information: while the account remains active and for two years after it is closed or becomes inactive; 

• website and security logs: normally for up to twelve months; 

• marketing contact and consent records: while we continue to send marketing and normally for two years after your last interaction with us; and 

• suppression records: for as long as necessary to ensure that we continue to respect your request not to receive marketing. 

We may retain information for longer where this is necessary because of an actual or reasonably anticipated legal claim, regulatory investigation, fraud investigation, legal obligation or instruction from a relevant authority. 

We may retain information for a shorter period where it is no longer required. 

When determining the appropriate retention period, we consider the amount, nature and sensitivity of the information, the purposes for which it is used, applicable legal and contractual requirements, the risk of harm from unauthorised use or disclosure, and whether the purpose can be achieved using anonymised information. 

When personal information is no longer required, we will securely delete or anonymise it. Anonymised information that can no longer identify an individual may be retained and used for statistical, reporting and service-improvement purposes. 

12. Cookies and Similar Technologies

Our websites and programme portals may use cookies and similar technologies. 

Detailed information about the technologies we use, their purposes, providers, duration and the choices available to you is provided in our separate Cookie Policy, available at: 

https://smbpromos.com/cookie-policy/

Where consent is required, non-essential cookies and similar technologies will be used only in accordance with the choices you make through our cookie controls. 

13. Automated Decision-Making

If no solely automated decisions are made: 

We do not currently make decisions that produce legal or similarly significant effects about you based solely on automated processing. 

We may use automated tools to identify potentially duplicate, unusual or fraudulent claims. Where such a tool flags a claim, the claim will be referred for appropriate review rather than being finally rejected solely by the automated tool. 

Where required by law, you may request human intervention, express your point of view and challenge the decision by contacting us using the details in section 16. 

14. Children’s Information

Our websites, programme portals and services are intended for adults acting personally or on behalf of a business, school or other organisation. They are not intended to collect personal information directly from children. 

If you believe that a child has provided personal information to us without appropriate authorisation, please contact us. 

15. Your Data Protection Rights

Depending on the circumstances and the lawful basis used, you may have the right to: 

• request access to your personal information; 

• request correction of inaccurate or incomplete information; 

• request deletion of your information; 

• request restriction of processing; 

• object to processing based on legitimate interests; 

• object at any time to the use of your information for direct marketing; 

• request the transfer of certain information to you or another organisation; 

• withdraw consent where processing is based on consent; and 

• challenge certain decisions made solely by automated means. 

These rights are not absolute, and exemptions may apply. For example, we may need to retain certain information to comply with a legal obligation or establish, exercise or defend a legal claim. 

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn. 

To exercise a right, contact us using the details in section 16. Please describe your request clearly. We may ask for information reasonably necessary to confirm your identity and protect personal information from unauthorised disclosure. 

We normally respond within one month, although the law permits additional time for particularly complex requests. We will tell you if additional time is needed. 

You will not normally have to pay a fee. However, the law allows us to charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive. 

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise a data protection right or have concerns about how we handle your information, please contact: 

Consenna Ltd
Address: Unit C Houston Road, Inchinnan, Renfrew, Scotland, PA4 9LS
Email: info@consenna.com 

17. Complaints

We would appreciate the opportunity to address your concerns first. Please contact us using the details above. 

You also have the right to complain to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection: 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF 

Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/ 

18. Links to Other Websites

Our websites and programme portals may contain links to websites operated by programme sponsors or other third parties. 

We are not responsible for the privacy practices of websites operated by other organisations. You should read the privacy information provided on the relevant website before submitting personal information. 

19. Changes to This Privacy Policy

We may update this Privacy Policy when our services, processing activities or legal obligations change. 

The latest version will be published on our website with its effective date. If we make a material change, we will take reasonable steps to bring it to the attention of affected individuals before the new processing begins, where required. 

Programme-specific notices may supplement this Privacy Policy. If there is a conflict concerning a particular programme, the programme-specific notice will explain which terms apply.