PRIVACY NOTICE

Company-wide privacy notice for website visitors, business contacts, clients, partners and prospects

Last updated: 2 November 2026

This Privacy Notice explains how 3 Goods Ventures Ltd collects, uses, shares and protects personal information in connection with its website, business-development activities, commercial relationships and corporate operations. It is intended to apply across the Company, not only to website visitors.

Controller	3 Goods Ventures Ltd
Company number	17483559
Registered office	Unit C, Aldow Enterprise Park, Piccadilly Business Centre, Blackett Street, Manchester M12 6AE, United Kingdom
Website	www.3goodsventures.com
Privacy contact	andres@3goodsventures.com

1. Who we are and scope of this notice

3 Goods Ventures Ltd is a private limited company incorporated in England and Wales. For the personal information covered by this notice, the Company is generally the data controller, meaning that it decides why and how the information is used.

This notice covers personal information relating to: website visitors; people who contact us; prospective and current clients; prospective and current commercial, scientific, funding and institutional partners; suppliers and professional advisers; investors and funders; event and professional contacts; and business contacts identified for relevant B2B outreach.

Where a specific project involves a different controller arrangement, special-category information, clinical or research data, or a separate contractual privacy framework, we will use project-specific documentation as appropriate. The public website is not intended to collect patient data, health data or other sensitive personal information.

2. Personal information we may collect

Identity and business contact information, such as name, business email address, business telephone number, organisation, role and professional address.

Professional and organisational information, such as job title, area of responsibility, organisation profile, sector and publicly available professional information relevant to a business relationship.

Enquiry and correspondence information, including messages, meeting notes, proposals, requests, introductions and records of communications.

Client, partner and project information needed to evaluate, structure, negotiate, manage or document an engagement or opportunity.

Commercial and relationship-management information, including contact history, source of contact details, interests relevant to the business relationship, follow-up status and opt-out preferences.

Transaction and compliance information, such as invoicing, payment, contractual, due-diligence and corporate records where relevant.

Website and technical information, such as IP address, device/browser information, security logs, consent choices and other information generated through necessary website technologies.

Optional analytics or similar information only where the relevant technology is lawfully enabled, normally on the basis of consent.

3. Where we obtain personal information

We obtain personal information from several sources, depending on the context:

directly from you when you contact us, meet us, send information, enter into discussions or work with us;

from your organisation or another person who introduces or refers you;

from publicly available business sources, including corporate websites, public registers, professional directories, professional networking platforms, event information and other legitimate business sources;

from service providers used to operate our website, email, communications and business systems; and

from counterparties, advisers, partners or institutions where disclosure to us is lawful and relevant to a project or relationship.

If we obtain your business contact details indirectly and use them for B2B outreach, we will provide access to this notice at or before the first relevant communication, unless an applicable legal exception applies.

4. Why we use personal information and our lawful bases

Purpose	Typical information	Lawful basis
Responding to enquiries and considering potential work or collaboration	Identity, contact details, message, professional context	Legitimate interests in responding to relevant business enquiries; contract or steps before contract where you are contracting in your own capacity.
Managing clients, projects, partners, suppliers and professional relationships	Contact, correspondence, project, contractual and relationship records	Legitimate interests in operating and managing business relationships; contract where the individual is a contracting party; legal obligation where required.
Targeted B2B business development, partnership and commercial outreach	Business identity/contact details, role, organisation, source, contact history	Legitimate interests in developing our business and relevant professional relationships, subject to balancing safeguards and applicable PECR rules.
Funding, institutional and strategic-partner engagement	Business contact, professional context, correspondence, proposal data	Legitimate interests in developing and financing projects and maintaining institutional relationships.
Corporate administration, accounting, tax, legal and compliance	Contract, invoice, payment, corporate and compliance records	Legal obligation; legitimate interests in governance, record-keeping and protection of legal rights.
Website operation, security and fraud/abuse prevention	Technical data, security logs, necessary storage/access data	Legitimate interests in secure and reliable website operation and, where applicable, statutory exceptions for necessary storage/access technologies.
Optional analytics, preferences, external media or other non-essential website technologies	Device/browser and interaction data as specified in Cookie Settings	Consent, unless a specific statutory exception has been deliberately assessed and documented.
Handling privacy rights, complaints and legal claims	Identity, request/complaint, correspondence and evidence	Legal obligation and legitimate interests in resolving complaints and establishing, exercising or defending legal rights.

When we rely on legitimate interests, we consider whether the processing is necessary, proportionate and within reasonable professional expectations, and we use safeguards to reduce privacy impact. You may object to processing based on legitimate interests. You have an absolute right to object to direct marketing.

5. B2B outreach and direct marketing

We may contact relevant people at companies and other organisations about services, projects, partnerships, licensing, funding, commercial opportunities or other matters that are reasonably connected with their professional role.

For corporate subscribers, such as limited companies and LLPs, UK electronic-marketing rules generally allow B2B marketing emails without prior consent, but every message must identify the sender and provide a clear way to opt out.

Where a named business contact is used, data-protection law still applies. We generally rely on legitimate interests for targeted, proportionate B2B outreach where the contact is relevant to the person’s professional role.

We do not rely on the corporate-subscriber rule for sole traders or other recipients treated as individual subscribers under PECR unless consent or another lawful route applies.

If you ask us to stop direct marketing, we will stop and may retain a minimal suppression record so that we can respect your preference in the future.

6. Sharing personal information

We do not sell personal information. We may share it only where reasonably necessary with:

hosting, email, cloud, communications, security and IT service providers acting under appropriate contractual terms;

accountants, lawyers, consultants, banks, payment providers and other professional advisers or service providers;

project partners, counterparties, funders, clients or prospective transaction parties where sharing is relevant, proportionate and lawful;

public authorities, regulators, courts or law-enforcement bodies where required or permitted by law; and

a successor, purchaser or other party involved in a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

7. International access and transfers

Our business is international and some service providers or counterparties may process or access personal information outside the United Kingdom. Where UK data-protection rules on restricted transfers apply, we use an available lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another permitted safeguard, together with any required assessment and supplementary measures.

Where another applicable data-protection law provides additional protections, we will apply those requirements to the relevant processing.

8. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, contractual, accounting and evidential requirements. Our current operating retention periods are:

Record type	Typical retention
General enquiries and early-stage discussions	Up to 24 months after the last substantive interaction, unless a relationship continues or a longer period is justified.
B2B prospecting records	Up to 24 months after the last meaningful contact or verification. Minimal suppression information may be retained longer where needed to respect an opt-out.
Client, project and contractual records	Normally 6 years after the relevant relationship or project ends, unless law, contract, dispute or another justified need requires longer.
Accounting, tax and payment records	Normally 6 years or the applicable statutory period.
Supplier, adviser and partner contractual records	Normally 6 years after the relationship ends for material contractual/financial records; routine contact records may be shorter.
Website security and server logs	Normally no more than 12 months unless needed for an incident, security investigation or legal claim.
Privacy rights and complaint records	Normally 3 years after closure, unless a longer period is needed for a legal or regulatory reason.
Cookie/consent preference records	For the period reasonably necessary to remember and demonstrate the user’s choice; the live Cookie Settings interface identifies the duration of individual technologies.

9. Security

We use proportionate technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Measures may include access controls, secure accounts, authentication, encryption in transit, backups, device and account security, role-based access and contractual controls over service providers.

No internet or electronic-storage system can be guaranteed to be completely secure. We therefore review security measures in light of the nature of the information and the risks involved.

10. Special-category and sensitive information

Please do not send health information, genetic or biometric information, information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life or sexual orientation, criminal-offence data, patient data or other highly sensitive personal information through the public website or ordinary business email unless we have specifically requested it and appropriate safeguards are in place.

If a scientific, biomedical or other project requires such information, it will be governed by project-specific legal, ethical, security and privacy arrangements before processing begins.

11. Automated decision-making

We do not currently use personal information collected through the public website or ordinary B2B relationship management to make solely automated decisions that produce legal effects or similarly significant effects on individuals.

12. Your data-protection rights

Depending on the circumstances and the applicable law, you may have rights to:

request access to personal information we hold about you;

ask us to correct inaccurate or incomplete information;

ask us to erase information in certain circumstances;

ask us to restrict processing in certain circumstances;

object to processing based on legitimate interests;

object at any time to direct marketing;

receive certain information in a portable format where the right applies;

withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful processing; and

raise a concern or complaint about how we use your information.

We may need to verify your identity before acting on a request. We will respond within the period required by applicable law and will tell you if a lawful exception or extension applies.

13. Data-protection complaints

You can raise a data-protection concern or complaint directly with us at andres@3goodsventures.com. We will acknowledge a data-protection complaint within 30 days, investigate it without undue delay, keep you appropriately informed and explain the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). Information about complaints is available at ico.org.uk. We would normally welcome the opportunity to address your concern directly first.

14. Children

Our website and services are directed to business and professional audiences and are not intended for children. We do not knowingly use the website to collect children’s personal information.

15. Changes to this notice

We may update this notice to reflect changes in our activities, systems, legal obligations or data-processing practices. The current version will be published on our website with its latest update date.

16. Contact

Privacy and data-protection enquiries: andres@3goodsventures.com

3 Goods Ventures Ltd
Unit C, Aldow Enterprise Park, Piccadilly Business Centre, Blackett Street, Manchester M12 6AE, United Kingdom.

 

---

Cookies

This website does not use cookies, analytics tools, tracking pixels, or other similar tracking technologies.

If we incorporate any such technology in the future, we will update this information and, where appropriate, obtain the necessary consent before activating it.