Privacy Policy
August 2026
At TMH Procurement LLP, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact us or use our services.
TMH Procurement LLP is a procurement consulting firm serving clients including law firms and corporate organisations in the UK and internationally.
This Privacy Policy applies to personal information processed by TMH Procurement LLP as a data controller, where applicable. In some circumstances, when providing procurement consulting services to a client, we may process personal information on the client’s behalf. In those circumstances, the client may be the data controller and our processing will be governed by the relevant contractual arrangements and applicable data protection legislation.
By using our website or providing us with personal information, you acknowledge that your information will be handled in accordance with this Privacy Policy.
Who We Are
TMH Procurement LLP is the organisation responsible for the personal information covered by this Privacy Policy where we act as the data controller.
If you have any questions about how we process your personal information, please contact us at:
Email: mahwash.ali@tmhpllp.com
Information We Collect
Depending on how you interact with us, we may collect the following types of personal information:
- your name and job title;
- business address and contact details;
- email address and telephone number;
- information provided when you contact us or request information about our services;
- information relating to our business relationship with you or your organisation;
- information contained in correspondence, enquiries, proposals, contracts, invoices and other business records;
- information relating to your use of our website, including technical information such as your IP address, browser type, operating system and information about how you use the website;
- information relating to marketing preferences and subscriptions; and
- other information that you voluntarily provide to us or that we reasonably require in order to provide our services.
Where we provide procurement consulting services, we may also process information contained in contracts, invoices, supplier records, spend data and other business information supplied by or on behalf of our clients.
Such information may, in some circumstances, include personal information or confidential or privileged information. Where we process such information on behalf of a client, we will process it in accordance with the client’s instructions and the applicable contractual and legal requirements.
Information We Receive From Other Sources
We may receive personal information from sources other than the individual concerned, including:
- our clients and their employees or representatives;
- suppliers and other business contacts;
- publicly available sources, including company websites and professional networking platforms;
- service providers and business partners; and
- other organisations where this is lawful and appropriate.
Where we obtain personal information from another source, we will handle it in accordance with applicable data protection law and provide the required privacy information where applicable.
How We Use Personal Information
We may use personal information for the following purposes:
- providing procurement consulting and related services;
- managing our relationship with clients, suppliers and business contacts;
- responding to enquiries and requests;
- preparing proposals, contracts, invoices and other business documentation;
- administering and improving our website and services;
- communicating with you about our services;
- managing meetings, training, conferences and other business events;
- maintaining the security of our systems and website;
- detecting, preventing and investigating fraud, misuse or unauthorised access;
- complying with our legal and regulatory obligations;
- establishing, exercising or defending legal claims; and
- conducting business development and direct marketing where permitted by applicable law.
Lawful Bases For Processing
Under UK data protection law, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on one or more of the following lawful bases:
Contract – where processing is necessary to enter into or perform a contract with you or your organisation.
Legal obligation – where processing is necessary for us to comply with a legal or regulatory obligation.
Legitimate interests – where processing is necessary for our legitimate business interests, or those of a third party, provided that those interests are not overridden by your rights and interests.
Consent – where we ask for your consent to process your personal information for a particular purpose.
Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Direct Marketing
We may use business contact information to provide information about our services, subject to applicable data protection and electronic marketing laws.
Where required, we will obtain appropriate consent before sending electronic marketing communications. Where consent is not legally required, we may rely on another lawful basis, such as legitimate interests, where appropriate.
You can object to direct marketing or unsubscribe from marketing communications at any time by contacting us or using the unsubscribe facility provided in the relevant communication.
We will respect requests not to receive direct marketing and maintain appropriate records to ensure that marketing preferences are respected.
Sharing Personal Information
We do not sell or rent personal information.
We may share personal information where necessary and lawful with:
- our clients and their authorised representatives;
- professional advisers;
- IT, hosting, communications and other service providers who support our business;
- suppliers and other business partners where necessary to provide our services;
- regulators, government authorities, courts or law enforcement bodies where required or permitted by law; and
- parties involved in a business transaction, such as a merger, acquisition, restructuring or sale of part of our business.
Where we use third-party service providers to process personal information on our behalf, we will take appropriate steps to ensure that they process the information in accordance with applicable data protection requirements.
International Transfers
Because we work with clients and service providers internationally, personal information may in some circumstances be transferred outside the United Kingdom.
Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place as required by applicable data protection legislation.
Confidential and Privileged Information
In providing procurement consulting services, we may receive confidential business information and, where applicable, information that is subject to legal professional privilege.
Where we process such information on behalf of a client, we will handle it in accordance with our contractual obligations, the client’s instructions and applicable law.
Nothing in this Privacy Policy is intended to waive or otherwise affect any applicable legal privilege or confidentiality obligation.
Data Security
We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.
However, no method of transmitting or storing information electronically is completely secure. We cannot guarantee absolute security of information transmitted over the internet.
Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide services, maintain business and financial records, comply with legal and regulatory obligations, resolve disputes and establish, exercise or defend legal claims.
The length of time information is retained will depend on the nature of the information and the purpose for which it is processed.
When personal information is no longer required, we will take reasonable steps to securely delete or otherwise dispose of it, subject to any legal or regulatory requirements requiring us to retain it for longer.
Cookies and Website Information
Our website may use cookies and similar technologies to enable the website to function, improve its performance and understand how visitors use the website.
Where required by law, we will obtain appropriate consent before using non-essential cookies or similar technologies.
You can manage cookie preferences through your browser and, where available, through our website’s cookie settings.
Third Party Websites and Social Media
Our website may contain links to third-party websites or services. We are not responsible for the privacy practices, security or content of third-party websites.
We may maintain profiles or pages on professional and social media platforms, including LinkedIn and X. If you interact with us through these platforms, the relevant platform’s own privacy policy will also apply.
Video and Audio Conferencing
We use third-party video and audio conferencing platforms, which may include Microsoft Teams, Zoom, Google Meet and Webex.
Where meetings, training events or conferences are recorded, we will provide appropriate information about the recording where required. Recordings may be stored or processed by the relevant third-party service provider in accordance with its own terms and privacy policy.
Children’s Privacy
Our website and services are intended for businesses and professional users and are not directed towards children.
We do not knowingly collect personal information from children through our website.
Your Data Protection Rights
Subject to certain legal exceptions, you may have the following rights under UK data protection law:
- the right to be informed about how your personal information is used;
- the right to access the personal information we hold about you;
- the right to request correction of inaccurate or incomplete information;
- the right to request erasure of your personal information in certain circumstances;
- the right to request restriction of processing in certain circumstances;
- the right to object to certain processing, including direct marketing;
- the right to withdraw consent where we rely on consent; and
- the right to data portability in certain circumstances.
You can exercise your rights by contacting us at mahwash.ali@tmhpllp.com.
We may need to verify your identity before responding to a request.
Complaints
If you have concerns about how we have handled your personal information, please contact us first at:
You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).
Information about making a complaint is available from the ICO’s website.
Changes to the Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or how we process personal information.
The latest version will be published on this page and will include the date on which it was last updated.
Contact Information
If you have any questions about this Privacy Policy, our use of your personal information, or your data protection rights, please contact:
TMH Procurement LLP
Email: mahwash.ali@tmhpllp.com
By using our website or services, you acknowledge that you have read and understood this Privacy Policy.