Privacy notice.

Who we are

Tribus Advisory Limited ("Tribus", "we", "us") provides leadership assessment and Management Due Diligence to private equity investors and their portfolio companies, and hosts assessment insight on the Leadership Insight Platform.

Company

Tribus Advisory Limited, registered in England and Wales, company number 16774192

Registered office

Darts Farm, Clyst St George, EX3 0QH

ICO registration

ZC123303

Contact

David Chamberlain, DC@tribusadvisory.co.uk, or Jeremy Lowen, JL@tribusadvisory.co.uk

For most of the personal information described here, we are the controller. When a client uses assessment insight within its own organisation, that client is also a controller for its own use.

Who this notice covers

• People who visit this website or contact us with an enquiry.
• Representatives of our clients, including authorised users of the Leadership Insight Platform.
• Leaders who take part in an assessment, a 100-Day Review or a later review ("participants").
• Referees and other people who provide input to an assessment, such as Chairs and investors completing a survey.

Information we collect

Enquiries

Your name, organisation, work email address, the type of enquiry you choose and anything you tell us in your message.

Client representatives

Name, role, organisation and contact details, and for platform users, account details, sign-in records, which report sections they open and when, and the questions they ask the platform's AI assistant with its answers.

Participants

Name, role, employer and career history; interview notes; psychometric questionnaire responses and results; referee and survey input; assessor ratings, written commentary, development areas and recommendations; and, where provided, a profile photograph.

Referees and survey respondents

Name, role, organisation, relationship to the participant, and the views and ratings you give.

We do not routinely seek or assess special category personal data, including health information. Where this is voluntarily disclosed during an interview, we only record or process it where necessary for a clearly identified and lawful purpose. Access is restricted, and unnecessary sensitive information is excluded from assessment reports.

Psychometric information

Participants may complete psychometric questionnaires, such as Hogan assessments, as part of an assessment. Results are interpreted by Tribus assessors alongside the other evidence and are never used on their own to decide a participant's suitability.

Psychological Consultancy Limited (PCL) acts as our data processor, with Hogan Assessment Systems as its sub-processor. Tribus Advisory remains the data controller. Assessment responses and results are processed through Hogan's online platform, including transfers to the United States under appropriate data protection safeguards. Under our agreement with PCL, participant data is anonymised after 12 months unless an alternative period is agreed. We retain our copies of reports under the retention arrangements below.

Assessment findings are provided to our clients. Individual participant feedback sessions are not included as standard but may be arranged as an additional paid service. Participants retain their rights to access their personal data.

Where it comes from

Most information comes from you directly. Participant information also comes from the client who commissions the assessment (usually the investor), from the psychometric questionnaires participants complete, from referees and survey respondents, and from company documents the client shares with us.

How we use it and why

Responding to enquiries

Our legitimate interest in replying to you and discussing how we can help.

Delivering our services

Performing our contract with the client, and our and the client's legitimate interest in making well-informed investment, leadership and development decisions.

Assessing participants

The legitimate interests of the client and Tribus in understanding whether a leadership team can deliver an investment plan. Before participating, individuals are told the purpose of the assessment, what information is collected, how it will be used, who may receive the findings and how their personal information will be handled.

Hosting insight on the platform

Our and the client's legitimate interest in using existing assessment insight more effectively, under the terms of our client agreements.

Improving our methods

Subject to appropriate contractual permissions, we may use anonymised and aggregated assessment insights for benchmarking, research and improving our assessment methods. This information will not identify individual participants, clients or transactions.

Legal and regulatory duties

Where we need to comply with the law or establish, exercise or defend legal claims.

AI and automated decisions

The Leadership Insight Platform includes Ask the Report, an AI assistant that answers authorised users' questions about a report. Its answers are generated automatically from that engagement's report and are not checked by Tribus before they are shown, and the platform tells users they may contain errors. AI supports the analysis only. We do not make decisions about anyone based solely on automated processing, and every assessment conclusion and recommendation in a report is made and reviewed by an experienced Tribus assessor.

To answer a question, the platform sends the question, the recent conversation and the relevant report content, which can include participants' names, roles, ratings and assessment commentary and referees' names and comments, through Vercel's AI Gateway to OpenAI, or to Anthropic if OpenAI is unavailable. Requests go only to providers with zero-data-retention agreements that do not train their models on the information. Each user's questions and answers are saved for 90 days. Each question and answer expires 90 days after it is saved, even if the conversation continues. Expired content is no longer available in the platform or sent as AI conversation history, and is removed from the live database by an hourly cleanup. Users can clear their conversations earlier at any time. Saved conversations are available only to the relevant authorised user. Underlying assessment data and reports follow the separate platform retention arrangements below. Backup copies expire on their normal cycle.

Who we share it with

• The client who commissioned the work, and authorised users the client names in writing. Participants' individual results are shared only with them, with the participant where feedback forms part of the engagement, and with Tribus personnel who need them.
• Our service providers, who act only on our instructions: Kyln Digital Ltd (platform development and support), Vercel (hosting, image storage and AI gateway), Neon (database and sign-in), OpenAI and Anthropic (AI model providers), Resend (email delivery), Sentry (error monitoring) and GitHub (code hosting). We also use PCL and Hogan for psychometric assessments, and Microsoft 365, including Outlook and SharePoint, for business communications, document management and secure storage of assessment materials.
• Professional advisers, regulators or law enforcement, where we are required or permitted to by law.

We never sell personal information or share identifiable client assessment information with another client.

Where it is stored

The Leadership Insight Platform runs, and stores assessment data, in the United Kingdom, in London. Some of our service providers process information outside the UK: Ask the Report sends questions and report content to OpenAI and Anthropic in the United States, Sentry stores error reports in the European Union (Germany), and Resend delivers our emails, including sign-in codes and survey invitations, from the European Union (Ireland). Hogan also processes psychometric responses and results in the United States, as described above.

Transfers to the European Union are covered by the UK's adequacy regulations. For the United States we rely on the safeguards in each provider's data processing terms: the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

How long we keep it

Enquiries

Enquiry emails and business correspondence are retained for as long as reasonably necessary to manage business relationships and maintain appropriate records. We review them periodically and delete them when no longer required.

Platform data

For the duration of the client's platform subscription, then securely deleted from the live platform within 30 days of termination, with backup copies expiring on their normal cycle.

Removal on request

A client can ask us to remove an individual participant's data from the platform, and we will do so within 30 days unless we must keep it for legal reasons.

Reports and working files

PDF reports, interview notes and psychometric results held outside the platform are kept securely for three years after the engagement ends. Where ongoing client services or platform access require continued use, we keep them for the duration of those services and three years thereafter. Records may be kept longer where required by law or to establish, exercise or defend legal claims. They are securely deleted or anonymised when no longer required.

How we protect it

Information is encrypted in transit and at rest, and access is limited to named, authenticated users. The platform records each client user's sign-ins and the report sections they open, and keeps an audit trail of the changes Tribus staff make to reports and access. Relevant Tribus consultants can see client users' report access and engagement records for security, audit, service support and understanding how clients use the assessment insights. If a personal data breach affects your information and is likely to put your rights at risk, we will act quickly and notify the Information Commissioner's Office and those affected where required. Full detail is in our data and security policy.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to ask for it to be transferred. Where we rely on your consent, you can withdraw it at any time. Some rights are limited where information is held on behalf of a client or where we must keep it for legal reasons, but we will always explain our decision.

To make a request, email DC@tribusadvisory.co.uk or JL@tribusadvisory.co.uk. We will respond within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, although we would welcome the chance to put things right first.

Cookies

Where enabled, this public website offers two optional tools. Google Analytics measures visits, pages viewed and successful enquiries. Leadfeeder uses IP addresses and browsing activity to help identify visiting organisations and their interest in our services. A company match does not reliably identify an individual. We load each tool only after you accept its separate option in Cookie preferences. Rejecting both does not affect your use of the website. We do not install these tools in the client portal.

We rely on your consent for this optional tracking. You can withdraw it using Cookie preferences in the footer. Withdrawal stops future collection; you can contact us about previously collected information. Your browser stores your choice for six months. Google and Leadfeeder may use their own cookies and process technical visit data, including outside the UK, under their applicable data protection terms. We do not send enquiry names, email addresses or message contents as analytics events. See how Google uses information from partner sites and Leadfeeder’s privacy notice for further details.

Our fonts and film are served from this site. When you send an enquiry, we use your IP address, in memory and for up to ten minutes, to stop repeated submissions. It is not stored.

The Leadership Insight Platform sets only the cookies it needs to sign you in and keep you signed in, and for Tribus staff one that remembers whether the admin menu is open. Your browser keeps your light or dark setting and the width of the Ask the Report panel. To find and fix faults, Sentry receives technical error reports to help diagnose faults. Session replay is disabled.

Changes and contact

We will update this notice when our practices change and show the date of the latest version at the top. Questions about this notice can be sent to David Chamberlain (DC@tribusadvisory.co.uk) or Jeremy Lowen (JL@tribusadvisory.co.uk).