Privacy notice

We collect only what you choose to send us through the forms on this website.

• Certification enquiries: your name, company, work email, optional phone number, company size and message.
• Advocate enquiries: your name, role, organisation, organisation type, work email, optional phone number and details of your supply chain.
• Contact messages: your name, email, optional company and phone number, topic and message.
• Initial Exposure Check: your answers and the calculated result. If you ask us to email your results, your email address and, optionally, your company name.
• Concern reports: what happened and, optionally, when, who or what was involved and whether you have reported it elsewhere. Your name, company and contact details only if you give them and do not report anonymously.
• For all forms: the date and time, your browser type, and a one-way scrambled (hashed) version of your IP address used to prevent spam. We do not store your IP address itself.

Searches on the Verify page are not linked to you and are not stored with any personal information.

The public register shows the certified organisation's name, certificate number, scope, validity dates and status. This is business information that certified organisations agree to publish.

Reports are stored in a separate, restricted database table. They are seen only by Portcullis staff who review reports, and are never published.

The email that tells us a report has arrived contains only a reference number, the date and the first 100 characters of the report.

Portcullis is not a law-enforcement body. We may pass information to the police, the National Crime Agency or another authority where the law requires it, or where we believe it is necessary to prevent or detect crime or to protect someone from harm.

• To respond to enquiries and provide information about membership and certification: taking steps at your request before a contract, and our legitimate interest in responding to business enquiries.
• To send you your Initial Exposure Check results and follow up if you asked us to: your consent, which you can withdraw at any time.
• To review concern reports: our legitimate interest in preventing crime in the freight industry and, where a report concerns criminal offences, the substantial public interest in preventing or detecting unlawful acts.
• To keep the website secure and prevent abuse: our legitimate interest in protecting our service.

Your information is used only by Portcullis. We use these service providers, which process data on our instructions:

• Supabase: secure database hosting, in London.
• Vercel: website hosting.
• Resend: sending emails.

Form data is stored in the UK. Some providers are based in the United States and emails may pass through their systems. Where that happens we rely on the UK International Data Transfer Addendum or the UK-US data bridge.

• Enquiries and contact messages that do not lead to membership: up to 2 years from your last contact with us.
• Initial Exposure Check results: up to 2 years. Results without an email address contain no personal information beyond the hashed IP.
• Members' information: for the duration of membership and 6 years after.
• Concern reports: up to 6 years, unless you ask us to delete a report sooner and we have no legal reason to keep it.

You can ask for a copy of your information, and ask us to correct it, delete it, restrict or object to its use, or move it to another organisation.

To make a request, including deleting a concern report, email info@cargoportcullis.com. For a report, include its reference number (for example PCR-4F7K2). We will reply within one month.

You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.