Your information, explained
Privacy policy
We use your information to run the Institute, support members and help people find professional investigators. You can ask us to remove your information when you no longer want an account or a place in the directory.
Last updated: 8 November 2026. This notice covers the IPI website, membership administration and directory. It reflects the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, including amendments in force under the Data (Use and Access) Act 2025.
Make a privacy request Read about cookies
Who is responsible?
The Institute of Professional Investigators Limited (IPI) is the controller of the personal information described here. Contact the IPI administration team at admin@ipi.org.uk, telephone 01707 371144, or write to IPI, 27 Pelham Road, Beckenham, England, BR3 4SQ.
What we collect and why
- Accounts and membership: your name, contact details, account credentials, membership status, qualifications, experience, applications and relevant supporting documents. We use these to assess applications and provide and administer membership, taking steps towards or performing our agreement with you. We also have a legitimate interest in checking eligibility and maintaining professional standards.
- Directory profiles: names, business contact details, services, locations, photographs, logos and descriptions supplied for publication. We use these to provide the agreed listing service. Published information can be seen and copied by anyone. Details about another person should be supplied only with proper authority.
- Enquiries, reviews and reports: the contact details and information you provide, together with relevant correspondence. We use these to respond, send an enquiry to its intended recipient, moderate reviews and investigate reports. Our legitimate interests are providing a useful directory, preventing misuse and resolving concerns. Approved reviews and reviewer display names may be public; private enquiry and report details are not public reviews.
- Orders and renewals: order details, billing information, payment status and related correspondence. We need these to fulfil orders and administer renewals, and to meet applicable accounting and tax obligations. Online card details are not collected by our own website. If an external payment service is offered, its payment screen and privacy information apply.
- Website security and operation: session identifiers, IP addresses, browser information, sign-in attempts, activity records and spam-check results. We use these to protect accounts and forms, operate the website and investigate faults or abuse. Our legitimate interests are maintaining a secure, reliable service; we also have legal duties to protect personal data.
- Optional website analytics: if you allow analytics, we use pseudonymous browser and visit identifiers, the public pages viewed, UK calendar dates and the referring website’s domain to understand and improve the site. Consent is our basis for this optional processing. We do not send this information to an external analytics provider, join it to your account or use it for advertising. Admin and editor browsing and recognised bots are excluded.
- Privacy requests and complaints: your contact details, request, correspondence and a record of the action taken. We use these to meet our data-protection duties and demonstrate how we handled the matter.
We receive information directly from you, from authorised listing owners or representatives, and from our existing membership and website records. Where necessary, we may verify professional information with a referee, qualification provider or relevant public source. We will explain any additional collection when it is needed.
Please do not put confidential case material, identity documents, health information or information about offences into ordinary enquiries or reviews. Where a membership check requires sensitive or criminal-record information, IPI must identify the additional legal condition, explain the purpose and collect only what is necessary. A general privacy notice is not consent to unrestricted use of that information.
Required form fields identify information we need to process that request. Without it, we may be unable to provide the service. Where we specifically ask for consent, it is optional and can be withdrawn by contacting us; withdrawal does not affect earlier lawful processing. Using the website is not blanket consent to unrelated processing or marketing.
Who can receive your information?
Authorised IPI administrators and relevant staff can access information needed for their work. Our hosting, email and other contracted service providers may process it to supply their services. Directory enquiries are shared with the investigator you contact. Published profiles and approved reviews are public. We may disclose necessary information to professional advisers, regulators or public authorities where legally required or justified to establish, exercise or defend legal claims. We do not sell personal information.
Forms use Google reCAPTCHA to help prevent spam, fraud and abuse. It loads when you interact with a protected form or submit it. Google processes information such as your IP address, browser and device characteristics and interactions for this security purpose on IPI’s behalf. Since 2 April 2026 Google provides reCAPTCHA as a processor under its Cloud terms and data-processing addendum. See Google’s explanation of reCAPTCHA processing and our cookie information. You can contact IPI by email, telephone or post if you cannot use the form.
Some providers, including Google, may process information outside the UK. UK data-protection rules require an appropriate transfer arrangement, such as applicable UK adequacy regulations or approved contractual safeguards, where required. Contact IPI for details of the arrangements and safeguards relevant to your information. Browsing this website does not authorise an otherwise unlawful transfer.
Investigators and external training websites are responsible for their own services and privacy practices. This notice does not cover information you give them independently.
How long we keep information
Accounts and listings: our normal approach is to keep the information needed for your account, membership and listing while you want to remain with IPI or appear on the website. You can request removal at any time. We also review information for continued relevance rather than treating an unused account as permission to retain everything indefinitely.
Deletion requests: IPI will complete eligible deletion requests within 30 days of receipt, or within one calendar month where that is sooner. We may need proportionate identity checks or clarification. If the law allows an extension or requires us to retain some information, we will explain this, the reason and the next steps within the original response period. Requests are handled by the IPI team; sending a form does not automatically erase an account.
Necessary exceptions: limited records may still be needed for statutory accounting and tax requirements, an unresolved complaint, a legal claim or another applicable legal obligation. We restrict such records to that purpose, assess the appropriate retention period and explain any exception relevant to your request. Closing an account does not automatically cancel a debt, order or legal obligation.
Other records: applications, enquiries and correspondence are retained only while needed to deal with the matter and any relevant follow-up, legal obligation or dispute. Public reviews remain while relevant and lawful; requests about them are assessed individually, including the rights of other people. Security records are retained only as needed to protect and investigate the service. A minimal record of a privacy request and its outcome may be retained to demonstrate compliance and prevent deleted information being restored.
Backups and historical copies: removal covers relevant live and historical working records. Data awaiting removal from a protected backup must be kept out of ordinary use until that backup is replaced or securely disposed of. If a backup is restored, applicable deletions must be reapplied before the data returns to use. We will explain any remaining backup copy and its disposal arrangements when handling your request; we do not promise that every archived copy disappears instantly.
Your choices and rights
Depending on the circumstances, you can ask for access to your information, correction, deletion, restriction of processing or a portable copy. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent where we rely on it. These rights can have legal exceptions, which we will explain if they apply.
Use our privacy request form, email admin@ipi.org.uk, telephone or write to us. You do not need an account or a particular form of words. Requests are normally free. We respond without undue delay and within the applicable statutory period; our normal target is the earlier of 30 days and one calendar month.
If you have a complaint
Choose “Make a data protection complaint” on the form, or use the contact details above. We will acknowledge a complaint within 30 days, investigate it, keep you informed and provide an outcome without undue delay. The acknowledgement deadline is not a promise that every investigation will be completed in 30 days.
You can also complain to the UK data-protection regulator through the ICO complaints service. You do not lose that right by contacting IPI first.
Security, service decisions and updates
We use access controls, encrypted private submissions, protected passwords and other safeguards appropriate to the information. No online service can guarantee absolute security. Spam checks can reject a submission automatically; contact IPI for help if that happens. Membership and privacy requests are reviewed by people, and the site does not make solely automated decisions with legal or similarly significant effects about you.
Optional analytics records are retained for the current calendar month and the previous 12 months, then removed during regular website use. Visitor identifiers are pseudonymous; an IP address, full browser user-agent, account ID, form contents, query strings and full referring URLs are not stored in the analytics tables. Only public page paths and referral domains are recorded. Signed-in administrators and content editors, private account and payment pages, members-only pages and privacy requests are excluded.
You can withdraw permission at any time by choosing “Essential only” on our cookie settings page. This stops collection, removes the analytics cookies and deletes analytics records linked to the current browser identifier. Already anonymous historical directory totals can remain. If a cookie has already been removed, we may no longer be able to associate older pseudonymous statistics with your browser. The retention limit and protected-backup arrangements still apply. Consent is optional; refusal does not prevent using the website.
We will revise this notice when our use of information changes and draw significant changes to your attention where appropriate. The date at the top identifies this version.