Privacy Policy

What we collect

When you submit an enquiry form, we collect your name, email address, and anything else you choose to give us: company, role, a message, and, on The Forge, the initiatives you have selected.

When you complete The Scorecard, we collect your answers to the twenty questions, together with the name, email and any organisation and role you give us at the end. Your answers are only sent to us at that point - if you do not fill in that form, nothing about your assessment reaches us.

When you book a call through the site, Cal.com collects the scheduling details you provide - see their privacy policy for how they handle it. We only see the booking once it is confirmed.

We do not require an account and do not ask for payment details on this site.

How we use it

Enquiry details are used solely to respond to you: to answer the question you asked, or to follow up on the initiatives you expressed interest in. We do not use them for marketing you have not asked for, and we do not sell or rent them to anyone.

Scorecard details are used to produce and send you the report you asked for, and so that any follow-up conversation can start from what you actually told us. We do not use them for marketing you have not asked for, and completing the scorecard does not subscribe you to anything.

IP addresses are used briefly to rate-limit form submissions and reduce spam. This is a short-lived technical control, not a profile of you.

Where it goes

There is no database of people behind this site. Enquiry and scorecard submissions are sent as an email via Resend, our transactional email provider, to our inbox. For the scorecard we also send a copy of the report to you. Those emails are the only record we keep that is tied to you.

We do separately keep an anonymised copy of scorecard answers, so that we can eventually publish a benchmark of how PMOs score. That record holds the answers, the scores and the date, and no name, email address, organisation, role or IP address - the part of our code that writes it is not given your details in the first place, so they cannot be attached to it. Where a day carries very few responses, we accept that separation is weaker in principle than it is in practice.

Rate limiting is handled by Upstash, which briefly holds a hashed record of recent submitting IP addresses to enforce a short cooldown window. If Upstash is unavailable, the same check runs in memory on our hosting infrastructure instead and is discarded on restart.

Cal.com processes booking details directly as an independent controller once you use the scheduler.

We do not share your enquiry with any other third party.

Analytics

We use Vercel Analytics to understand which pages are visited and roughly how much traffic the site gets. It is cookieless and does not track you individually across sites - it reports aggregate counts, not a profile tied to your identity.

We do not run advertising pixels, retargeting tags, or third-party trackers on this site.

How long we keep it

Enquiry and scorecard emails are retained in our mailbox for as long as is reasonably needed to progress the conversation, and are deleted when no longer relevant, in line with our normal mailbox housekeeping. Rate-limit records expire automatically after a matter of minutes.

Anonymised scorecard answers are kept indefinitely, because their only purpose is long-run benchmarking. They carry nothing that identifies you, so there is nothing in them to delete on request - but if you would rather we did not keep even that, tell us when you complete it and we will remove the entry.

Your rights

Under UK GDPR you can ask us to confirm what personal data we hold about you, correct it, or delete it. Because the only records tied to you are the emails you sent us and the report we sent back, most requests are resolved by us deleting those emails on request.

To exercise any of these rights, email contactus@oramapm.com. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) if you think we have handled your data incorrectly.

Changes to this policy

If how we handle data changes, we will update this page and move the date at the top. We will not reduce your rights under this policy without telling you.