Privacy Policy

What we collect

When you submit an enquiry form, we collect your name, email address, and anything else you choose to give us: company, role, a message, and, on The Forge, the initiatives you have selected.

When you complete The Scorecard, we collect your answers to the twenty questions, together with the name, email and any organisation and role you give us at the end. Your answers are only sent to us at that point - if you do not fill in that form, nothing about your assessment reaches us.

The Forge demo tools (financial, resourcing and benefits) run entirely in your browser. A file you load into a demo is parsed and analysed on your own device: it is not uploaded, stored or transmitted to us or to anyone else, and it is discarded when you leave the page. If you ask for a briefing from a demo, we collect your name, email address and any organisation and role you give us, together with derived aggregate figures only - counts, totals and scores. Where the figures come from your own file, identifying labels are replaced with positional ones (such as "Project 3 of 8") before anything is sent, so the contents of your file never reach us.

When you book a call through the site, Cal.com collects the scheduling details you provide - see their privacy policy for how they handle it. We only see the booking once it is confirmed.

Separately from this site, we collect business contact details - a name, a role and a work email address - for people at organisations we think we can help, from public sources. Section 03 explains where we get them and what we do with them.

We do not require an account and do not ask for payment details on this site.

How we use it

Enquiry details are used to respond to you: to answer the question you asked, or to follow up on the initiatives you expressed interest in. We may follow up again about that same enquiry. We do not add you to a mailing list, and we do not sell or rent your details to anyone. Section 03 sets out exactly what we will and will not send you.

Scorecard details are used to produce and send you the report you asked for, and so that any follow-up conversation can start from what you actually told us. Completing the scorecard does not subscribe you to anything. We may follow up about your result; we will not use your details to send you anything else. Section 03 sets out the limits.

IP addresses are used briefly to rate-limit form submissions and reduce spam. This is a short-lived technical control, not a profile of you.

Direct marketing

We treat two situations differently, and it is worth being plain about both.

If you contacted us - through an enquiry form, or by completing the Scorecard - we may follow up about that specific thing: the question you asked, the initiatives you selected, or the result you were sent. We will not put you on a mailing list, send you a newsletter, or contact you about anything unrelated. If you tell us you would rather we did not follow up, that is the end of it, permanently, and you do not have to give a reason.

We also approach organisations directly. Where we do, we obtain business contact details from public sources: the organisation's own website, public professional profiles, and public job advertisements. We contact business addresses at incorporated organisations - limited companies and limited liability partnerships - and not sole traders, ordinary partnerships or personal addresses. Every message we send identifies Orama Portfolio Management, states where we obtained your details, and carries a working unsubscribe.

Our lawful basis for that outreach is legitimate interests: we have a commercial interest in reaching organisations we are qualified to help, and we have weighed that against your interests and rights in a Legitimate Interests Assessment which we keep on file and will provide on request.

You have an absolute right to object to direct marketing. Tell us to stop, and we must, with no reason needed and no questions asked. When you do, we add your address to a suppression list. That list exists only so that we do not contact you again, we keep it for that purpose alone, and it is the one record we deliberately retain rather than delete.

Where it goes

There is no database of people behind this site. Enquiry and scorecard submissions, and briefing requests from the Forge demo tools, are sent as an email via Resend, our transactional email provider, to our inbox. For the scorecard and the demo briefings we also send a copy to you. Those emails are the only record we keep that is tied to you.

We do separately keep an anonymised copy of scorecard answers, so that we can eventually publish a benchmark of how PMOs score. That record holds the answers, the scores and the date, and no name, email address, organisation, role or IP address - the part of our code that writes it is not given your details in the first place, so they cannot be attached to it. Where a day carries very few responses, we accept that separation is weaker in principle than it is in practice.

Rate limiting is handled by Upstash, which briefly holds a hashed record of recent submitting IP addresses to enforce a short cooldown window. If Upstash is unavailable, the same check runs in memory on our hosting infrastructure instead and is discarded on restart.

Cal.com processes booking details directly as an independent controller once you use the scheduler.

We do not share your enquiry with any other third party.

Analytics

We use Vercel Analytics to understand which pages are visited and roughly how much traffic the site gets. It is cookieless and does not track you individually across sites - it reports aggregate counts, not a profile tied to your identity.

We do not run advertising pixels, retargeting tags, or third-party trackers on this site.

How long we keep it

Enquiry and scorecard emails are retained in our mailbox for as long as is reasonably needed to progress the conversation, and are deleted when no longer relevant, in line with our normal mailbox housekeeping. Rate-limit records expire automatically after a matter of minutes.

Anonymised scorecard answers are kept indefinitely, because their only purpose is long-run benchmarking. They carry nothing that identifies you, so there is nothing in them to delete on request - but if you would rather we did not keep even that, tell us when you complete it and we will remove the entry.

Business contact details we have sourced but not yet used are reviewed periodically and deleted when they are no longer accurate or no longer relevant. Suppression-list entries are the exception and are kept indefinitely, because deleting them is what would let us contact you again by mistake.

Your rights

Under UK GDPR you can ask us to confirm what personal data we hold about you, correct it, or delete it. Because the only records tied to you are the emails you sent us and the report we sent back, most requests are resolved by us deleting those emails on request.

You can object to direct marketing at any time, and that right is absolute: we have to stop, we do not get to weigh it against anything, and you do not have to explain. You can also object to any other processing we carry out on the basis of legitimate interests, and ask for a copy of the assessment behind it.

To exercise any of these rights, email contactus@oramapm.com. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) if you think we have handled your data incorrectly.

Changes to this policy

If how we handle data changes, we will update this page and move the date at the top. We will not reduce your rights under this policy without telling you.