LM3 ONLINE PRIVACY POLICY
Last updated: 8 September 2026
Impact Measurement Limited ("Impact Measurement", "LM3", "we", "us" or "our") respects your privacy and is committed to protecting personal information.
This Privacy Policy explains how we collect, use, disclose, retain and protect personal information in connection with LM3 Online, our websites and our related products and services.
It also explains how we may use artificial intelligence and other automated analytical technologies in providing and improving our services.
Depending on the circumstances, Impact Measurement Limited may act either as a Controller of personal information or as a Processor acting on behalf of an LM3 client.
1. Who we are
LM3 Online is owned and operated by:
Impact Measurement Limited
Registered Office:
Bramley Orchards
Bromyard
Herefordshire
HR7 4UT
United Kingdom
Company Number: 06870046
General enquiries: office@lm3online.com
Contact: Richard Wilde
Privacy enquiries: privacynotice@lm3online.com
2. Our role in processing personal information
LM3 provides software and analytical services that enable organisations to analyse expenditure, economic impact, social value and related information.
We may process personal information in two different capacities.
Where we are a Controller
We act as a Controller where we determine why and how personal information is processed. This includes information concerning our clients and prospective clients, account administration, billing, website use, customer support and our own business operations.
Where we are a Processor
Where an LM3 client uploads or otherwise supplies personal information to LM3 for processing through the LM3 service, the client will generally be the Controller and LM3 will act as its Processor.
In these circumstances, we process that information on the client's instructions and in accordance with our agreement with the client and applicable Data Protection Laws.
Questions concerning personal information uploaded by an LM3 client may therefore need to be directed initially to that client.
3. Personal information we collect
Depending upon how you interact with us, we may collect:
- your name;
- business address;
- email address;
- telephone number;
- organisation and job information;
- account and login information;
- billing and transaction information;
- correspondence and support requests;
- IP address;
- browser and device information;
- server and application logs;
- information concerning your use of our website and services; and
- other information you choose to provide to us.
LM3 clients may also upload information concerning their suppliers, contractors, employees or other third parties.
The precise information contained within client-uploaded data is determined principally by the relevant client.
4. How we obtain information
We may obtain personal information:
- directly from you;
- from the organisation for which you work;
- when you create or use an LM3 account;
- when you contact us;
- when you use our website or services;
- automatically from our website and systems;
- from LM3 clients;
- from service providers acting on our behalf; and
- from other lawful sources where appropriate.
Where you or your organisation supplies personal information concerning another person, you are responsible for ensuring that you are entitled to provide that information to us and that its use is lawful.
5. How and why we use personal information
We may process personal information to:
- provide and operate LM3 Online and our other services;
- create and administer accounts;
- authenticate users and maintain security;
- process orders, invoices and payments;
- communicate with clients and users;
- provide customer service and technical support;
- perform analysis requested by our clients;
- maintain, troubleshoot and improve our systems;
- detect and prevent fraud, misuse and security incidents;
- maintain appropriate business and accounting records;
- comply with legal and regulatory obligations;
- establish, exercise or defend legal claims;
- understand how our services are used;
- improve the functionality, reliability and usability of our services;
- develop and improve analytical methodologies and models; and
- undertake statistical and comparative analysis.
6. Our lawful bases
Where LM3 acts as a Controller, our lawful basis for processing will depend upon the particular purpose.
We may rely upon:
Contract – where processing is necessary to enter into or perform a contract with you.
Legitimate interests – where processing is necessary for our legitimate business interests or those of another organisation and those interests are not overridden by your rights and interests. These interests may include operating and securing our services, providing customer support, improving our products and services and administering our business.
Legal obligation – where processing is necessary for us to comply with a legal obligation.
Consent – where we have specifically requested and obtained your consent. Where processing is based upon consent, you may withdraw that consent at any time.
Where LM3 acts as a Processor, the LM3 client is responsible for determining the lawful basis applicable to its processing.
7. Client data
Information uploaded to LM3 by or on behalf of a client remains the client's data.
LM3 does not acquire ownership of client-uploaded data.
We process such information as necessary to provide the LM3 service and in accordance with our agreement with the relevant client.
Further information concerning ownership and permitted use of Client Data is contained in our Terms and Conditions.
8. Anonymised and aggregated information
We may create anonymised or aggregated information from data processed through our services.
Our anonymisation processes are intended to prevent information from reasonably being used to identify an individual, an LM3 client or, where appropriate, an identifiable supplier or other organisation.
Once information has been properly anonymised so that it is no longer personal information, we may use it to:
- improve our products and services;
- develop and improve analytical models and methodologies;
- improve data quality and matching techniques;
- develop benchmarks;
- produce comparative statistics;
- identify economic, social and other trends;
- undertake research and analysis;
- develop new products and functionality; and
- train, test, validate and improve analytical and artificial intelligence systems.
We may retain properly anonymised information after the underlying client relationship has ended.
We do not sell identifiable client data or personal information for advertising or marketing purposes.
9. Artificial intelligence and automated technologies
LM3 may use artificial intelligence, machine learning, statistical models and other automated analytical technologies as part of our services.
These technologies may assist us in activities including:
- analysing and classifying data;
- identifying and matching information;
- checking data quality;
- identifying patterns and trends;
- producing analytical outputs;
- developing comparative statistics;
- improving our methodologies and models; and
- improving the functionality and effectiveness of LM3.
Where an AI system processes personal information, we will process that information in accordance with applicable Data Protection Laws and apply appropriate technical and organisational safeguards.
We will not knowingly use identifiable personal information or confidential Client Data to train publicly available third-party general-purpose AI models unless the processing is necessary for a service specifically requested by the relevant client and the appropriate legal and contractual requirements have been satisfied.
We may use properly anonymised information to train, test, validate and improve LM3's own analytical and AI systems.
Where LM3 uses solely automated decision-making concerning an individual which produces legal or similarly significant effects, we will provide the information and safeguards required by applicable Data Protection Laws.
10. Statistical and comparative information
An important function of LM3 is the production of comparative and statistical information.
We may therefore use anonymised and aggregated information to compare performance, establish benchmarks and produce statistics and insights for LM3 clients and for research and service-development purposes.
Information provided externally for these purposes will not identify an individual or LM3 client unless we have lawful authority to make that disclosure.
11. Sharing information
We do not sell personal information to third parties for marketing or advertising purposes.
We may disclose personal information to organisations that help us provide and operate our services, including providers of:
- cloud hosting and infrastructure;
- software and IT services;
- communications;
- payment and accounting services;
- security services;
- professional advice; and
- analytical or AI technology where appropriate.
Where a service provider processes personal information on our behalf, we require appropriate contractual and security safeguards.
We may also disclose information:
- where required by law or a court or regulatory authority;
- to protect our legal rights or those of another person;
- to investigate fraud or security incidents; or
- in connection with a merger, acquisition, financing, restructuring or sale of all or part of our business, subject to appropriate confidentiality safeguards.
12. International transfers
Some of the organisations and technologies used to provide our services may process personal information outside the United Kingdom.
Where personal information is transferred internationally, we will ensure that the transfer complies with applicable Data Protection Laws.
Depending upon the destination and circumstances, this may include reliance upon UK adequacy regulations or the use of appropriate contractual safeguards or another lawful transfer mechanism.
13. Security
We take reasonable and appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Measures may include, where appropriate:
- access controls;
- authentication;
- encryption;
- secure hosting;
- monitoring and logging;
- backups;
- security procedures; and
- restrictions on personnel access.
No internet-connected system can be guaranteed to be completely secure.
Users are responsible for maintaining the confidentiality of their account credentials and should notify us promptly if they suspect unauthorised access.
14. Data breaches
We maintain procedures for responding to suspected Personal Data breaches.
Where a breach occurs, we will investigate it and comply with applicable notification and reporting requirements.
Where LM3 acts as a Processor, we will notify the relevant client without undue delay after becoming aware of a Personal Data breach affecting Personal Data processed on its behalf.
15. Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, accounting, contractual and regulatory requirements.
Different categories of information may therefore have different retention periods.
Certain business and financial records may need to be retained for a number of years after our relationship with a client ends.
Where LM3 processes Personal Data solely on behalf of a client, we will delete or return that information following termination in accordance with our agreement with the client, subject to applicable legal requirements and normal secure backup retention.
Properly anonymised information may be retained for statistical, research, benchmarking, service-development and model-development purposes because it no longer identifies an individual.
16. Your information rights
Depending upon the circumstances and applicable law, you may have the right to:
- be informed about how your Personal Data is processed;
- request access to your Personal Data;
- request correction of inaccurate or incomplete information;
- request deletion of your Personal Data;
- request restriction of processing;
- object to certain processing;
- request transfer of your information where the right to data portability applies;
- withdraw consent where processing is based upon consent; and
- exercise rights relating to certain automated decision-making.
These rights are not absolute and may be subject to legal conditions and exemptions.
If LM3 processes your information solely on behalf of one of our clients, we may refer your request to that client as the relevant Controller.
17. Marketing
We may send information about LM3 products or services where permitted by law.
Where consent is required, we will obtain it before sending marketing communications.
You may opt out of marketing communications at any time using the unsubscribe facility provided or by contacting us.
Service messages concerning an existing account or contract are not marketing communications.
18. Cookies
Our website uses cookies and similar technologies.
Further information about the cookies we use, their purposes and the choices available to you is contained in our Cookie Policy.
19. Links to other websites
Our websites may contain links to third-party websites.
We do not control those websites and are not responsible for their privacy practices. We recommend reviewing the privacy information provided by the operator of any third-party website you visit.
20. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technology, business practices or legal requirements.
We will publish the current version on our website.
Where we intend to introduce a materially different use of Personal Data, we will provide appropriate information before commencing that processing where required by law.
21. Contacting us
Questions about this Privacy Policy or our handling of Personal Data should be sent to:
Impact Measurement Limited
20 Bramley Orchards
Bromyard
Herefordshire
HR7 4UT
United Kingdom
Company Number: 06870046
Email: privacynotice@lm3online.com
General enquiries: office@lm3online.com
22. Complaints
If you are concerned about how we process your Personal Data, please contact us first so that we have an opportunity to investigate your concern.
You also have the right to complain to the UK data protection regulator, the Information Commission.
Information about making a complaint is available from the Information Commissioner's website.
Impact Measurement Limited — Company No. 06870046
Privacy Policy — revised September 2026