1 – Data controller
The data controller for personal data collected through the GARPI™ 2026 benchmark is Optimal Group of Companies ("Optimal"), registered in Scotland, operating globally with offices in Aberdeen, UK and Midrand, South Africa.
For all data protection enquiries contact: data@optimal.world
2 – What data we collect and why
| Data element | Purpose | Legal basis (UK GDPR) |
|---|
| Name |
Personalise and issue the requested benchmark report |
Consent (Art. 6(1)(a)) |
| Email address |
Verify benchmark access, identify incomplete sessions, save progress and deliver a requested report |
Legitimate interests (Art. 6(1)(f)); Consent for the optional reminder and report |
| Organisation name |
Administer resumable access, identify the requested internal report and support appropriate peer context |
Legitimate interests (Art. 6(1)(f)); Consent where report opt-in is given |
| Job title |
Provide role context for the requested report |
Consent (Art. 6(1)(a)) |
| Location and participant message |
Provide geographic context and respond to the participant's request or feedback |
Consent (Art. 6(1)(a)) |
| Sector and sub-sector |
Peer group assignment; sector-level benchmark publication |
Legitimate interests (Art. 6(1)(f)) |
| Respondent and asset regions |
Regional segmentation; geographic benchmark comparisons |
Legitimate interests (Art. 6(1)(f)) |
| Benchmark responses |
Scoring; benchmark dataset construction; published aggregate findings |
Legitimate interests (Art. 6(1)(f)); Consent where report opt-in given |
We do not collect any special category data (health, ethnicity, political opinion, etc.) through this Benchmark.
3 – Anonymisation and published outputs
No individual or organisation is identifiable in any published output. All benchmark reports, sector analyses, and research publications produced from GARPI™ data present aggregated, anonymised findings only. Individual scores are never disclosed to third parties.
Anonymisation is applied before any data is used in published research. The anonymisation process is irreversible – once anonymised, data is no longer considered personal data under UK GDPR and is retained indefinitely as part of the longitudinal dataset.
Your individual responses and personal details remain separate from published outputs at all times.
4 – Data retention
Unverified access requests are deleted after 24 hours. Identity and saved answers for verified but incomplete sessions are removed after 90 days of inactivity. Completed identifiable GARPI™ 2026 data, including contact details, response records, internal report emails and working report files, is retained through 31 December 2030. The cycle closes on 31 December 2027; identifying fields and response references are irreversibly removed or replaced no later than 1 January 2031.
You may request deletion of your personal data at any time by emailing data@optimal.world. We will action confirmed deletion requests within 30 days.
Anonymised Benchmark responses (with all personal identifiers removed) are retained as part of the longitudinal benchmark dataset with no time limit.
5 – Third-party data sharing
We do not sell, rent, or share your personal data with any third party for their own purposes.
Benchmark responses are hosted on infrastructure supplied by Hostinger, which processes them on Optimal's instructions. Internal notification and report emails are relayed through Elementor Email Deliverability. As requested for operational resend and delivery support, its email log includes message content and may retain that content for up to 30 days.
Messages delivered to info@optimal.world are stored in Optimal's Microsoft 365 mailbox. Hostinger, Elementor and Microsoft act as processors for these defined services and may use documented subprocessors and safeguarded international transfers. Optimal remains responsible for the processing purpose, access controls and retention decisions.
No personal data is shared with marketing partners, data brokers, analytics platforms, or any other third party for commercial purposes.
6 – Your rights under UK GDPR
You have the right to: access your personal data; request rectification of inaccurate data; request erasure (right to be forgotten); restrict processing; object to processing based on legitimate interests; and where applicable, request data portability.
To exercise any of these rights, contact data@optimal.world. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
7 – Verified access and separation
A verified work email and organisation are required to enter the production Benchmark so incomplete sessions can be identified and resumed. Name is optional. Access identity is stored separately from scoring answers, is never included in published findings, and is not used for marketing without separate consent.
8 – Cookies and tracking
This page uses no third-party tracking cookies. After email verification, the production Benchmark sets a secure, HttpOnly, SameSite functional cookie so the respondent can resume. Draft answers and progress are stored privately on the server and linked to the encrypted access record; email addresses and access tokens are not kept in browser storage. Verification links and codes expire promptly even where Elementor's operational email-content log retains the message for up to 30 days. Hostinger and its CDN process ordinary technical request logs for security and service operation. A functional counter is maintained server-side to display live participation.
9 – Changes to this notice
This notice was last updated 16 July 2026. Material changes will be communicated to registered participants by email. The current version is always available at optimal.world/garpi/.
