Privacy Policy

Dynamic Image Ltd Trading as Sourcing City, Sourcing City Platinum, Promotional Office, Dynamic Highway, Purple Club, Sourcing City News and Merchandise World

Last updated: September 2026

1. Who we are

Dynamic Image Ltd is the data controller responsible for the personal information described in this policy.

Dynamic Image Ltd The Hub, Fowler Avenue, Farnborough, Hampshire, GU14 7JP, United Kingdom Company registration number: 4595360 VAT registration number: GB 807 3619 28 Registered with the Information Commissioner's Office, registration reference Z8923474

Telephone: 01252 224191 Email: info@sourcingcity.co.uk

We are not required to appoint a statutory Data Protection Officer and have not done so. Privacy enquiries are handled by our management team using the contact details above.

2. What this policy covers

This policy explains how we handle personal information across our services, including:

• the Sourcing City platform at sourcingcity.co.uk and sourcingcity.com, including Sourcing City Platinum
• Promotional Office business management software, including Dynamic Office Lite
• Dynamic Highway data services
• Sourcing City News
• Merchandise World, which we operate jointly with the British Promotional Merchandise Association
• Purple Club
• the distributor websites, skin sites, eco skin sites, web shops and top client sites we build and host
• promotional-images.co.uk, which we use to host and serve product imagery to our platforms and to customer websites
• enquiries, subscriptions, events, advertising and support contact with us by any route

It applies to every website and service we operate, whichever of our brands you arrive through. Where you see a link to this policy on any of our sites, it is the same policy.

Our services are provided to businesses in the promotional merchandise industry. They are not intended for consumers or for personal use.

Some third-party sites carry our branding or connect to our services but are operated by other organisations, including PromoAlliance, which is hosted by ASI.

Those organisations are responsible for their own privacy practices, and this policy does not apply to them.

3. When we are a controller, and when we are a processor

This distinction matters and we want it to be clear.

We act as a controller for the information we hold about our own customers, subscribers, users, suppliers, enquirers, advertisers, event exhibitors and event visitors. Sections 4 onwards of this policy describe that processing.

We act as a processor where our software and hosted websites are used by a distributor or supplier to run their own business. When a distributor uses Promotional Office or Dynamic Office Lite to manage its clients, quotations and orders, or when an end customer buys through a web shop or client site we host for a distributor, that distributor is the controller of its own customer data. We process that information on the distributor's instructions and under our agreement with them.

If you are the customer of one of our distributor or supplier clients and you want to exercise your data protection rights, please contact that company directly.

We will support them in responding.

4. The personal information we collect

We hold business information rather than information about people's private lives. In practice this means company details together with the names, job titles, business email addresses and business telephone numbers of the individuals who work at those companies. Much of it is already published by the businesses themselves. Business contact details that identify an individual are still personal data under UK data protection law, so we treat them accordingly.

The main categories are:

• Identity and contact information. Name, job title, company, business email address, business telephone and mobile number, business postal address.
• Account information. Username, password, subscription and service level, access permissions, account status and history.
• Platform activity. Products viewed, searches, click-throughs to supplier content, enquiries, quotation and sample requests, and general usage of our platforms and software.
• Enquiry and transaction information. Enquiry details, products of interest, correspondence with us, order and subscription records, invoices and payment references.
• Event information. Registration, invitation, attendance, exhibitor and stand information for Merchandise World, and lead capture activity at the event.
• Marketing information. Communication preferences, subscription and unsubscribe status, and email delivery, open and click data.
• Technical information. IP address, device and browser type, and cookie and analytics data, as described in section 14.

We do not seek or knowingly collect special category data, and we do not build profiles of people's personal lives or interests outside their professional role.

5. Where we get it

We collect personal information:

• directly from you, when you register, subscribe, apply for a trial, submit an enquiry, contact us, attend or exhibit at an event, or use our platforms
• from the company you work for, where a colleague sets up your account or adds you as a contact
• from suppliers and distributors who ask us to list their business, products and contact details on our platforms
• from your use of our websites and software, through the activity and technical data described above

We do not buy marketing lists and we do not build our database from purchased or scraped third-party sources.

6. How we use personal information, and our lawful bases

Where we rely on consent, you can withdraw it at any time without affecting anything we did before you withdrew it.

7. Our legitimate interests

We rely on legitimate interests for much of our processing. When we do, we consider whether the processing is necessary, whether it is what people in this industry would reasonably expect, and whether it would be overridden by the rights, interests or freedoms of the individuals concerned. We only proceed where those rights, interests and freedoms are not overridden.

In our assessment:

• Purpose. We operate a business-to-business platform, media and event business serving the promotional merchandise industry. Connecting distributors with suppliers, and keeping industry professionals informed, are the point of what we do.
• Necessity. The processing cannot reasonably be achieved without holding company and business contact information, and without passing enquiry information to the supplier being enquired about.
• Balance. The information is business contact information used in a business context, the communications relate only to the promotional merchandise industry, and the privacy impact is low. Individuals can object at any time, and we act on objections.

You can ask us for more detail on our assessment using the contact details in section 1.

8. Distributor enquiries and supplier data sharing

When a registered distributor uses our platforms to submit a product enquiry, request a quotation or sample, or otherwise express interest in a supplier's products or services, we share relevant information with that supplier so they can respond. This may include company name, contact name, business email address, telephone number, enquiry details, the products of interest and related engagement information.

We also provide suppliers with reporting and analytics on enquiries and engagement relating to their own listings. That reporting can identify individual contacts by name where they have actively clicked through to a supplier's products or content. In other words, a supplier may be told that a named contact at a named distributor engaged with their listing. Reporting is limited to activity relating to that supplier's own products and content. Suppliers do not receive reporting on activity relating to other suppliers.

Suppliers receive this information as independent controllers, and are required to:

• use it only for legitimate business purposes connected to the enquiry or their own listings
• process it in accordance with UK data protection law
• maintain appropriate confidentiality and security
• refrain from using it for unlawful or unrelated marketing

If you would prefer your engagement activity not to be reported to suppliers in this way, contact us and we will discuss the options with you. Note that some sharing is unavoidable if you want a supplier to respond to your enquiry.

We do not sell personal data.

9. Dynamic Highway

Dynamic Highway is our data infrastructure service, moving product, pricing, stock and image data between supplier systems, our platforms and distributor websites and software.

The data flowing through Dynamic Highway is product information. It does not carry customer, order or end consumer personal data. The only personal information we hold in connection with it is the business contact and account information of the supplier and distributor personnel who manage the integrations, together with the technical credentials needed to operate them.

10. Merchandise World and the BPMA

Merchandise World is jointly owned by Dynamic Image Ltd and the British Promotional Merchandise Association.

If you are invited to, register for, attend or exhibit at Merchandise World, we hold your business contact and registration details, and we use them to run the event and to keep you informed about it. Registration and exhibitor management are operated for us using third-party event software, as listed in section 12.

Exhibitors are told which invitees are attending and, where we are aware of it, which are not.

Lead capture. We run exhibitor lead capture at the event using third-party event software provided by VenuIQ. If you consent to your badge being scanned by an exhibitor, your business contact and registration details are shared with that exhibitor, who then holds them as an independent controller and under their own privacy policy. If you do not want an exhibitor to hold your details, do not allow your badge to be scanned.

Sharing with the BPMA. Because Merchandise World is jointly owned, we occasionally share event related information with the BPMA. There is no standing arrangement to transfer our wider customer database to them. Where the BPMA holds your information, its own privacy policy governs how it is managed, and it is available from the BPMA on request.

Other than the sharing described in this section and in section 8, we do not pass identifiable personal data to other organisations for those organisations to use for their own marketing.

11. Marketing communications

We hate spam as much as you do. Our communications are professional, industry-orientated and relevant to the promotional merchandise trade.

Email. We send industry news, product and service information, event information and sponsored or partner content to business contacts in the industry. We rely on legitimate interests, in line with the business-to-business rules in the Privacy and Electronic Communications Regulations. Where a communication is sponsored by or promotes a partner, we send it ourselves from our own systems. Sponsorship does not mean your details have been passed to the sponsor.

Every marketing email carries a clear unsubscribe link, and unsubscribes are actioned promptly.

Telephone. We make targeted business-to-business calls to contacts on our database about our services and about developments relevant to their business.

We do not operate automated or high-volume dialling campaigns. You can ask us to stop calling you at any time and we will record that objection.

Post. We occasionally write to business contacts, principally in connection with events and subscriptions.

Your right to object. You have an absolute right to object to direct marketing of any kind. Unsubscribe from any email, tell the person who calls you, or contact us using the details in section 1. When you object, we keep a minimal suppression record so that we can honour the objection in future. We will not use that record for anything else.

12. Service providers and other recipients

We use trusted third parties to run our business. They act as our processors, working under contract and on our instructions, except where noted otherwise.

The categories are:

• Hosting and cloud infrastructure, including Amazon Web Services in Ireland, which hosts our business management software, and Microsoft Azure
• Email delivery and marketing, including MailChimp
• CRM, quotation and invoicing software, including QuoteWerks
• Website analytics and performance tools
• Live chat and customer support tools
• Payment providers, being NatWest Tyl for card payments and Bottomline Technologies for Direct Debit
• Accounting software and our accountants, for invoicing and financial records
• Event software for Merchandise World, including Reftech for registration, Ffair.io for the exhibitor console, and VenuIQ for exhibitor lead capture
• Software development and support partners, including Promidata B.V., which develops and supports the Promotional Office software
• IT support partners, who are UK based

We also share information where we are legally required to, where it is necessary to establish or defend legal claims, and with our professional advisers. If our business or any part of it is sold or reorganised, information may be shared with the other party and its advisers, subject to appropriate confidentiality protections.

Suppliers receiving enquiry and engagement information under section 8, exhibitors receiving scanned lead data under section 10, and the BPMA, act as independent controllers rather than as our processors.

13. International transfers

Our operations are UK based.

Some of our service providers are established outside the United Kingdom, or host or support their platforms outside it, principally in the European Economic Area and the United States. In particular, the Promotional Office software is hosted in Ireland and is developed and supported by Promidata B.V. in the Netherlands. Our systems are also accessed by a contractor based in the Czech Republic who supports our data integration services, and by personnel of our IT support partner who are located in India.

Where personal information is transferred outside the UK, we make sure an appropriate safeguard is in place. For the European Economic Area we rely on UK adequacy regulations. For countries not covered by adequacy regulations, including India, we rely on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with any additional measures needed. You can ask us for details of the safeguards applying to a particular transfer.

14. Cookies and similar technologies

Our websites use cookies and similar technologies. Rather than list every one here, we group them into categories:

• Strictly necessary. Needed for the site to work, including logging in, session management, security and basic site functions. These do not require your consent.
• Functional. Remember your preferences and settings so the site behaves the way you expect.
• Analytics and performance. Help us understand how our sites are used so we can improve them, and support the site and supplier reporting described in this policy.
• Marketing and tracking. Measure the effectiveness of our campaigns and content, including whether marketing emails are opened and which links are clicked.
• We also use tracking technologies that are not cookies, including tracking pixels in our marketing emails, which tell us whether a message was opened and which links were clicked.

Strictly necessary cookies do not require your consent. All other cookies and similar technologies are blocked from running until you have consented through the cookie banner on our sites, which is managed for us by CookieYes. We keep a record of consent choices for five years. You can change or withdraw your consent at any time using the cookie settings link on the site, and you can also control cookies through your browser settings, although blocking some of them will affect how our sites work.

Our Cookie Policy sets out the individual cookies in use on each of our sites, including who provides them, what they do and how long they last. For general guidance on cookies, see the Information Commissioner's Office at ico.org.uk.

15. Payments

Card payments are processed by NatWest Tyl and Direct Debit payments by Bottomline Technologies. Where a customer pays by recurring card payment, the card details are held securely by our payment provider under their own security standards. We hold payment references and transaction records rather than full card details on our systems.

We keep financial records as required for accounting and tax purposes.

16. How long we keep personal information

We keep personal information for as long as we have a proper reason to, and no longer. We do not keep personal data indefinitely as a matter of course.

We decide how long to keep each category by reference to why we hold it, whether the relationship is live, whether it remains relevant to the industry, and whether we need it for legal, accounting or evidential reasons. In practice:

• Account, subscription and service records are kept while the relationship is live, and for a reasonable period afterwards while a renewal or reactivation is realistically in prospect and while any claim could still arise.
• Financial and accounting records are kept for six years from the end of the financial year to which they relate, as required by law.
• Enquiry, quotation and order records are kept while they remain commercially relevant to the distributor, the supplier and the operation of the platform, and are reviewed periodically.
• Marketing contact records are kept while the contact remains relevant to the promotional merchandise industry and has not objected. We review the database periodically and remove records that are no longer relevant, including contacts who have left the industry or whose details have gone stale.
• Event records are kept for the event concerned and for subsequent event cycles while the invitation remains appropriate.
• Suppression records confirming that someone has objected to marketing are kept for as long as we hold the relevant database, because we need them in order to honour the objection. They are not used for anything else.
• Website analytics and cookie data are kept in line with the retention settings of the tools concerned.

Where information no longer has a purpose, we delete it or anonymise it.

17. Security and data breaches

We use appropriate technical and organisational measures to protect personal information, including access controls, authentication, encryption in transit, and contractual obligations on the providers and partners who work with us.

If a personal data breach occurs, we will assess it and report it to the Information Commissioner's Office where the law requires. Where a breach is likely to result in a high risk to you, we will tell you as soon as we reasonably can, explain what has happened and set out what we have done in response.

18. Your rights

You have the following rights over your personal information:

• Access. Ask for a copy of the personal information we hold about you.
• Rectification. Ask us to correct information that is inaccurate or incomplete.
• Erasure. Ask us to delete your information where we no longer have a good reason to hold it.
• Restriction. Ask us to pause our use of your information in certain circumstances, for example while we check its accuracy.
• Objection. Object to processing based on legitimate interests. Where the objection is to direct marketing, we will always stop.
• Portability. Where processing is based on consent or contract and carried out by automated means, ask for your information in a portable format or ask us to send it to another organisation.
• Withdraw consent. Where we rely on consent, withdraw it at any time.
• Complain. Raise a concern with the Information Commissioner's Office.

To exercise any of these rights, contact us at info@sourcingcity.co.uk, call 01252 224191, or write to the address in section 1. We may need to confirm your identity before we act.

We will respond within one month. If a request is complex or you have made several, we may extend that by up to two further months, and we will tell you if that happens and why.

Some information may need to be retained in order for you to continue using Sourcing City, Promotional Office or our other services, and we will explain if that applies.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

19. Children

Our services are business services for the promotional merchandise trade. They are not directed at children and are not intended for use by them. We do not knowingly collect personal information relating to children. If you believe we hold information about a child, contact us and we will look into it and delete it where appropriate.

20. Changes to this policy

We review this policy from time to time and may update it to reflect changes in our services, our systems or the law. The date at the top shows when it was last updated.

Where a change is material, we will take reasonable steps to bring it to your attention, for example by notice on our websites or by email to registered users.

Continuing to use our services does not, by itself, constitute agreement to a new use of your personal information. Where a new use requires your consent, we will ask for it.

21. Contact us

Dynamic Image Ltd The Hub, Fowler Avenue, Farnborough, Hampshire, GU14 7JP, United Kingdom Telephone: 01252 224191 Email: info@sourcingcity.co.uk

Sourcing City, Sourcing City Platinum, Promotional Office, Dynamic Office Lite, Dynamic Highway, Purple Club, Sourcing City News and Merchandise World are trading names or services of Dynamic Image Ltd. Merchandise World is jointly owned with the British Promotional Merchandise Association.