Privacy Policy

Last updated: September 5, 2026

ERP Research ("we," "us," or "our") operates the website www.erpresearch.com (the "Site"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and your rights regarding that data.

1. Information We Collect

1.1 Information you provide

When you use any form, gate or interactive tool on the Site — including contact forms, demo requests, newsletter sign-ups, pricing quote and cost-estimate forms, the TCO calculator, the ERP fit and readiness assessments, comparison-tool gates, resource download gates, partner-match and partner-contact forms, the requirements wizard, the review wizard, and partner-listing enquiries — we may collect:

• Name
• Email address
• Phone number
• Job title
• Company name, size and industry
• The answers you give the tool — your requirements, module selections, seat counts, budget range, timelines, shortlisted vendors and deployment preferences
• Message or enquiry text, and the text of any review you write

1.2 Information collected automatically

When you visit the Site, we automatically collect:

• Visitor identifier — a randomly generated UUID in the erp_vid cookie. Until you allow analytics cookies this is a session cookie that is deleted when you close your browser and is never joined to your name or to any other visit; only after you allow analytics does it become a 90-day identifier.
• Country-level location — our hosting provider derives your country from your IP address and passes it to us as a request header. We store the country in the erp_geo cookie and against your enquiry. See Section 12 for what happens to the IP address itself.
• Pages visited, referrer URL, and page type — logged to understand how people use the Site.
• A/B experiment assignment — stored in the erp_ab cookie so you see a consistent version of a page. This cookie is only set if you allow analytics; visitors who decline always see the default version.

Our Cookie Policy lists every cookie, script and embed, generated from our source code.

1.3 Information from third parties

When you submit a business email address through a form, we use enrichment providers to fill in professional and company context around your enquiry.

• What we send. Your full email address is sent to our contact-enrichment providers (FullEnrich, with Hunter.io as a fallback). A company-only lookup (People Data Labs) receives just the domain part. We also fetch your company's public website to read its name and description.
• What can come back. Company-level information (name, domain, description, size, industry, headquarters) and person-level information about you — typically your job title, seniority, LinkedIn profile URL, and in some cases a work phone number.
• What we do with it. It is attached to your enquiry and used to route it to relevant implementation partners, to score it (see Section 5B), and to understand which businesses use the Site.

You can ask us what enrichment data we hold about you, and ask us to delete it, at privacy@erpresearch.com.

2. How We Use Your Information

• Respond to enquiries — to reply to contact, demo, quote or partner-match requests you submit.
• Deliver what you asked for — the guide, template, cost estimate, comparison or assessment result you requested.
• Send marketing email — ERP buying guidance, research updates and our newsletter, where you have not opted out (or, if you are in the UK, EEA or Switzerland, where you have opted in). This includes occasional messages from ERP vendors we work with, sent by us on their behalf — we do not pass your address to them for that. Every marketing email has a one-click unsubscribe.
• Process payments — when you purchase benchmark data access or a partner portal listing, via Stripe.
• Improve the Site — to analyse usage patterns, run A/B tests, and fix issues.
• Prevent abuse — to rate-limit form submissions and detect spam and automated traffic.
• Score and route enquiries — see Section 5B.
• Connect you with implementation partners — as described in Section 5A.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, our legal basis depends on the context:

• Consent — for analytics and marketing cookies, for marketing email, and for sharing your details with implementation partners (Section 5A). Our forms ask for these separately, with unticked boxes; you can withdraw any of them at any time, using the unsubscribe link in any email, the "Cookie settings" link in our footer, or by emailing privacy@erpresearch.com.
• Contractual necessity — for processing payments and providing services you have purchased (benchmark access, partner portal listings).
• Legitimate interest — for core Site functionality such as spam prevention, security, and replying to business enquiries.

4. Cookies and Tracking Technologies

Our Cookie Policy lists every cookie, script and embed we use, in what category, and how long each lasts. It is generated from our source code rather than written by hand.

Nothing in the analytics or marketing categories runs before you choose. Google Analytics 4 loads with Google Consent Mode set to denied, with Google Signals and ad personalisation switched off; PostHog is initialised opted out with session replay disabled. If you decline, none of it is activated.

5. Third-Party Services and Sub-Processors

We share personal data with the providers below, who process it on our behalf under contract. This is the complete list; we update it when a provider is added or dropped.

We do not use third-party advertising pixels (for example the Facebook Pixel or the LinkedIn Insight Tag), and we do not share your personal information for cross-context behavioural advertising.

Separately from the processors above, ERP implementation partners who receive your enquiry act as independent controllers — see Section 5A.

5A. Sharing With ERP Implementation Partners

Connecting ERP buyers with implementation partners is a core part of our service, and it is how we keep our research free. When you submit an enquiry that expresses ERP buying interest — a quote or pricing request, a demo request, a partner-match request, a vendor comparison, a requirements wizard session, or a gated resource download — we may share the details you provided (name, business email, phone, company information, and a summary of your requirements) with ERP implementation partners and consultancies listed in our directory, including partners who pay us for introductions to prospective buyers. Those partners may contact you directly about your enquiry.

• Every such form tells you at the point of submission that your details may be shared, and who with.
• If you are in the EEA, UK, or Switzerland, we share your details only if you tick the consent box on the form. On forms whose whole purpose is a partner introduction — a demo, a quote, or a partner match — that box has to be ticked to submit, because we cannot deliver the thing you asked for without passing on your enquiry. Everywhere else it is optional: leave it unticked and you still get the download, comparison or estimate, and your details are not shared. You can withdraw consent at any time by emailing privacy@erpresearch.com.
• If you are a California resident, this sharing may constitute a "sale" of personal information under the CCPA/CPRA and you have the right to opt out — see Section 8 and our Do Not Sell or Share My Personal Information page. If your browser sends a Global Privacy Control signal we treat it as an opt-out automatically.
• Newsletter sign-ups and benchmark access emails are never shared or sold to partners.
• Once a partner receives your details, it processes them as an independent controller under its own privacy policy.

5B. How We Score and Profile Enquiries

We do not simply pass enquiries on untouched. To decide which partners an enquiry is relevant to, and what it is worth, we build a short profile of it. You have a right to know that this happens and what goes into it.

• Lead quality bands. Each enquiry is placed in a band — broadly "standard" or "premium" — from how much you told us (whether we have your requirements, seat count, budget and timeline), how complete the company information is, and whether the address is a work address. Partners pay more for higher bands.
• Automated industry classification. We use an AI model (Anthropic) to sort your company into an industry from its name, domain and public description. Where you have told us your industry yourself, your answer takes precedence over the model.
• Buyer-journey summary. Partners who purchase an enquiry receive a summary of your evaluation — the requirements and modules you selected, the vendors you compared, the resources you downloaded, and roughly where you appear to be in your evaluation. This is shared with the enquiry itself, under the same consent.
• Exclusion rules. Some enquiries are automatically held back from partners entirely — students and academic addresses, competitors and vendor staff, obvious test entries, and anyone who has opted out of sharing.
• No solely-automated decisions with legal effect. None of this produces a decision that has a legal or similarly significant effect on you. It decides which consultancies see a business enquiry you asked us to route. You can ask us for the profile we hold on your enquiry, ask us to correct it, or object to the profiling, at privacy@erpresearch.com.

6. Data Retention

• Form submissions — retained for up to 24 months after submission, then deleted.
• Page view logs — retained for up to 12 months, then deleted.
• Marketplace enquiry records — deleted 90 days after they expire.
• Benchmark access records — retained for the duration of your subscription or purchase, plus 90 days.
• Partner portal profiles — retained until you cancel your subscription and request deletion.
• Cookies — see the Cookie Policy for individual durations.

These periods are enforced by an automated daily job, not only by policy.

7. Your Rights Under GDPR

If you are in the EEA, UK, or Switzerland, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your personal data.
• Right to restrict processing — request that we limit how we use your data.
• Right to data portability — request your data in a machine-readable format.
• Right to object — object to our processing of your data, including for direct marketing and to the profiling in Section 5B.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time, and it is as easy to withdraw as it was to give.

To exercise any of these rights, email privacy@erpresearch.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

8. Your Rights Under CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you additional rights:

• Right to know — request the categories and specific pieces of personal information we have collected about you.
• Right to delete — request deletion of your personal information.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale/sharing — sharing your enquiry details with implementation partners (Section 5A) may constitute a "sale" of personal information. You can opt out at any time via our Do Not Sell or Share My Personal Information page, and we honour Global Privacy Control signals sent by your browser. We do not share your personal information for cross-context behavioural advertising.

To exercise these rights, email privacy@erpresearch.com or use the opt-out page. We will not discriminate against you for exercising your rights.

9. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate — the Location column in Section 5 shows where each one is. When we transfer data outside the EEA or the UK, we rely on Standard Contractual Clauses or other legally approved transfer mechanisms.

10. Children's Privacy

Our Site is intended for business professionals and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

11. Security

We implement technical and organisational measures to protect your data, including HTTPS encryption in transit, secure cookie flags, row-level security on our database, rate limiting on form submissions, and input validation on all API endpoints. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

12. IP Addresses

We do not store your IP address in our database. Our hosting provider (Vercel) necessarily receives it in order to serve you the page, and processes it to derive a two-letter country code, which is what reaches our application. We store that country code — not the address.

Where we need to rate-limit or detect abuse, we store a one-way hash of the address rather than the address itself. Our hosting provider and our error-monitoring provider hold request-level logs under their own retention policies; we have configured error monitoring not to attach IP addresses to reports.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new "Last updated" date. We encourage you to review this page periodically.

Contact Us

For anything about this policy, your personal data, or a request to exercise your rights:

• Privacy and data rights — privacy@erpresearch.com. We respond within 30 days.
• Everything else — support@erpresearch.com.