Privacy notice

Who we are

BSC Associates Ltd is the data controller for the personal information described in this notice.

• Registered in England & Wales, company number 04818441
• Registered with the Information Commissioner's Office, registration number ZB152455
• Email: brian.collins@bscassociates.co.uk
• Post: available on request

We are a small consultancy and are not required to appoint a Data Protection Officer. Please address any questions about this notice to Brian Collins, Managing Director, at the email address above.

What we collect and why

Clients and business contacts

We hold the names, job titles, email addresses, postal addresses and telephone numbers of our client organisations and of the people within them who deal with us, so that we can contact you in the normal course of business. Our lawful bases are the performance of a contract with you or your organisation, and our legitimate interest in maintaining business relationships.

Project information

Project records may include some personal data, such as the names of people who attended meetings. These are held securely as described below and in accordance with any non‑disclosure agreement between us.

Enquiries

If you contact us by email, telephone or through the enquiry form on this website, we use the details you give us to reply to your enquiry. The enquiry form opens a message in your own email program; nothing is submitted to or stored on this website. Our lawful basis is our legitimate interest in responding to enquiries.

Accounting and legal records

We keep invoices and related records as required by UK tax and company law. Our lawful basis is compliance with a legal obligation.

This website

This website sets no cookies and uses no analytics or tracking. Our hosting provider keeps standard server logs, which include the IP addresses of visitors, for security and diagnostic purposes. We do not use these logs to identify individuals. We do not run newsletters or mailing lists, and we do not take payments through the website.

How we keep information secure

All business data is encrypted on our computer systems. Local backups are encrypted, and our cloud backup is encrypted both in transit and in storage. Cloud backups are held by Backblaze, Inc. and may be stored in the United States. Backblaze is certified under the UK Extension to the EU‑US Data Privacy Framework, which UK law recognises as giving adequate protection for such transfers.

Sharing

We do not sell or rent personal information, and we do not share it with third parties except our service providers (such as our backup provider), our professional advisers where necessary, or where we are required to do so by law. We do not use automated decision‑making or profiling.

How long we keep information

We keep client, project and accounting records for six years after the end of an engagement, which is the period required for tax and legal purposes. Other correspondence, including enquiries that do not lead to work, is kept for no more than six years after our last contact. After that, information is securely deleted.

Your rights

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete your information, where we have no legal reason to keep it;
• ask us to restrict how we use your information, or object to our using it;
• ask for information you have given us to be transferred to you or another organisation in a common electronic format.

To exercise any of these rights, email us at the address above. We will respond within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would be grateful for the chance to address your concerns first.

This notice was last updated on 16 October 2026 and replaces our GDPR statement of 24 May 2018.