Privacy policy

1. Who this policy covers

The controller is Bussinesstan, reachable in writing at hi@bussinesstan.com. This policy covers visitors to the website, people who complete the enquiry or audit form, candidates who apply for a role, newsletter subscribers, and the named contacts at client and supplier organisations.

It does not cover the personal data of senders and beneficiaries held inside a client's own systems. There the client is the controller and its own policy applies; Bussinesstan acts only as a processor on written instructions.

2. Definitions

• Personal data — information relating to an identified or identifiable living person.
• Processing — anything done with that data, including collecting, storing, using, sharing and deleting it.
• Controller — the party deciding why and how data is processed.
• Processor — a party processing data on the controller's instructions.
• Client data — personal data held inside a client's advertising, analytics, attribution or CRM accounts and accessed during an engagement.

3. Data collected

• Enquiry and audit form — name, work email, phone number, company, the service requested, preferred date and time, and the notes field.
• Candidate applications — name, email, discipline, corridors worked, a link to work, and notes.
• Newsletter — first name and email address.
• Website analytics — device, browser, approximate location derived from IP address, referring source, pages viewed, and an anonymised recording of pointer movement, clicks and scrolling on the page. Collected only after consent.
• Server logs — IP address, user agent and requested URL, written by the host as a normal part of serving the site.
• Client engagements — access to advertising, analytics, attribution and CRM accounts, which may contain the client's own customer data.

4. Lawful basis

• Enquiry and audit responses — steps taken at your request before entering a contract.
• Client engagement records — performance of a contract.
• Candidate applications — steps taken before a possible employment contract.
• Analytics and the newsletter — consent, which can be withdrawn at any time without affecting processing carried out before withdrawal.
• Accounting, tax and dispute records — legal obligation, and legitimate interests in establishing or defending legal claims.
• Access to client accounts — carried out as a processor on the client's written instructions.

5. How data is used

Form data is used to reply with a scope and a fixed price, and to decide whether an enquiry is a fit. Client data is used to deliver the engagement — campaigns, tracking, corridor performance, site conversion — and to report on it. Candidate data is used to assess the application, run the paid task stage and reach a decision. Newsletter data is used only to send the newsletter.

Personal data is never sold, never rented, and never used to build profiles for onward marketing.

6. Sharing and processors

Personal data is shared only with the processors below, and only as far as each needs it:

• Hostinger — website and email hosting. Processes server logs and any data submitted through a form on its way to us. Data centres in the EU.
• Google Ireland Limited — Google Analytics 4, installed through the Google Site Kit plugin. Receives page addresses, referrer, device and browser information and a coarse location. It is loaded only after you accept analytics in the cookie banner; before that, Google Consent Mode holds every storage type in a denied state and no analytics identifier is created.
• Google LLC — Google Search Console, which receives no personal data from this site; it reports aggregated search performance.
• Microsoft Ireland Operations Limited — Microsoft Clarity, for heatmaps and anonymised session replay. Receives page addresses, device and browser information, a coarse location, and a recording of how the page was used. Text typed into form fields is masked by default and is not recorded. No identifier is stored until you accept analytics in the cookie banner.

Advertising and analytics platforms operated by a client remain under that client's own agreements. Data may also be disclosed where required by law, or to establish or defend a legal claim. There are no other recipients.

7. International transfers

The team works across three time zones and some processors are outside the United Kingdom and the European Economic Area. Transfers rely on an adequacy decision where one exists, and otherwise on the UK International Data Transfer Addendum or standard contractual clauses, with a transfer risk assessment held on file. A current processor list with locations is available on request from the contact below.

8. Retention

• Enquiry and audit data — 24 months from the last contact, then deleted.
• Client engagement records — 6 years from the end of the engagement, for accounting and contractual requirements.
• Candidate data — 12 months from the decision, unless you consent to us keeping it longer.
• Newsletter data — until you unsubscribe.
• Analytics data — 14 months in Google Analytics, then deleted automatically.
• Session replay data — 13 months in Microsoft Clarity, then deleted automatically.
• Access to client accounts — handed back at the end of an engagement and credentials removed.

9. Your rights

You have the right to be informed, and rights of access, rectification, erasure, restriction of processing, data portability and objection, together with rights relating to automated decision-making. No automated decision-making producing legal or similarly significant effects is carried out.

To exercise any of them, email hi@bussinesstan.com. Requests are acknowledged within 5 working days and answered within one month of receipt. That period may be extended by a further two months for complex requests, in which case you will be told why within the first month. There is no charge unless a request is manifestly unfounded or excessive.

If you are not satisfied with the response you may complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your country of residence.

10. Cookies

Cookies and similar technologies are listed individually — name, purpose and lifespan — in the cookie policy. Nothing beyond the strictly necessary is set until you accept it, and you can change that choice at any time from the cookie preferences control in the footer.

11. Security

Access to systems is restricted to those who need it and is reviewed when somebody changes role or leaves. Client account access is read-only unless the engagement requires otherwise in writing. Devices are encrypted, and the site is served over HTTPS with HSTS.

A personal data breach that is likely to result in a risk to individuals is reported to the Information Commissioner's Office within 72 hours of us becoming aware of it, and to the affected individuals where the risk is high.

12. Changes to this policy

Changes are published on this page with a new version number and a new last updated date. Where a change materially affects how personal data is used, clients and subscribers are notified by email before it takes effect.

13. Contact

Data protection questions and rights requests: hi@bussinesstan.com. Requests are acknowledged within 5 working days and answered within one month of receipt.

Postal notice may be sent to the registered office given below.