Privacy policy

Effective date. Effective from 16 August 2026

Last updated. Last updated 16 August 2026

Version. Version 1.0

Controller line. Data controller: Bussinesstan. Written enquiries: hi@bussinesstan.com.

Intro. This policy explains what personal data Bussinesstan collects, why it is held, who it is shared with and how long it is kept.

Scope line. It applies to the website, the enquiry and audit forms, candidate applications and client engagements.

This privacy policy explains how Bussinesstan handles personal data collected through its website, forms and client engagements. It covers the categories of data collected, the lawful basis for each use, the processors that receive data, international transfers, retention periods, and the rights available to individuals. Requests are handled by the contact named in the document. Cookies are covered separately in the cookie policy.

1. Who this policy covers

2. Definitions

3. Data collected

4. Lawful basis

5. How data is used

6. Sharing and processors

7. International transfers

8. Retention

9. Your rights

10. Cookies

11. Security

12. Changes to this policy

1. Who this policy covers
The controller is Bussinesstan, reachable in writing at hi@bussinesstan.com. The policy covers visitors to the website, people who complete the enquiry or audit forms, candidates who apply for a role, newsletter subscribers, and the named contacts at client and supplier organisations. It does not cover the personal data of senders and beneficiaries held inside a client's own systems, where the client is the controller and its own policy applies.
2. Definitions
Personal data means information relating to an identified or identifiable living person. Processing means anything done with that data, including collecting, storing, using, sharing and deleting it. Controller means the party deciding why and how data is processed. Processor means a party processing data on the controller's instructions. Client data means personal data accessed inside a client's advertising, analytics or CRM accounts during an engagement.
3. Data collected
Enquiry and audit forms collect name, work email, optional phone number, company details, monthly transfer volume band, primary corridors and the open notes field. Candidate applications collect name, email, discipline, corridors worked, a link to work and notes. Newsletter signup collects first name and email. Website analytics collect device, browser, approximate location from IP address, referring source and pages viewed, subject to consent. Client engagements involve read only access to advertising, analytics, attribution and CRM accounts, which may hold the client's customer data.
4. Lawful basis
Enquiry and audit responses rely on steps taken at the individual's request before a contract. Client engagement records rely on performance of a contract. Candidate applications rely on steps taken before a possible employment contract. Analytics, advertising measurement and the newsletter rely on consent, which can be withdrawn at any time. Accounting, tax and dispute records rely on legal obligation and legitimate interests. Access to client accounts is carried out as a processor on written instructions.
5. How data is used
Form data is used to reply with scope and a fixed price, and to decide whether the enquiry is a fit. Client data is used to deliver the engagement: campaigns, tracking, corridor performance and site conversion, then reporting on it. Candidate data is used to assess the application, run the paid task stage and decide. Newsletter data is used only to send the newsletter. Data is never sold, and never used to build profiles for onward marketing.
6. Sharing and processors
The website is hosted by Hostinger, which processes server logs and any data submitted through a form on the way to us. Enquiry email is received at hi@bussinesstan.com. Google Site Kit is installed but is not connected to any Google service, so no analytics data leaves the site today; this policy and the cookie policy will both be updated before that changes. No CRM, advertising platform or other processor currently receives personal data from this website. Advertising and analytics platforms operated by a client remain under that client's own agreements. Data may also be disclosed where required by law or to defend a legal claim. There are no other recipients.
7. International transfers
The team works across three time zones, and some processors sit outside the United Kingdom and the European Economic Area. Transfers outside those areas rely on an adequacy decision where one exists, or on standard contractual clauses with a transfer risk assessment on file. A current processor list with locations is available from the contact in section 13.
8. Retention
Enquiry data is kept for 24 months from the last contact, then deleted. Client engagement records are kept for 6 years from the end of the engagement, for accounting and contractual requirements. Candidate data is kept for 12 months from the decision, unless consent is given to keep it longer. Newsletter data is kept until the subscriber unsubscribes. Access to client accounts is handed back at the end of an engagement and credentials removed.
9. Your rights
You have rights to be informed, to access, to rectification, to erasure, to restrict processing, to data portability, to object, and rights relating to automated decision making. No automated decision making with legal or similarly significant effects is carried out. Requests are answered within one month of receipt, extendable by two months for complex requests, with the reason given. Complaints go to the relevant supervisory authority, which in the United Kingdom is the Information Commissioner's Office.
10. Cookies
Cookies and similar technologies are covered in the cookie policy, which lists each cookie, its purpose and its lifespan. Non-essential cookies are set only after consent, which can be changed at any time from the same control.
11. Security
System access is restricted to those who need it, protected by multi-factor authentication and reviewed when someone changes role or leaves. Client account access is read only unless the engagement requires otherwise in writing. Devices are encrypted. A reportable personal data breach is notified to the supervisory authority within 72 hours of becoming aware of it, and to affected individuals where the risk requires it.
12. Changes to this policy
Changes are published on this URL with a new version number and last updated date. Material changes to how data is used are notified by email to clients and subscribers before they take effect.

Toc title. On this page

Callout · definition 1. Controller decides why and how personal data is processed.

Callout · definition 2. Processor acts only on the controller's written instructions.

Callout · definition 3. Client data means personal data inside a client's own accounts.

13. Contact

Email: hi@bussinesstan.com
Data protection contact: hi@bussinesstan.com

Contact intro. Data protection questions and rights requests go to the contact named here.

Response line. Rights requests are acknowledged within 5 working days and answered within one month.

Supervisory line. Complaints can be made to the Information Commissioner's Office at ico.org.uk.