Privacy Notice
What we do with personal data collected through this website.
Last updated: 2 September 2026
This notice explains what we do with personal data collected through businessbrain.net.
Who we are. Business Brain. For the personal data described in this notice we are the controller. You can reach us through the policy enquiry form.
The distinction that matters most on this page
This notice covers visitors to this website.
It does not cover the personal data inside a client’s Business Brain instance. For that data the client is the controller and we are the processor acting on their instructions. What we may and may not do with it is governed by our Data Processing Agreement with that client, not by this notice. If your employer uses Business Brain and you want to know what is held about you, ask your employer — they decide, and we are not permitted to answer for them.
1. What we collect, why, and on what legal basis
| What | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Your name, email address, organisation and message | The enquiry form | To answer you, and to talk to you about working together | Legitimate interests — responding to someone who has asked us to |
| Correspondence that follows | To carry on the conversation and keep a record of what was agreed | Legitimate interests, or performance of a contract once there is one | |
| Technical data — IP address, browser, pages viewed, time | Automatically, via our server logs | Security, fault diagnosis, and keeping the site working | Legitimate interests — running a service securely |
We do not collect special category data through this website, run advertising or profiling on it, sell personal data, or share it with anyone for their own marketing.
2. If you fill in the enquiry form
2.1 Your enquiry reaches our sales system and creates a record of you as a contact, so that we can answer and so that the next person who speaks to you knows what was already said.
2.2 We will use your details to reply, and to follow up on that conversation. We will not add you to a marketing list on the strength of an enquiry. If we ever start sending marketing, we will ask you first and every message will carry an unsubscribe link that works.
2.3 If nothing comes of the conversation, we delete your enquiry and the correspondence with it after 24 months.
3. Who else sees it
We use a small number of suppliers who process personal data on our behalf, under contract, only on our instructions, and who may not use it for their own purposes:
| Supplier | What for |
|---|---|
| Our email delivery provider | Sending email |
| Our website host | Hosting this website |
We will tell you who these suppliers are, and where they are established, if you ask.
There is no analytics supplier. We do not use any third-party analytics, advertising or tracking service, and we do not share your visit with anyone.
Our own mail is received and held on our own mail server, not a third party’s.
We will also disclose personal data where the law requires it. If we are ever compelled to hand over data, we will tell the person affected unless we are forbidden to.
4. Where it goes
Where personal data is transferred outside the jurisdiction in which it was collected, we rely on an appropriate transfer mechanism.
5. How long we keep it
| What | How long |
|---|---|
| Enquiries that go nowhere | 24 months |
| Correspondence with clients and prospects | The relationship, plus 6 years for our records |
| Support correspondence containing personal data | 12 months from closure of the issue |
| Server logs | 90 days |
6. Your rights
You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to our use of it, and to receive it in a portable form. Where we rely on legitimate interests, you can object, and we will stop unless we have a compelling reason not to — which, for an enquiry, we will not.
Ask us through the policy enquiry form, choosing “Privacy” as the subject. We will answer within one month. We do not charge.
If you are not satisfied you may complain to the supervisory authority in our local jurisdiction, or to the supervisory authority where you live.
7. Security
This site is served over TLS. Access to the systems holding enquiries is restricted to the people who need it, over key-based or multi-factor authentication, on named individual accounts. The security of a client’s Business Brain instance is described in the Service Terms and the DPA, which say considerably more.
8. Changes
We may update this notice. The date at the top tells you when it last changed.