Privacy notice
What BCA Business Ltd collects, why, on what lawful basis, who else sees it, where in the world it goes, how long we keep it and what you can make us do about it.
Section 05 is the one worth your attention. Doing our job means sending your contact details to regulatory representatives in countries with no UK adequacy decision. We name the countries and the legal footing.
Who is responsible
- Controller
- BCA Business Ltd
- Company no.
- 16606602, England and Wales
- Office
- 128 City Road, London EC1V 2NX
- ICO register
- ZC027486
- Contact
- mail@bcabusiness.co.uk
- Telephone
- +44 7342 901002
- DPO
- None appointed. We are not required to appoint one, and we would rather say so than imply a role we do not fill.
Version 1.0 · 21 October 2026 · reviewed annually and whenever we change a supplier
What we collect
Almost everything we hold is business contact data about people acting for a company, not private-life data about individuals. We collect it from you. We do not buy lists and we do not scrape.
Provision is not compulsory, but it is necessary. Nothing here forces you to give us personal data, but we cannot answer a question about your product without an address to answer to. If you would rather not be identified at the enquiry stage, ask with no more than a first name and a reply address.
Why, and on what lawful basis
Each purpose has one lawful basis under Article 6 of the UK GDPR. We do not stack bases or keep a spare in reserve.
| What we do | Lawful basis | Why that one |
|---|---|---|
| Answer your enquiry | Legitimate interests — Art. 6(1)(f) | Our interest in replying to someone who contacted us, and yours in getting an answer. A low-impact use of business contact data that you initiated. |
| Deliver a service you engaged us for | Contract — Art. 6(1)(b) | Where you are personally the client. Where the client is your employer, the basis is legitimate interests: performing that contract and dealing with the people appointed to it. |
| Invoice and keep accounts | Legal obligation — Art. 6(1)(c) | The Companies Act 2006 and HMRC require records to be kept, and for a set period. We have no discretion here. |
| Appoint a representative for you | Legitimate interests — Art. 6(1)(f) | Set out separately in section 05, because it leaves the United Kingdom. |
| Website analytics | Consent — Art. 6(1)(a) | And separately consent under regulation 6 of PECR before anything is stored on your device. No consent, no analytics. |
Where we rely on legitimate interests you may object, and we will stop unless we can show compelling grounds that override your rights. For an enquiry we will simply stop and delete.
Who else sees it
Three suppliers, and the representatives we appoint for you. That is the whole list.
We would also disclose where the law requires it — a court order, a regulator, a tax authority. It has not happened, and if it does we will tell you unless we are prohibited from doing so.
Where it physically goes
Most privacy notices say "we may transfer your data outside the UK" and stop. Below is the actual list, with whether the destination has a UK adequacy decision.
What the law requires of us. A transfer to a country without UK adequacy is a restricted transfer. It needs either an appropriate safeguard under Article 46 of the UK GDPR — in practice the International Data Transfer Agreement, or the International Data Transfer Addendum bolted onto European standard contractual clauses, preceded by the assessment the legislation now calls a data protection test — or one of the narrow exceptions in Article 49. Where a supplier transfers data out of the UK we require that Addendum, and you can ask us for a copy of the safeguard relied on for any transfer above.
Transfers to the six markets
This section exists because of what we do rather than because a template said so. Taking a product into Saudi Arabia, the UAE, Egypt, Türkiye, Nigeria or South Africa means dealing with a local entity there — and in five of the six the law requires it, because a UK company may not hold its own authorisation.
So at some point we will send someone in one of those countries your name, job title, employer and work email, so they can quote for the work and later be appointed. That is a restricted transfer, and none of the six has a UK adequacy decision.
What we send, and when
- Only after you have asked us to look at that market
- Name, job title, employer, work email — not personal contact details
- At the quoting stage we identify you no more than the conversation requires
- Full contact details only once you have chosen the representative
- Never beyond the representatives shortlisted for your project
What we do not do
- Circulate your details to a standing list of contacts in the region
- Introduce you to anyone not shortlisted for your work
- Take a commission from any representative for the introduction
- Rely on a one-off exception for something we do regularly — the regulator is clear that systematic transfers cannot rest on the Article 49 exceptions
The mechanism. Because these transfers are a normal and repeated part of our work rather than one-offs, we put an appropriate safeguard in place instead of relying on an exception: the International Data Transfer Agreement, or the Addendum where the representative already operates under European standard contractual clauses, with the required assessment completed before the first transfer. If you would rather we did not identify you to a particular market or company, say so — it is usually possible to obtain a quote without naming anybody.
How long we keep it
| What | How long | Then |
|---|---|---|
| An enquiry that goes nowhere | 12 months | Deleted. If you ask us to delete it sooner, we do it the same week. |
| A client project file | 6 years after the engagement ends | Deleted. The period matches the limitation period for a contract claim in England and Wales. |
| Accounting records | 6 years from the end of the financial year | Kept because the Companies Act 2006 and HMRC require it. We cannot delete these earlier, including on request. |
| Anything sent under an NDA | As the NDA says | Returned or destroyed on the terms you signed, which override this table. |
| Analytics | 14 months | The retention period set in our analytics property, after which the data expires automatically. |
A deletion in our email system removes the message from the mailbox. Provider backups cycle out on the provider's own schedule, which we do not control and will not pretend to.
Cookies and analytics
Regulation 6 of the Privacy and Electronic Communications Regulations says nothing may be stored on your device, or read from it, without your consent — unless it falls inside one of the exceptions now set out in Schedule A1 to those Regulations.
Since February 2026 one of those exceptions covers first-party statistics collected purely to improve a website. It is genuinely useful and it does not cover us: we use Google Analytics, and an ordinary Google Analytics deployment does not meet the exception's conditions. So we ask, and set no analytics cookie until you say yes.
Set without asking
- What is strictly necessary to serve this website and keep it secure
- Whatever remembers the choice you made about the banner
Set only if you agree
- Google Analytics, to count visits and see which pages are read
- The statistics cookies our website platform sets by default, which its own documentation treats as consent-based
Refusing is as easy as agreeing. The banner has a reject control of the same prominence as the accept control, because the regulator requires it and because a banner engineered to make refusal tiring is an admission. Refusing costs you nothing — no page behaves differently and nothing is withheld. The full list of cookies with names and lifetimes is on the cookie page.
We run no advertising pixels and no cross-site trackers. If that ever changes, this notice will change first.
Your rights
These are statutory, free to exercise, and asking is not an imposition. Write to mail@bcabusiness.co.uk and say which one you want.
- AccessA copy of the personal data we hold about you, and this notice as it applies to you specifically.
- RectificationCorrection of anything inaccurate, completion of anything incomplete.
- ErasureDeletion where we have no overriding reason to keep it. Accounting records are the usual overriding reason.
- RestrictionA pause on our use of it while a dispute about accuracy or grounds is resolved.
- PortabilityWhat you gave us, machine-readable, where we hold it on consent or contract.
- ObjectionTo anything we do on legitimate interests. For an enquiry we will simply stop.
- Withdraw consentAt any time. It does not affect what was lawful before you withdrew.
- Not to be profiledWe make no automated decisions with legal or similarly significant effects, and we do not profile.
Timescales, honestly. The statutory period is one month, extendable by two further months where a request is complex or there are several — and we would tell you, with reasons, before the first month was out. If we need to clarify what you are asking for, or confirm who you are, the law allows the clock to pause until you come back to us. A request from a company we have worked with is usually answered the same week.
Complaining
If you think we have handled your personal data badly you have two routes, and you are not obliged to take them in order.
Complain to us
Email mail@bcabusiness.co.uk with "Data protection complaint" in the subject line, or write to the registered office. There is no form to fill in.
- We acknowledge within 30 days, as the Data Protection Act 2018 requires of us
- We investigate and tell you the outcome without undue delay
- If it will take a while, we tell you how it is going rather than go quiet
Complain to the regulator
You may complain to the Information Commissioner's Office, the UK data protection regulator, under section 165 of the Data Protection Act 2018.
- ico.org.uk/make-a-complaint · 0303 123 1113
- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- You do not have to complain to us first. Some organisations imply that you do. It is not the law and we are not going to say it.
On names: since 30 September 2026 the office of the Information Commissioner has been replaced by the Information Commission, which took over the same functions. The regulator has said it will continue to be known as the ICO, and every contact detail above is unaffected.
What we never do
We do not sell, rent or licence personal data to anybody, on any terms.
We do not buy contact lists or scrape them. If we write to you it is because you wrote first.
We take no payment from any representative we introduce you to, for the introduction or anything else.
If this notice changes. We publish the new version here with a new number and date, effective from that date. If a change materially affects how we use data we already hold about you — a new supplier, a new purpose, a new country — we tell the people it affects before it starts, rather than after.
Ask us anything about this
Including the awkward questions. If something here is unclear, or you want the safeguard document behind a transfer, or you want to know exactly what we hold, write and ask.