Privacy notice

Last updated: 7 October 2026

1. Who we are and what this notice covers

BSB Management Consultancy Limited is a UK-registered company, company number 12876670. We provide management consultancy, tailored internal tools, workflow automation and practical AI development services.

This notice explains how we use personal information when you visit our website, contact us, book a discovery call or deal with us as a prospective or existing client or business contact. BSB is the controller of personal information used for those purposes: we decide why and how it is used.

For privacy questions or to exercise your rights, email hello@bsb.management. Your contact is Aziz Batuhan Dincel. Our registered office is 285 Fore Street, London, England, N9 0PD.

Where we process personal information on a client's behalf as part of a project, our role and responsibilities depend on that project. The client's privacy information and our agreed data-processing terms govern processing for which the client is the controller. This notice does not replace those arrangements.

2. Information we collect

You may give us your name, email address, company name, country or time zone, and information about your project or the process you want to improve. We also receive messages, booking information, meeting correspondence and information needed to manage an engagement, such as business contact and billing details.

The enquiry form requires a name, email address and description of your enquiry. Company and country/time-zone fields are optional. You are not legally required to send an enquiry, but without sufficient contact details and information about your request we may be unable to respond or arrange work.

Our hosting, security and spam-protection services may process technical information such as IP addresses, browser/device information, request logs and signals used to distinguish legitimate visitors from automated abuse. The cookie and optional-service section below explains additional website processing.

We generally receive contact information directly from you. During business engagements, a colleague or client may give us your work contact details so we can communicate about the project.

Please do not submit passwords, payment-card details, health information or confidential client records through our general enquiry form.

3. Why we use information and our lawful bases

Enquiries and bookings: we use your contact details and message to respond, arrange a conversation and consider your requirements. Where you are considering a contract with us personally, this may be necessary to take steps at your request before entering a contract. For company representatives and general business enquiries, we rely on our legitimate interests in responding to requests and managing business relationships.

Providing agreed services: where you are personally party to the contract, we process necessary information to perform it. For contacts acting for a business client, we rely on our legitimate interests in delivering and administering the business engagement.

Records and obligations: we use relevant records to meet applicable accounting, tax and other legal obligations. Where necessary, we also rely on legitimate interests to maintain appropriate business records and establish, exercise or defend legal claims.

Website operation and security: we rely on our legitimate interests in operating a reliable website, preventing spam and protecting our systems and communications. Separate rules apply to cookies and similar technologies; the lawful basis for personal-data processing does not by itself authorise storing information on your device.

We do not use Google Analytics or Smartsupp live chat on the website. Submitting an enquiry is not consent to unrelated marketing.

4. AI and discovery calls

We use dummy data when developing or experimenting with AI tools. We do not submit your enquiry content or client details to AI tools for this work.

Our discovery calls are not recorded or automatically transcribed. We may keep relevant written notes to respond to your request or manage a project.

We do not use the enquiry or booking process to make solely automated decisions about you that have legal or similarly significant effects.

Any future project involving personal information requires an agreed purpose, appropriate access and data-handling arrangements before that information is used. The fact that we offer AI-related services does not give us permission to use your information for AI training.

5. Services that help us operate

We use service providers to support the website and our communications. The current setup includes: • Krystal: website hosting in London, associated infrastructure and backups. • Google Workspace: business email, calendar bookings and meetings. • WordPress and WPForms: the website and enquiry form. The form is configured to send enquiries by email, without storing entries in WordPress or WPForms Lite Connect backups. • SMTP2GO: delivery of form notification emails through WP Mail SMTP. This involves processing the contact details and message included in your enquiry. • Google Fonts: font delivery, which involves requests containing technical information such as your IP address and browser headers. • hCaptcha: spam and automated-abuse protection for forms. • Complianz: a WordPress plugin that manages cookie preferences and script blocking on our website. Its external website scan and cookie-database synchronisation are disabled. • Website security tools, including Sucuri, help detect suspicious activity and protect the site.

Google Analytics and Smartsupp live-chat integrations were disabled on 7 October 2026. Any information collected before that date is subject to the retention arrangements applicable to that earlier processing; disabling the integrations does not delete historical provider-held information. Installing a WordPress plugin does not necessarily mean its vendor receives every form submission.

We may also disclose relevant information to professional advisers or authorities when necessary for legal obligations or the establishment, exercise or defence of legal claims. We limit disclosures to what is needed for the relevant purpose.

External links, including booking pages and LinkedIn, lead to services with their own privacy information. Their operators may process data for their own purposes as well as providing services to us.

6. Cookies and website features

We use Complianz within WordPress to manage cookie preferences and script blocking. Security, spam prevention and website features may use cookies or browser storage and process technical information. Read our Cookie Policy for details and choices. Google Analytics and Smartsupp live chat are disabled.

7. International processing

Our website is hosted in London. Providers supporting email, bookings, spam protection and consent management may also process data outside the UK, including in the European Economic Area and the United States, with international support and subprocessors.

Google Workspace processing is covered by its Cloud Data Processing Addendum. hCaptcha's standard terms incorporate a data-processing agreement and contractual transfer safeguards. Where required, these provider arrangements use approved standard contractual clauses and the applicable UK transfer terms, or a relevant adequacy framework. You can contact us for information about the safeguards relevant to your information.

Our SMTP2GO account is hosted in the EU. Its accepted Data Processing Agreement includes the EU standard contractual clauses and UK transfer addendum for relevant restricted transfers. SMTP2GO is operated by Sand Dune Mail Ltd in New Zealand and uses international infrastructure and support providers. Provider-hosted regions do not mean all support or onward processing occurs only in that region.

8. How long we keep information

Enquiries that do not become a client engagement: 12 months after our last interaction, after which we delete or anonymise the relevant personal information unless a specific legal obligation or dispute requires longer retention.

Client and contract records: we retain records during an engagement and afterwards where needed for accounting, tax, contractual obligations or legal claims. Retention depends on the type of record, the applicable statutory period and whether a dispute remains unresolved. We retain only the information relevant to those purposes.

Security and operational records: we keep the information needed to detect and investigate abuse, resolve technical problems and demonstrate compliance. We assess retention by the seriousness of any incident, whether an investigation or dispute is still active and whether the information remains needed as evidence. Consent records are retained as needed to remember and demonstrate your choices.

Email delivery records: SMTP2GO normally retains email headers and delivery information for 35 days. Its anti-abuse processes may retain a limited sample of message content for 35 days. Paid email archiving is not enabled on our account. The copy delivered to our Google Workspace mailbox follows the enquiry or client-record retention criteria above.

Website backups: our Krystal plan maintains 31 daily restore points, so deleted website data may remain in rotating backups for approximately 31 days. Email providers have separate deletion and recovery cycles. Information preserved in backups is used for recovery, rather than ordinary business use.

When information is no longer needed, we delete or anonymise it. Residual copies may remain during provider recovery and backup-expiry cycles.

9. Your rights

Depending on the circumstances and applicable law, you may request access to your personal information, correction of inaccurate information, deletion, restriction of use, or transfer of information in a portable format. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of earlier processing.

To make a request, email hello@bsb.management. We may need proportionate information to verify your identity. We will explain any applicable limitation or reason we cannot fulfil a request.

You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. Where EU GDPR applies, you may also complain to the relevant supervisory authority, including in the EU country where you live or work. You do not have to contact us before raising a complaint, although we welcome the opportunity to address your concern.

10. Changes

We will update this notice when our services or data practices change and show the effective date at the top. Where appropriate, we will bring significant changes to your attention.