Website Privacy Notice — BHD Limited

1. Who we are

BHD Limited is the data controller responsible for your personal data. This Privacy Notice also applies to personal data processed under our trading names, including BHD Commercial.

If you have questions about this Privacy Notice or how we handle personal data, please contact us using the details above.

Data protection contact:

2. The personal data we collect

Depending on how you interact with us, we may collect the following information.

Information submitted through our contact/enquiry form

This may include:

• Your name;
• Your email address;
• Your company name;
• Your business turnover band (under £1m, £1m–£5m, £5m–£15m, £15m+);
• Your contract type (NEC3/NEC4, JCT, public sector framework, other/mixed);
• The service you are interested in (Commercial Health Check, Commercial Management, Project Controls, Cost Engineering, Quantity Surveying, Project Management, Planning, Commercial Desk, NEC Advisory, Commercial Recovery, General enquiry);
• Details of your commercial challenge or enquiry (free-text); and
• Any other information you choose to include in your message.

Please avoid sending sensitive personal data or confidential information through the website contact/enquiry form unless we specifically ask you to provide it through a secure channel.

Information relating to Commercial Health Check enquiries and bookings

If you request or book a free Commercial Health Check, we may collect the personal data you provide to:

• Arrange the booking and communicate with you;
• Understand your business and the commercial challenge you want to discuss; and
• Follow up with recommendations or next steps.

This may include the same categories of information collected through our contact/enquiry form (and any additional information you provide during booking or follow-up communications).

Information relating to Commercial Desk enquiries and other services

If you enquire about our Commercial Desk retainer packages (Essentials, Professional and Assurance), project-based support or training work, we may collect personal data needed to:

• Respond to your enquiry and assess suitability;
• Prepare proposals, quotations or engagement documents; and
• Deliver and administer the requested services.

This may include your business contact details, role, business and project information, contract information, instructions and correspondence.

Information about clients and prospective clients

If you engage us, or are considering engaging us, we may collect information needed to:

• Respond to your enquiry;
• Assess your requirements;
• Prepare proposals, quotations or engagement documents;
• Deliver quantity surveying, cost consultancy, project controls, commercial management, contract administration, training, architectural or related services;
• Manage our relationship with you;
• Administer and invoice for our services; and
• Maintain appropriate business and project records.

This may include your role, business contact details, project information, contract information, instructions, correspondence and records relating to the services we provide.

Information relating to downloads and resources (gated downloads / resource capture)

If you request a download or free resource from our website, we may collect personal data associated with that request and the context of the request (such as which document/resource was requested and the date/time).

This includes:

• Documents & Downloads page (download requests): full name, work email, company and job title; and
• Resources page (free resource requests): name and email, for example when you request the Commercial Health Check Scorecard, NEC Tracker, Forecast Dashboard or Margin Leakage Assessment.

Information relating to associate recruitment and screening (associate network)

If you register an interest in working with BHD as an associate, or apply for an associate engagement, we may collect and process:

• Your name and contact details;
• Your CV and career history;
• Evidence of your professional body membership or status toward chartership;
• Evidence of professional indemnity insurance (including recording renewal dates so we know when cover has lapsed);
• Evidence of your right to work in the UK;
• References, including the referee's name, employer and contact details;
• Details of site competence cards and qualifications where the work is site-based; and
• Notes from your introductory and capability conversations and any capability assessment by a technical lead.

Right to work checks (sensitive handling): documents evidencing your right to work in the UK can contain nationality or immigration information. We treat this data as sensitive, collect only what is necessary to complete the check, restrict access to those who need it, and do not use it for any other purpose.

Our associate model: we are not a recruitment or staffing agency. Where we use associates to deliver our services, BHD contracts with the client and the associate contracts only with BHD.

Technical and usage information

When you visit our website, we may automatically collect limited technical information, depending on the website configuration and cookies or similar technologies in use. This may include:

• IP address;
• Browser type and version;
• Device type;
• Operating system;
• Approximate location derived from your IP address;
• Website pages visited;
• Referring website;
• Date and time of visits; and
• Information about how you use the website.

Cookies and similar technologies

Our website uses cookies and similar technologies.

Strictly necessary cookies may be used to operate and secure the website. Where required by law, we ask for your consent before using non-essential cookies, including analytics, advertising or tracking cookies.

Our website currently runs PostHog analytics, which sets a browser identifier and analytics storage. It requires your consent and only loads if you accept. You can manage or withdraw your choice at any time using the Cookie settings control in our website footer. Further information is provided in our Cookie Policy at /cookie-policy.

3. How we use personal data

We may use personal data to:

• Respond to enquiries and requests for information (including enquiries about public sector, framework and supply chain work);
• Discuss your business, project or commercial requirements;
• Provide requested documents, guides and free resources (including gated downloads and resource capture) and follow up on B2B enquiries linked to those requests, with a clear opt-out for any marketing follow-up;
• Assess suitability for associate engagements, run the associate network and maintain an associate register;
• Provide quotations, proposals and information about our services;
• Enter into and perform contracts with clients;
• Provide quantity surveying, cost consultancy, project controls, contract administration, training, architectural design and related services;
• Communicate with clients, prospective clients, suppliers and professional advisers;
• Manage projects, instructions, deliverables and records;
• Process payments and maintain accounting records;
• Maintain business, legal and insurance records;
• Improve, secure and administer our website and systems;
• Monitor website performance where appropriate consent has been provided;
• Send occasional relevant business updates or marketing communications where you have consented to receive them;
• Comply with legal, regulatory, accounting and professional obligations;
• Establish, exercise or defend legal claims; and
• Protect our business, systems, staff, clients and website from fraud, misuse or security incidents.

We do not sell your personal data.

Where you enquire about public sector, framework or supply chain work, we handle any information you provide with appropriate confidentiality and security and will not disclose any client-confidential information.

We do not sell associate applicant or associate personal data. Associate information is shared only with those within BHD who need it for associate screening, onboarding and delivery, and with our professional advisers and IT providers where necessary and lawful.

4. Lawful bases for processing

We will only process personal data where we have a lawful basis under applicable data protection law.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether our interests are balanced against your rights and freedoms.

You may object to processing based on legitimate interests. Further information is set out in the section headed Your rights.

5. Marketing communications

We may send you relevant business updates, service information, event invitations or other marketing communications where you have given us consent to do so.

Where we follow up after you request a download or free resource, we will do so on a B2B basis with a clear opt-out (and we will respect your preferences). You can withdraw your consent at any time (where consent is the lawful basis), and you may also object to direct marketing at any time.

You can withdraw your consent or unsubscribe at any time by:

• Using the unsubscribe link in the relevant communication;
• Contacting us at info@bhd-limited.co.uk; or
• Contacting us using the details in this Privacy Notice.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Who we share personal data with

We may share personal data where necessary and lawful with:

• Our employees, contractors and consultants who need the information to perform their duties;
• Professional advisers, including solicitors, accountants, insurers and auditors;
• IT, website hosting, cloud storage, cybersecurity and technical support providers;
• Analytics providers (including PostHog Inc., United States);
• CRM, email, communications and business administration providers;
• Payment processors and banking providers;
• Suppliers and subcontractors involved in delivering services;
• Clients, project participants or other parties where necessary to provide contracted services;
• Regulators, government bodies, courts, law enforcement agencies or other authorities where required or permitted by law;
• Referral or collaboration partners, such as Built Intelligence, where relevant to an enquiry, referral, training arrangement or service and where there is a lawful basis for sharing the information; and
• Prospective purchasers, advisers or successors in connection with a business sale, restructuring or reorganisation.

We require service providers processing personal data on our behalf to protect that data and only process it in accordance with our instructions and applicable law.

We do not sell personal data to third parties.

7. International transfers

Some of our service providers or technology platforms may process personal data outside the United Kingdom, including analytics providers (for example, PostHog Inc., United States) that may process analytics data outside the UK.

Where personal data is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that your personal data receives an adequate level of protection. Depending on the circumstances, this may include:

• Transferring data to a country recognised as providing an adequate level of protection;
• Using the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses;
• Relying on another lawful transfer mechanism; and
• Applying appropriate contractual, organisational and technical safeguards.

You can contact us using the details in this Privacy Notice if you would like further information about the safeguards used for a particular transfer.

8. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, regulatory, insurance and reporting requirements.

Our usual retention periods are as follows:

• Business enquiries that do not become clients: normally up to 24 months after the last meaningful contact, unless a longer period is reasonably necessary to deal with a continuing matter or potential claim;
• Client and project records: for the duration of the engagement and for an appropriate period afterwards, taking account of contractual, professional, insurance and limitation requirements;
• Financial and accounting records: generally for at least six years from the end of the relevant financial year, plus the current year where applicable, or longer where required by law or reasonably necessary;
• Marketing consent records: for as long as necessary to demonstrate consent and manage marketing preferences;
• Associate enquiries and unsuccessful associate applicants: normally up to 12 months after the last meaningful contact and then deleted, unless you ask us to keep your details on the associate register for longer;
• Evidence of right to work: retained only as long as necessary to meet our legal obligations and then deleted;
• Onboarded associates: records kept for the duration of the engagement and for six years afterwards where needed for tax and legal purposes;
• Website and security records: for the period reasonably necessary for security, troubleshooting, monitoring and legal purposes; and
• Cookie information: in accordance with the relevant cookie duration and your cookie preferences.

When personal data is no longer required, we will securely delete it, anonymise it or otherwise dispose of it in accordance with our retention procedures.

9. Data security

We take reasonable and appropriate technical and organisational measures to protect personal data against:

• Unauthorised access;
• Accidental loss;
• Destruction;
• Alteration;
• Disclosure; and
• Other unauthorised or unlawful processing.

These measures may include access controls, password protection, secure systems, software updates, backups, staff awareness and confidentiality obligations.

No internet transmission or electronic storage system can be guaranteed to be completely secure. You should avoid sending highly confidential information through an ordinary website contact form.

10. Your rights

Subject to certain legal conditions and exemptions, you may have the following rights under UK data protection law:

Right of access

You may ask for a copy of the personal data we hold about you and information about how we use it.

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

You may ask us to delete personal data in certain circumstances.

Right to restriction

You may ask us to restrict how we use your personal data in certain circumstances.

Right to object

You may object to processing based on legitimate interests, including certain forms of direct marketing.

Right to data portability

In certain circumstances, you may ask to receive personal data you have provided to us in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation.

Right to withdraw consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

Rights relating to automated decision-making

We do not use your personal data to make decisions based solely on automated processing that produce legal or similarly significant effects (including in relation to associate screening).

These rights are not absolute and may be subject to legal conditions or exemptions. We may need to verify your identity before responding to a request.

To exercise your rights, contact:

We will normally respond to a valid request within one month. This period may be extended where permitted by law if a request is complex or if you make multiple requests.

11. Complaints

If you have concerns about how we use your personal data, please contact us first so that we can investigate and try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:

12. Third-party websites

Our website may contain links to third-party websites, services or resources. Those websites operate under their own privacy notices and terms. We are not responsible for how third parties collect or use personal data.

You should review the privacy information provided by any third-party website before submitting personal data to it.

13. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our services, technology, legal obligations or the way we process personal data.

The latest version will be published on this page with the updated date shown at the beginning of the notice.

We encourage you to review this Privacy Notice periodically.