Privacy Policy

This policy explains how Blue Haven Business Advisory Ltd collects, uses, shares and protects personal data, and what rights you have. It applies to our website, to our services, to the Blue Haven App where you use it, and to the way we deal with clients, prospective clients, partners, suppliers and professional contacts.

We have written it to be read, so it avoids legal shorthand where plain wording does the job. Where a section does not apply to you, skip it.

This policy sits alongside our Client Terms of Business, our Cookie Policy and, where they apply to an engagement, any data processing agreement and any additional terms for the Blue Haven App. Where a data processing agreement applies, that agreement governs the processing it covers.

Effective date: September 2026. This policy is kept under review and clause 25 explains how changes are handled.

Blue Haven Business Advisory Ltd is the controller for the personal data described in this policy, except where clause 10 says we act as a processor for a client.

Company

Blue Haven Business Advisory Ltd

Registered office

Office 1, Izabella House, 24–26 Regent Place, Birmingham, B1 3NJ

Company number

17456245

Privacy contact

team@bluehavenadvisory.co.uk · 0121 728 2352

ICO registration

ZC247793

We have not appointed a Data Protection Officer. Privacy enquiries are handled through the privacy contact above. We will appoint a Data Protection Officer if applicable law requires one.

If you would rather write to us, use the registered office address. Please mark the envelope for the attention of the privacy contact so it reaches the right person quickly.

This policy covers personal data about:

1. people at prospective clients and clients, including directors, managers, employees and other contacts;
2. people at our suppliers, partners, introducers and referral contacts;
3. professional advisers and specialists we work with or introduce;
4. visitors to our website and users of the Blue Haven App;
5. people who contact us by any route, including at events and through professional networks; and
6. applicants, associates and contractors, where they apply to work with us or do so.

Our services are provided to businesses. We do not aim our services at consumers, and clause 24 explains our position on children.

The categories below describe the personal data we may hold. Not all of it applies to every person or every engagement.

Business risk data is the category most likely to include information about people other than our direct contact. We ask clients to give us business-level or anonymised information wherever that answers the question, and we work with roles rather than named individuals where that is practical.

We collect what we need for the work and no more. Where a client sends us information we do not need, we tell them and, where appropriate, we delete or return it.

We obtain personal data:

1. directly from you, when you contact us, meet us, send us information or use our website or the App;
2. from the business you work for, including through a colleague who supplies information for an engagement;
3. from records and systems a client gives us access to for an engagement;
4. from meetings, calls and correspondence during our work;
5. from professional advisers and specialists working on the same engagement;
6. from introducers and referral partners who put us in touch with you; and
7. from publicly available business sources, such as a company website, Companies House or a professional profile, when we are preparing for a conversation or checking who we are dealing with.

We do not buy personal data lists, and we do not build profiles of individuals from wide-scale collection of public information.

The table below sets out what we use personal data for and the lawful basis under the UK GDPR. Where we rely on legitimate interests, the interest is stated so you can see the reasoning.

Where we rely on legitimate interests, we consider whether the use is reasonable, whether you would expect it and whether it affects your rights unfairly. You can object to processing based on legitimate interests, and clause 22 explains how.

We do not use consent as a catch-all. Where we do rely on consent, you can withdraw it at any time, and withdrawing it does not affect anything done before you did so.

Much of the personal data we handle reaches us from a client rather than from the person it concerns. That may include information about employees, directors, customers, suppliers, claimants and other individuals.

Where that happens, the client is responsible for making sure it has the authority and the lawful basis to give the information to us, and for telling the people concerned where it is required to. This is recorded in clause 19 of our Client Terms of Business.

We use information supplied by a client only for the purposes of the agreed engagement, and we keep it in line with clause 18.

We ask clients to send anonymised or aggregated information where the work does not need identifiable data, and to avoid sending information about individuals which the engagement does not need.

If you are an employee of a client and you have a question about information your employer has given us, please ask your employer first, since they are usually best placed to explain it. You can also contact us using clause 22.

We do not seek special category data, meaning information such as health, ethnicity, religious belief, trade union membership or biometric data, and we do not build our services around it.

We may occasionally come across it during an engagement, for example inside claims information, an absence record or a health and safety document supplied by a client.

Where we do not need it, we do not collect it, and we ask the client to remove or anonymise it. Where the engagement genuinely needs it, we handle it only where an appropriate lawful basis and an Article 9 condition apply, and we keep it to the minimum required.

The same approach applies to information about criminal offences.

We contact business contacts, clients, partners, introducers and prospects about our services, and occasionally about something we think is relevant to their business.

Our approach is straightforward. Communications are relevant to the person's role, they are not sent in volume, and every one of them includes a way to stop receiving them.

Where the Privacy and Electronic Communications Regulations apply to a particular type of message or recipient, we follow them. A personal email address, or a contact at a sole trader or a partnership, may need different treatment from a corporate business address, and we take that into account.

You can opt out at any time by replying to any message, using an unsubscribe link where one appears, or contacting us under clause 22. Opting out of marketing does not stop communications we need to send about an engagement, an invoice or a legal obligation.

For most of what we do, we are a controller. That includes business contact data, relationship data, engagement administration, our own professional records, correspondence and the records we keep for compliance, insurance and tax purposes.

In some engagements we handle personal data solely on a client's documented instructions, for example where we process a set of records the client supplies for a defined purpose and we make no decisions about how or why it is used. In those engagements we act as a processor for the client.

Where we act as a processor, we put a data processing agreement in place with the client where one is required, and that agreement governs the processing it covers.

The role can differ within the same engagement, so we look at the individual processing rather than applying one label to everything.

We share personal data only where there is a reason to, and only to the extent reasonably necessary. Recipients may include:

1. the Founders, and any employee, associate or contractor delivering the work;
2. our information technology, cloud hosting, email, document storage and business system providers;
3. the provider of the Blue Haven App and any platform used to deliver it;
4. our accountants, legal advisers and insurance advisers, including our broker and insurer where a claim or a circumstance is notified;
5. payment providers, where you pay us or we pay you;
6. an analytics provider, where optional analytics is enabled and consented to under clause 14;
7. specialists we introduce or coordinate, in accordance with clause 12; and
8. regulators, public authorities, courts and other third parties where the law requires it or where we need to establish or defend a legal claim.

We choose suppliers with appropriate security and put contracts in place with them where the law requires. We do not sell personal data, and we do not share it for someone else's marketing.

If we ever restructure the business or transfer part of it, personal data may pass to the new owner, subject to the same protections.

Where an issue needs expertise we do not hold, we may introduce or coordinate a specialist. We share only the information the specialist needs, and we ask for the client's authority before sharing anything beyond a general description of the issue.

Where a specialist contracts directly with the client, the specialist will usually act as an independent controller for the information it receives, because it decides the purposes and means of its own processing, and its own privacy notice applies to that processing. The actual role depends on the processing concerned.

Where we subcontract a specialist to deliver part of our own scope, they work under our instructions and our contract with them.

This clause reflects clause 10 of our Client Terms of Business.

We use software, automation, analytical tools and artificial intelligence-assisted tools to support analysis, drafting, quality control, reporting and administration.

A person reviews the work before it reaches a client. These tools support our judgement; they do not replace it.

We do not intentionally submit client confidential information or personal data to a public artificial intelligence service for the purpose of training a model, and we configure the tools we use to prevent that where the setting is available to us.

We minimise the personal data involved, using business-level or anonymised information wherever the task allows, and we apply access and security controls to the tools we use.

We do not currently make any decision about an individual by automated means alone which produces a legal effect or a similarly significant effect. If that ever changes, we will say so in this policy before it does.

This clause reflects clause 17 of our Client Terms of Business.

When you visit our website, some technical processing happens so the site can be delivered to you and kept secure. That includes handling your IP address and basic request information, and keeping access and security logs.

Optional analytics is switched off by default. Nothing optional loads unless you have actively agreed to it, and the site works normally if you decline.

Where analytics is enabled and you have consented, we use it to understand which pages are read and how people find us. You can decline at the outset and withdraw your agreement afterwards.

Where you contact us using the contact details shown on our website, we use the information to respond and, if the conversation leads to an engagement, in accordance with the rest of this policy. If we introduce a website form in future, the same principles apply and this policy is updated where needed.

In summary, only essential storage is used unless you agree to something further.

Where an engagement includes the Blue Haven App, we may process the identity, role and contact details of the users you nominate, login and access data, engagement information, findings and actions, records uploaded by users, and activity and security logs.

Additional App or subscription terms may apply, and where they do they are issued with the Engagement Document.

Whether we act as a controller or a processor for App data depends on the processing concerned, and clause 10 applies.

Access is limited to the users the client nominates. The client is responsible for who it nominates, for telling us when someone should no longer have access, and for having the authority to upload information about other people.

Clause 21 of our Client Terms of Business covers the commercial side of App access, including what happens at the end of an engagement.

Some of the suppliers we use may process personal data outside the United Kingdom, which is common for cloud and software services.

Where personal data is transferred outside the United Kingdom, we rely on a lawful transfer mechanism, which may be UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission standard contractual clauses, or another mechanism permitted by UK data protection law.

We check the position supplier by supplier rather than assuming one mechanism covers everything. You can ask us which mechanism applies to a particular supplier using clause 22.

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, tax, accounting, insurance and professional risk requirements.

The categories we apply retention to are enquiry and prospect records, client engagement records, contracts, invoices and accounting records, complaints and claims records, marketing and relationship contacts, App account records, and security logs.

The detailed periods are controlled by the Blue Haven Retention Schedule, which we review and keep current. Engagement records are generally kept for longer than enquiry records, because a client may raise a question about our work years after it was delivered and we need to be able to answer it.

Where a complaint, a claim or a possible claim exists, we keep the relevant records until the position is resolved and any limitation period has passed.

When information is no longer needed, we delete it or anonymise it.

We use appropriate technical and organisational measures to protect personal data. These include access controls and role-based access, multi-factor authentication where it is available and appropriate, reputable cloud services, encryption in transit and at rest where our suppliers provide it, backup and recovery arrangements, monitoring, restricted access to client records, awareness among the people who do our work, and an incident response process.

No system is completely secure, and we do not promise that our systems or those of our suppliers cannot be compromised. What we can say is that we take security seriously, we choose suppliers with that in mind, and we act quickly when something goes wrong.

We have an incident response process covering how we contain, assess, record and learn from a data incident.

Where a personal data breach is likely to result in a risk to people's rights and freedoms, we report it to the Information Commissioner's Office within the time the law requires. Where it is likely to result in a high risk to an individual, we tell the individual as well.

Where a client's information is affected, we assess our role as controller or processor for the processing concerned. We notify the affected client without undue delay where the law, our contract or our role requires it, and otherwise where notification is appropriate because their information is affected. We cooperate with the client where the client has its own notification obligations.

Not every incident is reportable, and not every incident requires every client to be told. We assess each one on the facts and record the assessment either way.

Under UK data protection law you have rights over your personal data. Which rights apply depends on the circumstances and the lawful basis we are relying on.

Where the personal data was given to us by a client and we are acting on that client's instructions, we usually pass your request to the client and support them in responding, since the data is theirs to control.

Exercising a right is free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, and we will explain our reasoning if that ever arises.

We may ask for enough information to confirm who you are and to find the records you are asking about. That protects your data as much as ours.

We respond within one month. Where a request is complex, or where you have made several, we may extend that by up to two further months and we will tell you if we do.

If you are unhappy with how we have handled your personal data, tell us first using clause 22. We would rather hear it directly and put it right.

Our services are provided to businesses. We do not aim them at children, and we do not knowingly collect personal data from children through our business services.

We update this policy when our services, our systems or the law change.

The current version is always the one published on our website. Where a change is material, we tell affected clients and contacts where it is appropriate to do so.

Effective date: September 2026.

Internally it is supported by the Blue Haven Data Protection Policy, the Retention Schedule, the Information Security Policy, the AI Use Policy, the Incident Response Plan and the Professional Liability and Service Boundary Standard.

Where a data processing agreement covers a particular set of processing, that agreement takes precedence over this policy for that processing.