Last updated: 27 September 2026
This Privacy Policy explains how Brightlogic Consulting Ltd (“Brightlogic”, “we”, “us”, “our”) collects, uses, shares, and protects personal data when you visit our website, contact us, or when we provide services to business customers.
This policy is written for UK data protection requirements, including the UK GDPR and the Data Protection Act 2018.
1. Who we are (data controller)
Controller: Brightlogic Consulting Ltd
Company number: 14714715
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Contact email: support@brightlogic.uk
Brightlogic is the data controller for personal data collected via this website and our sales/marketing communications.
Where we provide services to business customers (for example, hosting or managed services), we may act as a processor of personal data under the customer’s instructions (see section 6).
2. What personal data we collect
We may collect and process the following categories of personal data:
A. Website enquiries and CRM data
Name, business email address, telephone number, company name, job title (if provided)
Enquiry content and any attachments you submit
Notes and follow-up activity created in our CRM
B. Business relationship data (B2B)
Business contact details for client and supplier contacts (name, role, business email, business phone)
Contract, proposal, and billing correspondence
Support tickets and account administration records
C. Technical and usage data
IP address and approximate location (derived from IP)
Device, browser, and operating system information
Website usage data (pages visited, session duration, interactions)
For Marketing Shares, and only after Analytics consent: access time, IP address, browser user-agent, referring page without its query string, HTTP request identifier and an indication based on request signals that an access may be a link preview or prefetch.
Cookies and similar technologies (see section 8)
D. Service delivery and security data (where relevant)
Authentication logs and access records for portals we provide
Service event logs required for security and troubleshooting
We do not intentionally collect special category data (such as health data) via our website. Please do not include special category data in website forms unless it is strictly necessary.
3. How we collect personal data
We collect personal data in the following ways:
When you submit a form on our website, email us, or contact us by phone
When you enter into discussions with us about services
Automatically through website logs, analytics, and cookies (subject to cookie settings), including consent-gated Marketing Share access details
When our business customers provide contact details for service delivery and account management
4. How we use personal data (purposes and lawful bases)
We only use personal data where we have a valid lawful basis.
A. Responding to enquiries and managing relationships
Purpose: respond to enquiries, arrange meetings, provide quotes/proposals, manage business relationships.
Lawful basis: legitimate interests and/or contract (where steps are taken at your request prior to entering a contract).
B. Delivering contracted services
Purpose: deliver services, provide support, manage accounts, handle incidents, and perform service administration.
Lawful basis: contract and legitimate interests.
C. Billing, accounts, and legal obligations
Purpose: invoicing, payment administration, tax/accounting records, compliance with legal obligations.
Lawful basis: legal obligation and/or contract.
D. Service security and abuse prevention
Purpose: protect our systems, prevent fraud/abuse, investigate security incidents, maintain service stability.
Lawful basis: legitimate interests.
E. Marketing (B2B)
Purpose: send B2B communications about our services and maintain suppression lists (opt-outs).
Lawful basis: legitimate interests and/or consent where required for a particular channel. You can opt out at any time (see section 9).
F. Website analytics and behaviour insights
Purpose: understand how visitors use the site, measure performance, improve content and user experience, and diagnose issues.
Lawful basis: consent, where these tools rely on non-essential cookies or similar technologies (see section 8).
For Marketing Shares, this includes recording access details for page opens and PDF downloads to understand engagement with shared collateral. Analytics consent is required. These connection and browser signals do not identify a person or prove that a link was forwarded; automated-preview classifications are estimates and may be wrong.
5. Who we share personal data with
We may share personal data with trusted third parties where necessary to operate our business and provide our services, including:
IT and hosting suppliers used to deliver and operate our services (for example: infrastructure, storage, backups, and security tooling).
Google Analytics, used only where you consent to Analytics cookies. Marketing Share access details are recorded on Brightlogic’s own systems and are not sent to an analytics provider.
Communications and support tooling used to manage enquiries and customer communications.
Professional advisers (for example: legal, insurance, and accounting) where required.
Authorities where required by law, or where necessary to protect rights, safety, and security.
We do not sell personal data.
6. CRM and enquiry handling (self-hosted)
When you submit an enquiry or otherwise contact us, we record and manage that information in our customer relationship management (CRM) system to handle your request, maintain business communications, and manage service delivery.
Our CRM platform is self-hosted and operated by Brightlogic as part of our internal systems.
Access is restricted to authorised personnel.
7. When we act as a processor (client service data)
When we provide services to business customers (for example, hosting or managed services), we may process personal data on behalf of the customer.
In those scenarios:
the customer is typically the controller; and
Brightlogic is a processor (or sub-processor) acting on the customer’s instructions.
Where required, this processing will be covered by a Data Processing Agreement (DPA).
8. International transfers
Some suppliers we use (including website analytics and user experience tools) may store or process personal data outside the UK.
Where a transfer of personal data outside the UK occurs, we take steps to ensure appropriate safeguards are in place in line with UK data protection requirements.
9. Cookies and similar technologies
We use cookies and similar technologies to operate the website and, where enabled, to analyse usage and improve performance.
Strictly necessary cookies are used where required for the website to function (for example, security and basic session management).
Analytics consent controls Google Analytics cookies and the optional recording of detailed Marketing Share page-open and PDF-download events. Marketing Share access details are stored on Brightlogic’s own systems, not in an analytics cookie. If you consent, those details include the source IP address, browser user-agent, referring page without its query string, request identifier and possible automated-preview or prefetch classification. You can refuse or withdraw Analytics and still view or download the shared document. See our Cookie Policy for the fields and retention period.
You can manage your preferences using our cookie settings (where available) and/or through your browser settings. If you disable cookies, parts of the website may not function as intended.
10. Marketing preferences
If we send you B2B marketing communications, you can opt out at any time by:
using the unsubscribe option in the email (where provided), or
emailing support@brightlogic.uk.
We may keep a record of your opt-out request to ensure we respect your preferences.
11. Data retention
We keep personal data only for as long as necessary for the purposes described in this policy, including legal, accounting, and operational requirements.
Typical retention examples (may vary by context):
Enquiry and lead data: retained for a reasonable period to manage follow-up and sales history, then deleted or minimised.
Client contract and billing records: retained for statutory and tax/accounting purposes.
Support tickets and service logs: retained for operational, security, and audit needs, then deleted or anonymised where feasible.
Marketing suppression lists: retained to ensure we continue to honour opt-out requests.
Marketing Share access details: removed after 90 days. The event type and UTC time are retained in the operational activity history associated with the share.
12. Your rights
You have rights under UK data protection law, including rights of access, rectification, erasure, restriction, objection, and (in some cases) portability.
To exercise your rights, email support@brightlogic.uk. We may need to verify your identity before fulfilling a request.
13. Complaints
If you have concerns about how we use your personal data, please contact us first at support@brightlogic.uk so we can address the issue.
You also have the right to complain to the UK supervisory authority for data protection.
14. Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, but we take reasonable steps to reduce risk.
15. Third-party links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. Please review the privacy policies of any third-party websites you visit.
16. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in law, guidance, or our practices. We will post the updated version on this page and update the “Last updated” date.
17. Contact
Brightlogic Consulting Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: support@brightlogic.uk