Privacy Policy

1. Who we are

This website is operated by BGC Consulting. You can contact us at hello@bgcconsulting.co.uk.

We are the “controller” of the personal data described in this policy, which means we decide how and why it is used.

2. The data we collect

• Contact and identity details — your name, email address and phone number.
• Discovery call information — your chosen call time and the career goals you tell us about.
• Account details — your login email and a securely hashed password (we never store your password in readable form).
• Purchase information — the programmes you buy, amounts paid, invoices and booking history. Card payments are handled by Stripe; we never see or store your full card details.
• Career information — your CV and any feedback we prepare, and notes from your coaching sessions.
• Communications — emails and messages you send us, and records of emails we send you.
• Marketing preferences — whether you have opted in to marketing emails, and when.
• Technical data — your IP address and basic device information, used for security (for example, to prevent fraud and repeated failed login attempts) and, if you accept advertising cookies, to measure our adverts.

We do not intentionally collect special category data (such as health information). Please don't include it in your CV or messages unless you want us to take it into account — if you do, we'll only use it to support you and with your explicit consent.

3. How and why we use your data

We do not sell your personal data, and we do not make decisions about you based solely on automated processing.

4. Marketing emails

We only send marketing emails if you have opted in — for example by ticking the box when you register or buy a programme. You can withdraw your consent at any time by clicking “unsubscribe” in any marketing email or by emailing hello@bgcconsulting.co.uk. Unsubscribing won't affect service emails about bookings or purchases you've made.

5. Who we share your data with

We use trusted service providers (“processors”) who only process your data on our instructions and under contracts that protect it:

• Cloudflare — website hosting, database and file storage, and security.
• Stripe — secure card payments. Stripe is also an independent controller for some payment data; see Stripe's privacy policy.
• Resend — sending our emails.
• Zoom — hosting discovery calls and coaching sessions.
• Google and YouTube — hosting some programme videos and documents you choose to view.
• Meta (Facebook) — only if you accept advertising cookies: the Meta Pixel tells Meta which pages you visit on our site and whether you book a call, register or enrol, so we can measure and improve our adverts. Meta is a joint controller with us for this data collection and an independent controller for how it then uses it — see Meta's Privacy Policy.

We may also share data with our professional advisers (such as accountants), and where required by law, with HMRC, the police or other authorities. If our business is ever sold or restructured, your data may transfer to the new owner, who must continue to protect it.

6. International transfers

Some of our providers process data outside the UK, including in the United States and the European Economic Area. Where this happens we make sure your data is protected — for example through the UK–US data bridge, UK adequacy regulations, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

7. How long we keep your data

• Discovery call enquiries (if you don't become a client) — up to 2 years after your call, then deleted.
• Client account and programme records — for as long as your account is active, then up to 6 years to deal with any queries or claims.
• Financial records (invoices, payments) — 6 years from the end of the financial year, as required by UK tax law.
• Marketing preferences — until you unsubscribe; we then keep a record that you opted out so we don't contact you again.
• Security logs — short periods, typically no longer than 30 days.

You can ask us to delete your account at any time (see your rights below).

8. Keeping your data secure

We use encryption in transit (HTTPS), hashed passwords, access controls and reputable providers to protect your data. If a data breach occurs that is likely to put you at risk, we will tell you and the ICO where the law requires us to.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to how we use it (including an absolute right to object to direct marketing);
• data portability — receive data you gave us in a reusable format;
• withdraw consent at any time where we rely on consent.

To exercise any of these rights, email hello@bgcconsulting.co.uk. We'll respond within one month, and there's usually no charge. We may need to confirm your identity first.

10. Cookies

We use essential cookies for the site to work, and Meta advertising cookies only if you accept them. You can change your choice at any time using “Cookie settings” in the footer. See our Cookie Policy for details.

11. Complaints

If you're unhappy with how we've handled your data, please contact us first and we'll do our best to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

12. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it was last changed. If we make significant changes, we'll let clients know by email.