Privacy notice

1. Who we are

BlueScale Talent Ltd, trading as BlueScale, is the data controller for the personal information described in this notice. That means we decide why and how it is used, and we are accountable for it.

• Registered in Scotland, company number SC876607.
• Registered office: Suite 2/3, 48 West George Street, Glasgow G2 1BP, United Kingdom.
• Contact for data protection matters: contact@bluescale.co.uk
• Registered with the Information Commissioner's Office as a data controller.

We are not required to appoint a Data Protection Officer. Enquiries about how we handle personal data are dealt with by the company's directors at the address above.

2. What we collect

Information you send us

If you use the enquiry form on our website, we collect the name, work email address, organisation and role you provide, the area of interest you select, and whatever you choose to write in the message field. If you contact us by email or telephone instead, we collect the contact details you use and the content of that correspondence.

Information we collect during an engagement

If your organisation becomes a client, we hold the business contact details of the people we work with, correspondence, meeting notes, and the documents produced as part of the engagement. Where those documents contain personal data belonging to your organisation, we normally act as a processor on your instructions under a separate agreement, and your own privacy notice will govern that data.

Technical information

Our website host records standard server log information when a page is requested, including the IP address making the request, the browser and operating system reported, the pages requested and the time of the request. This is used to operate and secure the site.

3. Where we get it

Most of the personal data we hold comes directly from you, when you contact us or when we work together.

We also carry out business development. Where we approach someone about our services, we may use business contact details that person has made available in a professional capacity — for example on a company website, a professional networking profile, or a public conference listing — together with information about their role and their organisation. We only use those details to make a relevant business approach, we identify ourselves clearly, and we stop on request. Section 10 explains how to object.

4. Why we use it, and our lawful basis

UK GDPR requires us to have a lawful basis for each use of personal data. Ours are set out below.

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms, and we have concluded that it is not, because the data involved is limited, professional in nature, and used in ways a business contact would reasonably expect. You can object at any time — see section 10.

We do not sell personal data, and we do not add enquirers to a marketing mailing list.

5. Who we share it with

We use a small number of established service providers to run the business. They process personal data on our instructions, under contract, and may not use it for their own purposes.

When your browser loads a page on this site it requests our typefaces from Google Fonts, which means your IP address is transmitted to Google in order to serve those files. No cookie is set by that request. If you would prefer to avoid it, most browsers and privacy extensions allow third-party font requests to be blocked, and the site remains fully readable without them.

We may also disclose personal data where we are required to by law, by a regulator or by a court, or where it is necessary to establish, exercise or defend legal claims.

6. Transfers outside the UK

Some of the providers listed above are based in the United States, so personal data may be transferred outside the UK. Where that happens, we rely on the safeguards permitted by UK data protection law — the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or another approved mechanism — together with the provider's own technical and organisational measures.

You can ask us for more detail about the safeguards that apply to a particular transfer using the contact details in section 13.

7. How long we keep it

• Enquiries that do not lead to work: up to 24 months from our last contact with you, then deleted.
• Client records: six years from the end of the engagement, to match the limitation period for contractual claims and HMRC record-keeping requirements.
• Accounting records: six years from the end of the relevant financial year, as required by law.
• Website server logs: retained by our hosting provider for a short period, typically no more than 30 days.
• Business development contacts: removed promptly if you ask us to stop contacting you, other than a minimal record kept so that we do not approach you again.

Where we no longer need personal data, we delete it or, where deletion is not immediately possible from backups, we put it beyond use until those backups expire.

8. How we protect it

Access to personal data is limited to those who need it to do their work. Company accounts are protected by multi-factor authentication, devices are encrypted and kept up to date, and data is encrypted in transit to and from this website and our email and storage providers.

No system can be guaranteed secure. If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell those affected where the law requires it.

Please do not send confidential or commercially sensitive material through the website form. If you need to share something sensitive, contact us first and we will agree a secure route.

9. Cookies and tracking

This website sets no cookies. It uses no analytics, no advertising or social media pixels, no session tracking and no profiling. Nothing is stored on your device by us, and there is no consent banner because there is nothing to consent to.

The only request made to a third party is the one that loads our typefaces, described in section 5.

10. Your rights

Under UK data protection law you have the following rights, which you can exercise free of charge:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete data where there is no good reason for us to continue holding it.
• Restriction — ask us to pause using your data while a concern is resolved.
• Objection — object to processing based on legitimate interests. Where you object to direct marketing or business development contact, we will stop, without exception.
• Portability — receive certain data in a portable format, or have it sent to another controller.
• Withdraw consent — where we have relied on consent, withdraw it at any time. This does not affect anything done beforehand.

To exercise any of these, email contact@bluescale.co.uk. We will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your information to someone else.

There is no automated decision-making or profiling that produces legal or similarly significant effects.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first — most issues are resolved quickly. You also have the right to complain to the UK supervisory authority at any time:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk

12. Changes to this notice

We review this notice when our services, systems or suppliers change, and at least annually. The date at the top of the page shows when it was last updated. Where a change materially affects how we use your personal data, we will take reasonable steps to tell you.