Privacy Policy

Last updated: 21 August 2026

This privacy notice explains how BroadSteps Consultancy Ltd collects and uses personal information through this website, and your rights under the UK GDPR and the Data Protection Act 2018.

Who we are

BroadSteps Consultancy Ltd is a health and safety consultancy operating in the United Kingdom. For the purposes of UK data protection law, we are the data controller for personal information submitted through this website.

• Company registration number: 17270598
• Registered office: 20 Wenlock Road, London, England, N1 7GU
• Data protection contact: info@broadstepsconsultancy.co.uk

Information we collect

We collect personal information in two ways.

1. Information you give us through the contact form. When you submit an enquiry, we collect:

• Your full name (required)
• Your email address (required)
• Your message (required)
• Your company or organisation name (optional)
• Your telephone number (optional)
• The service you are interested in (optional)
• A record that you gave consent for us to respond

2. Technical information collected automatically by our hosting provider. When you visit this website, our host records standard request data such as your IP address, browser type and the pages requested. This is used to deliver the site and to maintain its security and availability.

We do not use website analytics, advertising, tracking pixels or profiling technologies on this website.

How we use your information

• To respond to your enquiry and provide the information or advice you have asked for
• To discuss and, where agreed, deliver consultancy services
• To keep a record of enquiries and the advice we have given
• To maintain the security, availability and integrity of this website

We do not sell your personal information, and we do not use it for marketing unless you separately ask us to.

Our lawful basis for processing

• Consent (UK GDPR Article 6(1)(a)) - for handling the enquiry you submit through the contact form. You may withdraw consent at any time.
• Legitimate interests (UK GDPR Article 6(1)(f)) - for keeping this website secure and available, and for keeping business records of the advice we provide.
• Contract (UK GDPR Article 6(1)(b)) - where your enquiry leads to us providing services to you.

Who we share your information with

We use the following service providers, who process data on our behalf or receive data as a necessary part of delivering this website:

• Vercel - hosting and delivery of this website, and the processing of contact form submissions. Vercel processes the technical request data needed to serve pages, such as your IP address.
• Resend - transactional email delivery. Personal information you submit through the contact form is processed by Resend in order to deliver your enquiry to our inbox.
• Google Fonts - typefaces are loaded from Google servers (fonts.googleapis.com and fonts.gstatic.com). Google receives your IP address as part of that request.
• Unsplash - some photographs are loaded from images.unsplash.com. Unsplash receives your IP address as part of that request.

International transfers

Some of our providers operate outside the United Kingdom. In particular, information submitted through the contact form is processed by Resend, whose service involves processing in the United States.

Where personal information is transferred outside the UK, that transfer is protected by the contractual and transfer safeguards that apply to the provider's service.

How long we keep your information

Enquiries that do not become engagements. We keep enquiry records for up to 12 months after the last meaningful interaction, unless there is an active complaint, dispute or legal requirement that means we need to keep them for longer. After that period we delete the information, or anonymise it where that is appropriate.

Client and engagement records. Where an enquiry becomes a client engagement, we keep the relevant client and engagement records for six years after the end of that engagement. A longer period may apply where it is required for legal, regulatory, tax, insurance, complaint or dispute purposes.

Retention is applied proportionately. We do not keep every piece of information for six years by default - the six year period applies to the records that need to be kept for the purposes described above, and information that no longer serves a purpose is deleted or anonymised.

Your rights

Under UK data protection law you have the right to:

• Ask for a copy of the personal information we hold about you
• Ask us to correct information that is inaccurate or incomplete
• Ask us to erase your information in certain circumstances
• Ask us to restrict how we use your information
• Object to processing carried out on the basis of legitimate interests
• Ask us to transfer your information to another organisation
• Withdraw your consent at any time, without affecting processing carried out before withdrawal

To exercise any of these rights, email info@broadstepsconsultancy.co.uk. We will respond within one month.

If you are unhappy with how we have handled your personal information, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or by calling 0303 123 1113. We would encourage you to contact us first so that we have the opportunity to put things right.

Security

This website is served over HTTPS, and enquiry data is transmitted over an encrypted connection. Credentials used to deliver enquiries are held server-side and are never exposed in the website's code. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

Changes to this notice

We may update this notice from time to time. The date at the top of this page shows when it was last revised.

Contact us

If you have any question about this notice or about how we handle personal information, email info@broadstepsconsultancy.co.uk.