This data privacy notice explains how BSL Group companies collect and use personal information in a number of different situations.
The contact details of BSL’s data controllers are available via the contact us page.
If you have a contractual relationship with BSL, the company identified in that contract will be the data controller of your personal information.
Where processing of personal information is carried out by another group company for its own purposes, that other group company may also be a data controller of your personal information.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If the way that personal information will be managed differs from the details provided in this notice or is incompatible with the original purpose the data was collected for, additional information regarding this processing will be provided to you.
If necessary, we will collect consent from you and advise you of the impact of not providing any such consent. You should be aware that it is not a condition or requirement of your relationship with us that you agree to any request for consent from us.
Please note that we may process your personal information without your knowledge or consent, in compliance with the information set out in this notice, where this is required or permitted by applicable law.
We may amend the content of the notice from time to time to keep it up to date with current legal requirements and the way we operate our business.
In order to carry out any processing of your personal information, we need to ensure that we have a particular reason to do so. We have set out the reasons we have for processing your personal information in the various sections of this notice.
The reasons that we have for processing your personal information directly relate to the legal grounds for processing set out in applicable data protection laws. We have also identified these legal grounds within this notice where they apply.
Please contact us if you have any questions or would like more detail regarding our reasons for processing your personal information.
The general legal grounds for processing all types of your personal information and what they mean are described further below:
In order to carry out any processing of your special categories of personal information, we need to ensure that we have a particular reason to do so, in addition to the general legal grounds set out above. This reason needs to relate to one of the additional legal grounds for processing set out in applicable data protection laws.
We have set out the reasons we have for processing your special categories of personal information in this notice, along with the relevant general and additional legal ground for processing. These additional legal grounds for processing special categories of personal information and what they mean are described further below:
In some cases, you will be free to withhold personal information from us, however if you do withhold specific information we may not be able to continue our relationship with you, if we believe we require the relevant information to support the effective and efficient administration and management of that relationship.
For example, for employees, we require your identity information, contact and payroll information in order to pay you. If this is not provided, we may be unable to manage our contractual relationship.
In addition, for representatives of suppliers or customers, if we do not have your identity and contact information, we will not be able to communicate with you regarding the relevant commercial transaction between the relevantBSL company and that supplier or customer.
In most cases, we receive personal information directly from you. You either provide this to us at the outset of our relationship or do so at another time during your interactions with us. This will include personal information that you input into a form or through any self-service function, as well as information that you give to the HR team, your BSL contact and to any member of our workforce.
We may create personal information about you during your relationship with us - see internal sources below.
In some cases, we get personal information about you from third party sources - see external sources below.
In addition to the personal information that you provide to us, we may generate some further personal information internally. This will usually be generated by HR, line management or your BSL company contact, as appropriate.
In some circumstances, data may be collected indirectly from monitoring devices or by other means (for example, building and location access control and monitoring systems, CCTV, telephone logs and recordings and email and Internet access logs), if and to the extent permitted by applicable laws. In these circumstances, the data may be collected by us or a third party provider of the relevant service on our behalf.
We may also obtain some information from third parties.
If you are a representative of a supplier or a customer, we may receive your personal information directly from that company or from your colleagues. We may also use third parties to carry out anti-money laundering, anti-bribery and corruption and Know Your Client checks.
If you are an applicant for a role with us, a potential or current supplier or contractor or an employee, we may obtain references from a previous employer, medical reports from external professionals, criminal records checks, social media checks, information from tax authorities, benefit providers or from a third party that we engage to carry out a background check to include address, education and employment verification (where permitted by applicable law).
Within the BSL Group, your personal information can be accessed by or may be disclosed internally on a need-to-know basis - see internal recipients in the table below.
Your personal information may also be accessed by third parties, including suppliers, advisers, national authorities and government bodies - see external recipients in the table below. We have sought to identify these parties in this Notice.
In addition, there are circumstances where we may need to disclose your personal information to third parties, to help manage our business and deliver our services. We may disclose your personal information to third parties if:
Where these third parties (or any others) act as a data processor (for example, a benefits provider), they carry out their tasks on our behalf and upon our instructions for the reasons that we have set out in this notice. In this case your personal information will only be disclosed to these parties to the extent necessary to provide the required services.
Internal recipients of your personal information may include:
Personal information may also be shared inside of the Group between certain interconnecting IT systems.
In addition, where relevant, certain basic personal information (which may include your name, location, job title, contact information and any published skills and experience) may also be accessible to the relevant BSL company's employees for the purposes set out in this notice.
External recipients of your personal information may include:
For candidates applying for roles with us, we will retain the information provided to us for a reasonable period and may put you forward for jobs other than the one you applied for, including with our customers.
Personal information contained in our IT systems may be accessible by providers of those systems, their associated companies and sub-contractors (such as those involved with hosting, supporting and maintaining the framework of our HR information systems).
We expect these third parties to process any data disclosed to them in accordance with the contractual relationship we have with them and applicable law, including with respect to data confidentiality and security.
In addition, we may share personal information with national authorities in order to comply with a legal obligation to which we are subject. This is for example the case in the framework of imminent or pending legal proceedings or a statutory audit.
We share your personal information within the BSL Group as set out in this notice, which could include transfers between the UK, Oman, Turkey and Qatar on secure networks that may use servers and support services in other jurisdictions. Some of the people who access your personal information may not therefore be in the same country as you.
In addition, some of the external organisations we share your personal information with may be located in a different country. We will always take steps to ensure that any transfer of information is carefully managed to protect your privacy rights:
If you have any questions regarding overseas transfers, please contact us for further details.
We will retain your personal information for as long as is reasonably necessary for the purposes explained in this notice.
In some circumstances we may retain your personal information for longer periods of time than is needed for those purposes described in this notice. For instance: where we are required to do so in accordance with legal, regulatory, tax or accounting requirements; to ensure that we have an accurate record of your dealings with us in the event of any complaints or challenges; or if we reasonably believe there is a prospect of litigation relating to your relationship with us.
We maintain policies governing the creation, retention and disposal of records in our care. These policies set out our requirements for the management of records, including guidance on keeping personal information as current as possible, securely deleting records and irrelevant or excessive data, and storing information anonymously or in a manner which no longer identifies you.
Apart from personal information relating to you, you may also provide us with personal information of third parties, for instance, your family or dependants, or your colleagues. This information will be managed in line with this notice.
Before you provide information about others to us, you must first inform these individuals that you intend to provide their details to us and of the processing to be carried out by us, as detailed in this notice.
BSL aims to ensure that all personal information is correct. You also have a responsibility to ensure that changes to your personal information are notified to the relevant BSL company as soon as possible so that we can ensure that your data is up-to-date.
You have the right to request access to any of your personal information that BSL may hold, and to request correction of any inaccurate data relating to you.
You should note that we do not always need to comply with your requests, but we will ensure that this is explained to you if this is the case.
Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the reason or legal ground for processing, and that personal information is processed by automatic means, you have the right to receive all such personal information which you have provided to BSL in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.
You have a right to request that we rectify inaccurate personal information. We may seek to verify the accuracy of the personal information before rectifying it.
You can also request that we erase your personal information in limited circumstances where:
We are not required to comply with your request to erase personal information if the processing of your personal information is necessary:
You have the right to restrict our processing of your personal information but only where:
Where personal information is subjected to restriction in this way, we will only process it with your consent; for the establishment, exercise or defence of legal claims; or to protect the rights of another natural or legal person.
Where you have provided us with your consent to process data, you have the right to withdraw such consent at any time. You can do this by (i) in some cases deleting the relevant data from the relevant IT system (although note that in this case it may remain in back-ups and linked systems until it is deleted in accordance with our policy) or (ii) contacting us.
Where the reason for processing your personal information is our legitimate interests, you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as the legal ground for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.
You have the right to object to any decision that significantly affects you being taken solely by a computer or other automated process. In such a case, you have the right to obtain human intervention, to express your point of view, and to contest the automated decision.
You can request that we change the manner in which we contact you for marketing purposes. You can request that we not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.
You can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred to different countries. We may redact data transfer agreements to protect commercial terms.
You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, if you consider that the processing of your personal information infringes applicable law.
For further information regarding your rights, or to exercise any of your rights, please contact us.
If you wish to exercise your rights, you should contact us or make contact with your usual BSL contact or manager.
We may ask you for proof of identity when making a request to exercise any of these rights. We do this to ensure we only disclose information or change account details where we know we are dealing with the right individual.
We will not ask for a fee, unless we think your request is unfounded, repetitive or excessive. Where a fee is necessary, we will inform you before proceeding with your request.
We aim to respond to all valid requests within one month. It may however take us longer if the request is particularly complicated or you have made several requests. We will always let you know if we think a response will take longer than one month. To speed up our response, we may ask you to provide more detail about what you want to receive or are concerned about.
We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others, or if we are otherwise legally entitled to deal with the request in a different way.
If you are not satisfied with the level of information provided in this notice, you can ask us about your personal information using the contact details provided.
We may amend this notice from time to time, for example, to keep it up to date or to comply with legal requirements or changes in the way we operate our business.
Last Updated: September 2025