Privacy Policy

Buying Support Agency Ltd (“BSA”, “we”, “us”) is committed to protecting your privacy. This policy explains what personal data we collect, how we use and protect it, who we share it with, and the rights you have. It applies to information we collect through this website and in the course of providing our cost-benchmarking and buying-group services.

Who we are

BSA is the data controller for the personal data described in this policy. Buying Support Agency Ltd is registered in England & Wales (company number 04448500), registered office c/o Business Control Limited, Red Lion Yard, Frome Road, Bath BA2 2PP. You can contact us about privacy on 0800 254 0344 or at infobuyingsupport.co.uk.

The information we collect

Depending on how you interact with us, we may collect:

• Contact and identification details — your name, business email address, telephone number, job title, and the name and address of your organisation.
• Enquiry and service information — the cost categories you’re interested in, your current suppliers, contract renewal dates, approximate spend, and notes about your requirements.
• Documents you provide — copy bills, invoices, statements and (for energy) a signed Letter of Authority, which we use to benchmark your costs. These may contain limited personal data, such as a named account holder.
• Website and device data — your IP address, and information collected through cookies and similar technologies (see “Cookies” below).

If you’re referred to us by one of our affiliate partners, we receive the business contact details and information they have gathered so that we can carry out a review for your organisation.

How we use your information, and our lawful bases

We use your personal data to:

• respond to your enquiries and provide our benchmarking and buying-group services (lawful basis: performance of a contract, or our legitimate interest in responding to enquiries and running our business);
• arrange introductions to supplier and broker partners and support the resulting relationships (legitimate interests / contract);
• send you marketing about our services where you have agreed to receive it (lawful basis: consent);
• maintain the accuracy of our records and meet our legal, accounting and regulatory obligations (legal obligation / legitimate interests);
• understand how our website is used so we can improve it (legitimate interests, and consent for non-essential cookies).
• We will not sell your personal data. Where we rely on consent, you can withdraw it at any time.

Who we share your information with

We share personal data only where necessary to provide our services or meet our obligations:

• Supplier and broker partners - where you ask us to benchmark a cost category, we share the relevant information with the trusted partner(s) who carry out the review and, if you proceed, the resulting supply. We tell you who a supplier is before you agree to anything.
• Service providers acting for us - providers that process data on our behalf under contract, including customer-relationship management, workflow automation, online forms, cloud document storage, electronic-signature and email-marketing tools, and advertising platforms. We keep this list under review, use only providers that offer appropriate safeguards, and will tell you our current providers on request.
• Professional advisers and prospective purchasers - in connection with professional advice or a sale of the business (see “Sale of business”).
• Authorities or regulators - where we are required to share information by law.

We do not sell your personal data to anyone.

International transfers

Some of our service providers are based outside the UK and the European Economic Area, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards — such as UK “adequacy” regulations, the UK Addendum to the EU Standard Contractual Clauses, or equivalent measures — to ensure your data is protected to UK standards.

Cookies and similar technologies

Cookies are small files stored on your device. We use them to make the website work, remember your preferences, understand how the site is used, and support our advertising. We also collect your IP address to help diagnose server issues and administer the site.

We use advertising and measurement cookies provided by Meta (Facebook), including the Meta Pixel, to measure and optimise our advertising and to recognise users across devices. Your use of third-party platforms such as LinkedIn, Meta (Facebook) and X (Twitter) is governed by their own policies, for which we are not responsible.

You can control cookies through your browser settings and, where shown, through our cookie banner. Blocking some cookies may affect how the site works.

How long we keep your data

We keep personal data only for as long as necessary for the purposes above and to meet our legal and accounting obligations. We review the accuracy of our records at least once every 12 months and will contact you to confirm your details remain correct and that you’re happy for us to keep them. For email marketing, we operate on an opt-in basis through our chosen platform; if opt-in isn’t confirmed, we remove the record within 30 days. You can ask us to delete your details at any time.

How we protect your information

We use appropriate technical and organisational measures to keep personal data secure, including reputable service providers with their own security controls, access restricted on a need-to-know basis, and internal procedures covering storage, access and disclosure. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your information.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data (the “right to erasure”);
• restrict or object to our processing;
• request portability of certain data;
• withdraw consent at any time where we rely on it.

To exercise any of these rights, contact us on 0800 254 0344 or via our enquiry form. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113 - though we’d welcome the chance to resolve any concern first.

Sale of business

If this business, or part of it, is sold or combined with another business, your details may be disclosed to our advisers and to prospective purchasers and their advisers, and passed to the new owners, who will continue to handle your data in line with this policy.

Links to other websites

Our website may contain links to other sites. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy notices. This policy applies only to information collected by this website.

Changes to this policy

We may update this policy from time to time. We’ll post any changes on this page and, where appropriate, let you know. Please check back so you’re aware of how we collect and use your information.

How to contact us

For any privacy queries, or to update or remove your details, call 0800 254 0344 or via our enquiry form.