This document is a template provided for launch readiness and should be reviewed and approved by qualified UK legal counsel and your appointed Data Protection Officer before public release.
This Privacy Policy explains how BizCol ("we", "us") processes personal data when you use our website and services. We are committed to handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The data controller is BizCol, United Kingdom. For privacy enquiries, contact us via the Contact page or email support@bizcol.com.
2. Data we collect
- Account data: name, email address, password (hashed — never stored in plain text), role, and contact details.
- Profile data: for consultants — headline, bio, services, skills, certifications, and portfolio; for businesses — company details and business challenges.
- Engagement data: consultation requests, appointments, messages, and reviews.
- Payment data: handled by Stripe; we do not store card details on our systems.
- Technical data: IP address, device and browser information, and audit logs for security purposes.
- Usage data: pages visited, features used, and interaction patterns — used to improve the platform.
3. How we use your data (lawful bases)
- Contract: to provide the marketplace, manage accounts, process payments, and facilitate engagements between businesses and consultants.
- Legitimate interests: to keep the platform secure, prevent abuse, improve our services, and send service-related communications.
- Legal obligation: to comply with applicable UK law, including tax, fraud prevention, and regulatory requirements.
- Consent: where required — for example, marketing communications. You may withdraw consent at any time.
4. Sharing your data
We do not sell your personal data. We share data only as necessary:
- Between participants: when a business and consultant engage, certain profile and engagement data is shared between them as necessary to facilitate the service.
- Service providers: trusted processors (hosting, email delivery, payment processing) under appropriate data processing agreements.
- Legal requirements: where required by law, court order, or to protect the rights and safety of users or third parties.
5. Data retention
We keep personal data only for as long as necessary for the purposes described, or as required by law. When data is no longer needed, it is securely deleted or anonymised. Account data is retained while your account is active and for a reasonable period afterwards to handle any disputes.
6. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Erasure: request deletion of your data in certain circumstances.
- Restriction: ask us to restrict processing in certain circumstances.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interests.
- Withdraw consent: where processing is based on consent, withdraw it at any time.
To exercise any of these rights, contact us via the Contact page. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
7. Security
We apply appropriate technical and organisational measures including:
- TLS encryption for all data in transit (HTTPS everywhere).
- Passwords hashed using bcrypt — never stored in plain text.
- Role-based access control (RBAC) — data accessible only to those who need it.
- Audit logging of all significant platform actions.
- API rate limiting and brute-force protection.
No method of transmission over the internet is fully secure. We work to protect your data appropriately but cannot guarantee absolute security.
8. Cookies
We use essential cookies to operate the platform (session management, authentication). We do not use advertising or tracking cookies without your consent. For full details, see our Cookie Policy — available in the platform.
9. Third-party services
- Stripe: payment processing. Stripe's privacy policy applies to payment data.
- Hosting: our infrastructure is hosted on a UK-based server. Data does not leave the UK/EEA without appropriate safeguards.
- Email delivery: transactional emails are sent via our email provider under a data processing agreement.
10. Children
BizCol is a professional B2B service not intended for children under 18. We do not knowingly collect data from anyone under 18.
11. Changes to this policy
We may update this policy from time to time. Material changes will be highlighted on this page and, where appropriate, notified to users by email. Continued use of the platform after changes constitutes acceptance.
12. Contact
For any privacy questions or to exercise your rights, contact us: