Privacy Policy
We are committed to protecting your personal information and respecting your privacy. Our Privacy Policy outlines how we collect, use, and safeguard your data. Read on to learn more about your rights and our practices.
Our Responsibilities
This Privacy Policy for Bridewell Consulting Limited (‘Bridewell’, ‘we’, ‘us’, or ‘our’,) describes how and why we collect, store, use, and/or share, (‘process’) your personal data and information when you use our services (‘Services’) such as when you:
Visit our website at https://www.bridewell.com
Express an interest in or take up one of our Services.
Engage with us in other related ways, including any sales, marketing, or events.
Bridewell are responsible for the data we collect and process for our own purposes. We’re committed to maintaining the security and privacy of the personal data we process, both through our website or through our interactions with clients, prospects, or industry partners.
Whether we are supporting our clients or managing our own data, privacy and security are at the heart of our operations. Whilst we take appropriate measures in our own practices, security and privacy is at the core of our business operations, so it is imperative we operate in accordance and where possible above industry and regulatory requirements.
Contacting us
Should you wish to contact us to find out more about how we process personal data and information, to exercise your rights, make a complaint or to discuss our practices, please use the following details:
Email: dataprivacy@bridewell.com
Post: Data Protection Officer, Bridewell Consulting Ltd, Thames Tower, Station Road, Reading, RG1 1LX , Reading,.
Telephone: +44 (0) 3308 285 883
What personal data will we collect about you?
Personal data or personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data and personal information which have been grouped together below:
Category | Personal Data Items |
Identity data | |
Contact data | Includes postal address, email address and telephone or mobile number. |
Internet or other similar network activity | Online behaviour and interactions with our and other websites, applications, systems, advertisements and electronic communications. Some of this information will be collected through cookies, tracking pixels and similar technologies. You can read more about this in our Cookie Policy. |
Professional or employment-related information | Business contact details to provide you our Services at a business level or job title. |
How will we collect your personal data?
We use different methods to collect data from and about you including:
Information provided by you: The information we collect from you depends on the context of your interactions with us and the Services, the choices you make, and the products you use. We will typically collect personal data directly from you via our website or in-person, such as during an industry event.
Third parties or publicly available sources: To enhance our ability to provide relevant marketing, offers, and Services to you and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, data providers, and from other third parties. Third party sources include but are not limited to: Cognism Limited, Foundry, LinkedIn, Pulse, Trident search and DWCC (US). Where we obtain your personal data from third-party data providers or publicly available sources, this will generally comprise professional or business contact information such as your name, employer, job title, professional contact details and information relating to your professional role or organisation.
Information automatically collected: We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes. Like many businesses, we also collect information through cookies, tracking pixels and similar technologies, including information about interactions with our website and electronic communications, such as whether an email has been opened or a link has been clicked.
Special Category and criminal-offence data
We do not generally seek to collect special category personal data or criminal offence data through our website or ordinary client and business interactions. We may, however, process such information in limited circumstances, including in connection with recruitment, security vetting, accessibility or reasonable adjustment requirements, or where required or permitted by law. Where we do so, we will identify an appropriate lawful basis and, where applicable, an additional condition under Articles 9 or 10 UK GDPR and the Data Protection Act 2018.
How do we use your personal data?
The following table sets out why we process your personal data and information, including our lawful basis for processing your personal data, in accordance with UK and EU Legislation. We may rely on more than one lawful basis for processing your personal data depending on the context of the processing activity.
Purpose/activity | Lawful basis for processing | Personal Data Categories |
To provide our services | This processing is carried out in our legitimate business interests of providing you with our services. | · Name |
To handle website enquiries | This processing is carried out for our legitimate interests, enabling Bridewell to facilitate to your enquiry. | · Name |
To engage with prospective clients We may also maintain records of our sales and marketing interactions with you, including when and how you have been contacted, relevant communications and interactions, and your marketing preferences or objections. We use this information to manage our business development activities, maintain accurate contact histories and ensure that your marketing preferences are respected. | This processing is carried out for our legitimate interests of promoting our Services to your organisation, managing our business development activities, maintaining accurate records of our interactions with prospective and existing clients and ensuring that marketing preferences and objections are appropriately recorded and respected. | · Name · Marketing preferences and objections · Records of communication and interactions · Source of contact information |
To manage Financial Accounting and Administration | This processing is carried out for our legitimate interests with your organisation, or to meet our legal obligations for financial reporting. | · Name |
To collect information on Associates / Contractors | This processing is necessary for the performance of a contract with you, or to take steps prior to entering a contract when you are a named signatory within the contract. | · Name |
To recruit employees | This processing is necessary for the performance of a contract of employment with you, or to take steps prior to entering such a contract with you. | · Name |
To send you marketing and promotional communications: | This processing is carried out for our legitimate interests, for us to promote our Services or events to your organisation. Where we carry out direct marketing, we will also comply with the Privacy and Electronic Communications Regulations 2002 (PECR) where applicable. | · Full name |
To identify usage trends and understand our customer journeys: | This processing is carried out for our legitimate interests to analyse and improve your user experience understand engagement with our communications and improve the performance and effectiveness of our website and communications. Where consent is required under applicable law for the use of cookies, tracking pixels or similar technologies, we will obtain that consent. | · IP Address |
Teams meeting recordings | This processing is carried out in our legitimate interests of accurately capturing a Teams call/meeting. Bridewell will inform participants when a meeting is being recorded, explain the purpose and restrict access/retention appropriately. | · Full name |
Call logging | This processing is carried out in our legitimate interests of analysing and improving the user journey when contacting us. | · IP address |
CCTV | This processing is carried out in our legitimate interests of the prevention and detection of crime, for protecting the safety of individuals and the security of our premises. | · Moving images |
Brand Pages and Chatbots We offer content through social media, any information provided to us when you engage with our content (such as through our brand page or via our chatbot on the Site or Service) may be used. If public reference is made to our Service on social media (by using a hashtag associated with Sprout Social), we may use it on our Site or in connection with our Service | This processing is carried out for our legitimate interests of promoting our Services to you and your organisation. |
|
Where we process your personal data based on our legitimate interests, we have carried out a balancing exercise to make sure our legitimate interest does not override your privacy rights as an individual. We document the balancing exercises we carry out when relying upon this lawful basis for processing your personal data.
Sharing your personal data
As you’d expect, our employees will access personal information for the purposes mentioned above. For example, our Business Development staff may need access to your details to support you when you get in contact with us.
We will also share information with third parties including service providers, business partners and sub-contractors for business administration, support, processing, Services, or IT purposes.
Where appropriate, we may also share your personal data with our third-party partners, for the purpose of promoting or delivering our services and events. Our third-party partners include but are not limited to:
Please note that any third parties will only process your personal data for specified purposes and where they have contractually agreed to treat the information confidentially and to keep it secure.
We may also share your personal data with a third party who has purchased or merged with our organisation, in which case personal data held by us, about you, will be transferred to that third party to carry on our business. This may include members of the I-tracing Group and our investors.
Security of your personal data
At Bridewell we take the security of personal data extremely seriously. We have implemented cyber security and privacy controls including encryption, and a Business Management System (BMS) which underpins our ISO27001:2022, ISO14001:2015, ISO9001:2019, ISO27701:2019 and Cyber Essentials Plus Certifications.
Bridewell are also a certified National Cyber Security Centre (NCSC) consultancy and a registered member of the Council for Registered Ethical Security Testers (CREST), which ensures our methodologies used for delivery of our Services meet the expectations of the UK Governments Technical security arm.
We assess security for Confidentiality, Integrity, and Availability to ensure that data remains protected, accurate and available for its intended purposes. Some of the core controls we have implemented as part of these certifications are:
Multi-Factor Authentication (MFA) on all internet-based systems
Encryption of data at rest and in transit
Technical assessments of our systems for vulnerabilities and configuration weaknesses
Controlled access to only approved individuals
Screening of all employees to a minimum of the Baseline Personnel Security Standard (BPSS)
Data handling training for all employees
Policies and procedures on secure operations and configuration of systems
International Data Transfers
Although our systems and Services are primarily located within the United Kingdom and EEA, there may be occasions where your personal data will be processed in countries not deemed by UK and EU to have adequate Data Protection safeguards in place as some of our service providers and group companies may be located outside of the UK or may process personal data from locations outside of the UK.
Where we transfer personal data outside the UK, we will ensure that the transfer is made in accordance with applicable Data Protection Legislation. Where required, we will assess the relevant transfer and safeguards to ensure, reasonably and proportionately, that the standard of protection provided to your personal data is not materially lower than the standard of protection provided under UK Data Protection Legislation this will include undertaking a transfer risk assessment where required.
Automated decision making
From time to time and only in relation to roles where we receive a high volume of applications, we may use automated tools, including artificial intelligence, to assist us in reviewing and assessing applications. These tools may analyse information contained in CVs and applications and use that information to score or rank candidates against criteria relevant to the role, such as relevant skills, qualifications and experience.
The results of this automated assessment are used to support Bridewell’s recruitment process and may influence the decision on whether and how an application progresses through our recruitment process. In some circumstances, the initial screening and ranking of candidates may constitute automated decision-making, for example where the outcome of the automated assessment materially influences whether an application progresses to the next stage of our recruitment process.
There is always a human involved in the process and Bridewell uses these tools to help us manage high volumes of applications efficiently and consistently and to identify candidates whose skills, qualifications and experience appear to match the requirements of the relevant role. We rely on our legitimate interests in operating an effective and efficient recruitment process as our lawful basis for this processing.
We do not use special category personal data as part of the automated scoring or ranking of candidates.
Where we use automated decision-making in this way, we implement appropriate safeguards. You may ask us to provide further information about an automated decision, make representations about the decision, request that the decision is reviewed by a person and contest the decision. Any human review will involve an appropriate reconsideration of your application rather than simply confirming the automated outcome.
If you have concerns about the use of automated tools in relation to your application, wish to challenge an automated decision or would like us to carry out a human review, please contact careers@bridewell.com
How long will we keep your personal data?
Bridewell only processes personal data for as long as necessary to meet our legal obligations or where we have a legitimate business reason for keeping it. We review personal data on a case-by-case basis and document the period of retention for each.
The period for which we retain personal data varies according to the purpose for which it is processed. In determining appropriate retention periods, we consider the nature and sensitivity of the information, the purpose for which it was collected, the period for which it remains necessary for that purpose, applicable contractual requirements, limitation periods and our legal, regulatory and record-keeping obligations.
For further information on how long personal data is likely to be kept before being removed from our systems and databases, please contact us via: dataprivacy@bridewell.com
Your rights
Data Protection Legislation gives you a number of Rights over your information which are focused on placing you in control of how your data are processed.
You can exercise these Rights by emailing us at dataprivacy@bridewell.com or by writing to: Data Protection Officer, Bridewell Consulting Ltd, Thames Tower, Station Road, Reading, RG1 1LX , Reading, RG1 7EB.
We may verify your request and identity before any information is provided to you. This is to make sure you are entitled to receive the information.
You have the following Rights in relation to the processing of your personal data:
Data Subject Right | Description |
Right to be informed | A right to be informed about the personal data we hold about you. |
Right of access | A right to access the personal data we hold about you. |
Right to rectification | A right to require us to rectify any inaccurate personal data we hold about you. |
Right to erasure | A right to ask us to delete the personal data we hold about you. This right will only apply where (for example): |
Right to restrict processing | In certain circumstances, a right to restrict our processing of the personal data we hold about you. This right will only apply where (for example): |
Right to data portability | In certain circumstances, a right to receive the personal data you have given us, in a structured, commonly used, and machine-readable format. You also have the right to require us to transfer this personal data to another organisation, at your request. |
Right to object | A right to object to our processing of the personal data we hold about you where our lawful basis is for the purpose of our legitimate interests, unless we can demonstrate, on balance, legitimate grounds for continuing to process the personal data which override your rights, or which are for the establishment, exercise or defence of legal claims. Where you object to the processing of your personal data for direct marketing purposes, we will stop processing your personal data for those purposes. We may retain limited information on a suppression list to ensure that your marketing preference continues to be respected. |
Right to withdraw your consent | A right to withdraw your consent, where we are relying on it to use your personal data (for example, to provide you with brochures and newsletters). |
Right to complain | A right to complain to us about the way we have processed your personal data which we must acknowledge within 30 days and respond without undue delay. |
Your right to complain
If you’re unhappy with how we’re using your personal data, including how we collect use, or otherwise process your personal data you have the right to raise a complaint.
You can submit a data protection complaint by contacting us at dataprivacy@bridewell.com.
We will acknowledge receipt of your complaint within 30 days and take appropriate steps to investigate and respond to your complaint without undue delay. We will keep you informed about the progress and outcome of our investigation.
You also have the right to complain to a Supervisory Authority. In the UK, the Supervisory Authority is The Information Commissioner’s Office (ICO) who can be contacted by:
Visiting their website: www.ico.org.uk
Phoning: 0303 123 1113
Writing to: Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Additional Information for US Residents
If you reside in the US, this section supplements the information contained in the Privacy Notice. US residents have specific rights regarding their personal information.
Please note that in the preceding twelve months, we have not sold your personal information.
We may disclose certain personal information, such as your first and last name, email address, job title/position, and other similar contact data, financial information, and employment details with our subsidiaries and affiliates and other third parties, including service providers who provide Services on behalf of Bridewell. When personal information is disclosed to a subsidiary, affiliate or other third party the recipient entity will be obligated to provide the same level of privacy protection required under Applicable Data Privacy Legislation.
You have the following Rights in relation to the processing of your personal data:
Personal Information Right | Description |
Notice of and Access to personal information | A right to notice of and access to certain information about our collection and use of your information. |
Correction of personal information | A right to ask for inaccurate personal information be to be corrected. |
Deletion of personal information | A right to ask that we delete your personal information relating to you, subject to certain exceptions. |
Objection to the sale of or sharing of personal information | A right to ask for your personal information to not be sold or shared with a third party, subject to certain exceptions. |
To transmit personal information to another entity | A right to ask for your personal information to be transferred, in a readily useable format, to another entity. |
None of these rights are absolute and there may be circumstances in which we are required or permitted under applicable law not to address your request.
We may verify your request and identity before any information is provided to you. This is to make sure you are entitled to receive the information.
If you’d like to exercise any of your rights or have any questions, please contact us at dataprivacy@bridewell.com
Changes to our Privacy Policy
We keep this Policy under review and will reflect any updates or changes to practice within this notice (to reflect changes in operations and the way we process your data). This notice was last updated in September 2026.
