Privacy Policy

Guardian Support Privacy Notice

Last updated: 11th September 2026

1. About this notice

This privacy notice explains how Bushell Investment Group Business Services Limited, trading as Guardian Support ("Guardian Support", "we", "us" or "our"), collects and uses personal data and the rights available to individuals under the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and other applicable data protection legislation.

We act as a controller when we decide why and how personal data is used. When we handle personal data on a client's instructions in providing HR, employment law, health and safety or related services, we may act as that client's processor.

2. Personal data we collect

Personal data is information relating to an identified or identifiable individual. Depending on how you interact with us, we may collect contact and identity details; employment and business information; enquiry, contract and account records; payment and transaction information; communications; marketing preferences; and technical and usage information such as IP address, device and browser information, pages viewed, referring source and cookie or similar identifiers.

Special category and criminal offence data

Special category data includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data, biometric data used to identify a person, data concerning health, or data concerning a person's sex life or sexual orientation. Information about criminal convictions and offences is subject to separate legal safeguards.

We process this information only were permitted by law and, where we act for a client, in accordance with the client's documented instructions.

3. How we collect personal data

We collect personal data directly from you when you contact us, request a quotation, enter into or manage a contract, use our services, attend training, subscribe to updates or communicate with us. We may also receive data from a client, employer, supplier, professional adviser, public source or service provider, and collect technical information automatically when you use our website.

4. Purposes and lawful bases

Purpose: Responding to enquiries and providing quotations Typical data: Contact details, organisation, enquiry records Lawful basis: Steps requested before entering into a contract; legitimate interests in managing enquiries and developing our business

Purpose: Delivering and managing services and client accounts Typical data: Contact, account, contract, employment and payment information Lawful basis: Contract; legal obligation; legitimate interests in delivering and administering services

Purpose: Providing HR, employment law, health and safety and related support for clients Typical data: Client employee records, which may include special category or criminal offence data Lawful basis: Where we are a controller: legal obligation, legitimate interests and an applicable condition under data protection law; where we are a processor: the client determines the lawful basis and instructs us

Purpose: Operating, securing and improving our website and systems Typical data: IP address, device, browser, usage and security information Lawful basis: Legitimate interests in operating and protecting our services; consent where legally required for non-essential cookies or similar technologies

Purpose: Marketing, business-to-business lead generation and retargeting Typical data: Business contact details, preferences, IP address, website activity and inferred business interest Lawful basis: Consent where required under electronic communications law; otherwise legitimate interests, subject to your rights

Purpose: Meeting legal, regulatory and professional obligations and handling claims Typical data: Relevant records and communications Lawful basis: Legal obligation; legitimate interests in establishing, exercising or defending legal claims

5. Service communications and marketing

We may send service and legal updates that are necessary to perform our contract or support the services you receive. We send promotional marketing only where permitted by applicable law, relying on consent or the business-to-business marketing rules and our legitimate interests as appropriate.

Every marketing email includes a way to opt out, and you may object to direct marketing at any time. If you opt out of direct marketing or object to our use of Lead Forensics for lead generation, we will add your organisation's details to our internal suppression list. This ensures we do not contact you again unless you ask us to. The suppression list is retained for 5 years from the date you opt out, after which it is deleted.

After 5 years, if there is a significant change in our services or your business circumstances, we may contact you again based on legitimate interests. If you do not wish to be contacted after this period, you may object again at any time.

6. Sharing personal data

We share personal data only where there is a lawful basis and the disclosure is necessary for the relevant purpose. Recipients may include service providers acting on our instructions, professional advisers, occupational health providers, training providers, payment and technology providers, business partners where you request an introduction, regulators, law-enforcement bodies, courts and other parties where disclosure is required by law or necessary to establish, exercise or defend legal claims. Our processors are subject to contractual confidentiality and data protection obligations.

7. Website cookies and similar technologies

Our website uses cookies and similar technologies to operate the website, remember choices, understand how visitors use the site and, where you consent, support advertising and retargeting.

Strictly necessary technologies are used because they are required to provide the website. Analytics, advertising and retargeting technologies are used only after the required consent has been obtained. Our cookie controls allow you to accept, reject or change your choices at any time.

Lead Forensics: how we identify business visitors

We use Lead Forensics technology on our website to help identify the organisations (rather than individual people) that visit our site. This helps us understand which companies are interested in our consultancy services and enables us to follow up on genuine business opportunities.

In our current configuration, UUID tracking is disabled and Lead Forensics does not use a cookie or other identifier stored on your device. Instead, we process your IP address together with the date, time, pages you viewed, and the source that brought you to our site. Lead Forensics matches your business IP address against its global business database and tells us the name, location, industry and size of your organisation. We cannot identify you as an individual.

What we use this information for:

• Understanding which organisations are researching our services
• Generating qualified business leads from website visitors who have not yet completed a contact form
• Contacting relevant organisations with information about our consultancy services

Why we consider this lawful: legitimate interests

We rely on our legitimate interests in identifying new potential business customers from those who visit our website, developing and maintaining relevant business relationships with organisations interested in our services, and operating and optimising our business in an effective and competitive way.

Why we believe this is fair to you:

• You are not identified as an individual. We only know which company you work for.
• If you visited our website through an advert or search, or actively sought our consultancy services, you have already shown business interest, so a follow-up about our services is reasonably foreseeable.
• This is standard practice in B2B marketing. Organisations visiting a consultancy's website expect to be contacted with relevant service information.
• We do not profile you or make automated decisions. We use the data only to identify potential customers and send you relevant, targeted information.
• We retain the data only for 12 months, minimising any privacy impact.

Your rights: You may object to this processing at any time. If you object, we will stop processing your organisation's IP address for lead generation and will add you to our suppression list so that we do not contact you again. To object, contact us using the details in Section 11.

Future changes to our Lead Forensics configuration: If we enable the optional Lead Forensics cookie (UUID tracking) in future, we will update this privacy notice and obtain your prior consent. The Lead Forensics cookie allows us to recognise your organisation when you return to our website, which improves lead matching but is not essential to our service.

Analytics and advertising services

We use the following third-party analytics and advertising providers, but only when you give us consent through our cookie banner:

Service: Google Analytics Purpose: Measures website traffic, user behaviour, conversion rates and site performance. Helps us understand how visitors use our website. Provider & Location: Google LLC (US). Data transferred to US under Google's data processing agreement. Service: Google Ads Purpose: Displays our advertisements on other websites and measures advertising campaign performance. Provider & Location: Google LLC (US). Data transferred to US. Service: Meta Pixel Purpose: Retargets visitors who have previously visited our site with relevant advertisements on Facebook and Instagram. Provider & Location: Meta Platforms, Inc. (US). Data transferred to US.

How to manage your cookie consent: Our cookie consent banner appears when you first arrive at our website. It shows:

• Strictly necessary cookies (always on – these are required for the website to work)
• Analytics cookies (opt-in)
• Marketing and retargeting cookies (opt-in)

You can:

• Accept all non-essential cookies by clicking 'Accept All'
• Reject all non-essential cookies by clicking 'Reject All'
• Customise your choices for each cookie category by clicking 'Manage Preferences' You can change your cookie preferences at any time by clicking the 'Manage Cookies' button in the footer of the website. Withdrawing or changing your consent: Consent can be withdrawn at any time. Withdrawal does not affect any processing that occurred before you withdrew consent. When you withdraw consent, we will stop using the relevant analytics or advertising services for future visits.

8. International transfers

We may transfer personal data outside the United Kingdom where this is necessary to provide our services. Where we do so, we ensure the same standard of protection applies as would be required within the UK.

How we protect international transfers:

• UK adequacy decisions: we may transfer data to countries that the UK government has formally recognised as having adequate data protection laws (including EEA countries under equivalent protections)
• UK International Data Transfer Agreements (ITAs) or UK Addendum to Standard Contractual Clauses: we require contractual commitments from overseas recipients to protect your data to the same standard as UK law
• UK-approved Binding Corporate Rules: for organisations with international group companies

International transfers via Lead Forensics: Lead Forensics is a UK and US-based company. Your IP address and visit information processed through Lead Forensics may be stored and processed in the United States. Lead Forensics operates under the UK International Data Transfer Agreement framework. For details of the specific safeguards applied to your data, contact our data protection team using the details provided in Section 11.

9. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Specific retention periods depend on the type of data and your relationship with us:

Data Category: Website visitor IP address (Lead Forensics) Retention Period: 12 months from date of visit. You may request deletion at any time.

Data Category: Contact enquiries and quotation requests Retention Period: 3 years from last interaction or 2 years from date of collection, whichever is longer, to comply with limitation periods for contract claims.

Data Category: Website analytics (Google Analytics) Retention Period: Aggregated data for 26 months. Individual session data for 14 months.

Data Category: Marketing suppression list Retention Period: Until you request removal, or for 5 years, whichever is sooner. This respects your opt-out preference.

Data Category: Client HR/employee records (where we act as processor) Retention Period: In accordance with client's written instructions and applicable employment law, typically 6 years following termination of employment.

Data Category: Legal, regulatory or compliance records Retention Period: As long as required by law. Specific periods vary by regulation (6-20 years depending on the obligation).

At the end of the relevant retention period, data is securely deleted or anonymised unless a longer period is required by law or we need to retain it to establish, exercise or defend legal claims.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and accidental loss, destruction or damage. Access is limited to people who need the information for authorised purposes, and relevant staff and suppliers are subject to confidentiality and security obligations.

11. Your rights

Depending on the circumstances, you may have rights to be informed; obtain access to your personal data; have inaccurate data corrected; request erasure or restriction; receive certain data in a portable format; object to processing based on legitimate interests; object at any time to direct marketing, including related profiling; withdraw consent at any time; and receive safeguards relating to solely automated decisions that have legal or similarly significant effects.

These rights are not absolute and exemptions may apply.

How to contact us about your data: To exercise any of the rights listed in this notice, or if you have questions about how we use your personal data, please contact our Data Protection Officer using any of the following methods:

• Email: info@guardiansupport.co.uk
• Post: Guardian Support, Nationworld House, Noose Lane, Willenhall, WV13 3AP, United Kingdom
• Phone: 0845 26 26 260

Please include in your request:

• Your full name and contact details
• Details of what right you are exercising (e.g., access, correction, deletion, portability)
• Any additional information that will help us locate your records (dates, account numbers, etc.)

Our response timescale: We will respond to your request within one calendar month of receipt. We may extend this by up to two further months if your request is complex or if we receive multiple requests from you. If we extend the deadline, we will tell you why.

We may ask you for further information to confirm your identity or to locate the relevant records. We will not delay our response unreasonably to collect this information.

If you are dissatisfied with how we use your personal data, please contact us first so that we can try to resolve the issue. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Current contact details are available on the ICO's website at www.ico.org.uk.

12. Automated processing and profiling

We use limited profiling in connection with website analytics, business-to-business lead identification, marketing and retargeting, including grouping activity by organisation or inferred business interest. This does not produce legal or similarly significant effects for individuals.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. You may object to profiling used for direct marketing and withdraw consent for non-essential website technologies at any time.

13. Changes to this notice

We review this privacy notice regularly and may update it when our processing activities, suppliers or legal obligations change. The date shows when it was last updated.

Version history

Date: 2018

Version: 1.0

Key Changes: Original version

Date: 11th September 2026

Version: 2.0

Key Changes: Enhanced transparency on retention periods, Lead Forensics legitimate interests, international transfers, and contact methods for data subject rights. Added specific analytics providers and cookie consent procedures. Improved plain language clarity throughout.