Privacy Policy

Who we are

BBH Partners, a London-based hotel mystery guest audit firm. BBH Partners is the trading name of Engbra Ltd, a company registered in England and Wales under company number 16853646, with its registered office at 86-90 Paul Street, London EC2A 4NE. Engbra Ltd is the data controller for the personal data described in this policy.

If you have any questions about this policy or how we handle your data, email office@bbhpartners.org or call 07943 152901.

What this policy covers

This policy explains what personal data we collect through www.bbh-partners.co.uk, why we collect it, how long we keep it, who we share it with and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Personal data processed during a mystery guest visit, quality audit or consultancy engagement is governed by the contract and non-disclosure agreement we sign with each client, not by this website policy.

Information we collect

We collect the following categories of personal data:

• Enquiry details you give us. When you submit the proposal form or email us, we receive your name, email address, job title, company or property name, the service you are interested in and the message you write.
• Correspondence. Emails, calls and meeting notes exchanged while we discuss a proposal or engagement.
• Technical and usage data. Our hosting provider records standard server logs (IP address, browser type, pages requested, timestamps) to run and secure the site. Our analytics tools record which pages are visited, how visitors move through them and, with Microsoft Clarity, anonymised session replays and heatmaps.

We do not knowingly collect special category data (such as health or biometric data) through this website, and the site is not directed at children under 18.

How we use your data and our lawful bases

• To respond to your enquiry and prepare a proposal. Lawful basis: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)), and our legitimate interest in running our business.
• To deliver and manage an engagement once you become a client. Lawful basis: performance of a contract.
• To keep the website secure and improve it, including understanding which pages are useful. Lawful basis: our legitimate interests in operating a reliable, safe and effective website.
• To comply with legal obligations, for example accounting and tax record keeping.

We do not sell personal data, and we do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

Cookies and analytics

This site uses two analytics services. Vercel Web Analytics collects aggregated page-view statistics without cookies and without identifying individual visitors. Microsoft Clarity records how visitors interact with pages (clicks, scrolling, anonymised session replays) and sets first-party cookies to recognise a returning browser. Clarity masks text typed into forms by default.

You can block or delete cookies in your browser settings at any time; the website will continue to work. We do not use advertising or cross-site tracking cookies.

Who we share data with

We share personal data only with service providers that process it on our behalf under contract:

• Resend delivers the email generated when you submit the proposal form.
• Vercel hosts the website and provides Web Analytics.
• Microsoft provides Clarity analytics.
• Professional advisers, insurers or authorities where the law requires it.

Some of these providers process data outside the United Kingdom, including in the United States. Where they do, we rely on safeguards recognised under UK GDPR, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework.

How long we keep your data

• Enquiries that do not lead to an engagement: up to 24 months after our last contact, so we can pick up the conversation if you return.
• Client records: for the duration of the engagement and up to 6 years afterwards, in line with UK limitation periods and accounting rules.
• Server logs and analytics data: for the retention period set by each provider, typically between 30 days and 25 months, after which they are deleted or fully anonymised.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data where we no longer need it;
• restrict or object to our processing, including processing based on legitimate interests;
• receive the data you gave us in a portable format;
• withdraw consent at any time where consent is the basis for processing.

To exercise any of these rights, email office@bbhpartners.org. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, although we would welcome the chance to resolve any concern first.

Security

The website is served over HTTPS, form submissions are validated and rate-limited against automated abuse, and access to enquiry emails is restricted to the BBH Partners team. Client engagements are additionally protected by non-disclosure agreements and UK GDPR-compliant handling protocols.

Changes to this policy

We may update this policy as our services or the law change. The date at the top of this page shows when it was last revised. This version was published on 20 October 2026.