Privacy and Cookie Policy
For: Build Secure Thinking Ltd
Website: buildsecurethinking.com
Last updated: 14 September 2026
1. Who we are
Build Secure Thinking Ltd is a cybersecurity consultancy serving charities and third-sector organisations in the United Kingdom.
For data-protection purposes, Build Secure Thinking Ltd is generally the data controller for personal data collected through this website and for its own business administration, enquiries and marketing.
In some consultancy engagements, we may process personal data on behalf of a client. In those cases, the client may be the controller and Build Secure Thinking Ltd may be a data processor. The applicable client contract and data-processing agreement will govern that processing.
Controller contact details
- Legal name: Build Secure Thinking Ltd
- Address: 6a South Street, Leominster, England, HR6 8JB
- Privacy contact email: info@buildsecurethinking.com
- ICO registration number: ZB788100
- Data Protection Officer: Alison Crockford
2. What this policy covers
This policy explains how we collect, use, store and disclose personal data when you:
- visit buildsecurethinking.com;
- contact us through a form, email or another enquiry channel
- communicate with us about our cybersecurity consultancy services;
- use any account, client portal or login functionality we provide; or
- subscribe to receive email marketing from us.
This policy does not replace any privacy notice or data-processing terms that apply to a client engagement where we process data on a client's instructions.
3. Personal data we collect
Depending on how you interact with us, we may collect:
Information you provide to us:
- name and job title;
- organisation name and sector;
- email address, telephone number and other contact details;
- the contents of enquiries, messages and correspondence;
- information about your organisation's cybersecurity needs; and
- account or login information where a client portal or other restricted service is provided.
Information collected automatically:
We may collect limited technical information such as IP address, browser type, device type, operating system, approximate location, pages viewed, timestamps and website-security logs. The exact information depends on the hosting, security, analytics and cookie technologies enabled on the website.
Information received from others
We may receive information from your organisation, colleagues, service providers, professional advisers or publicly available sources where this is relevant to providing or discussing our services.
4. How we use personal data
We may use personal data to:
- respond to enquiries and requests for information;
- arrange calls, meetings, assessments or consultancy work;
- provide, administer and improve our services;
- create and manage client or user accounts where applicable;
- authenticate users and protect accounts, systems and information;
- maintain website, network and information security;
- investigate suspected misuse, fraud, abuse or security incidents;
- manage our business relationship and keep appropriate records;
- send service communications and administrative messages;
- send marketing emails where permitted by law and, where required, with your consent;
- understand website use and improve content, subject to applicable cookie and consent requirements;
- comply with legal, regulatory, accounting and insurance obligations; and
- establish, exercise or defend legal claims.
We will not use personal data for purposes that are incompatible with the purposes described here unless we provide further information and have a lawful basis to do so.
5. Our lawful bases
Under the UK GDPR, we rely on one or more of the following lawful bases:
Responding to an enquiry or taking steps at your request before a contract
Contract or pre-contractual steps, or legitimate interests where appropriate
Delivering agreed consultancy services - Contract
Managing accounts and authentication
Contract and legitimate interests in secure service delivery
Protecting systems and preventing misuse
Legitimate interests and, where applicable, legal obligations
Keeping business, financial and professional records
Legal obligation and legitimate interests
Sending direct marketing
Consent where required; otherwise legitimate interests only where permitted by applicable marketing rules
Non-essential analytics, advertising or similar cookies
Consent
Defending or establishing legal claims
Legitimate interests and, where applicable, legal obligation
Where we rely on legitimate interests, we balance those interests against your rights and expectations. You may object to processing based on legitimate interests; see section 11.
6. Email marketing
If you subscribe to our marketing emails, we may use your name, organisation and email address to send information about cybersecurity, charity and third-sector security, events, reports, services and related content.
We will send marketing in accordance with applicable UK electronic-marketing rules. Where consent is required, we will ask for it using a clear affirmative action. You can unsubscribe at any time by using the unsubscribe link in an email or by contacting us at info@buildsecurethinking.com.
Unsubscribing from marketing will not stop essential service or transactional communications, such as messages about an active engagement, account, security matter or legal obligation.
7. Cookies and similar technologies
Cookies are small text files or similar technologies placed on your device. They can remember preferences, support website operation, help protect the site and, where permitted, measure or personalise activity.
Strictly necessary technologies
These are required for the website to operate or for a service you have requested. They may include security, session, load-balancing, form-submission, consent-preference and authentication technologies. They do not normally require consent, but we will describe them accurately in our cookie controls.
We will not set non-essential cookies or use similar technologies that require consent until you have given a valid choice. You should be able to accept or reject non-essential categories separately, and change or withdraw your choice later through [INSERT COOKIE SETTINGS LINK OR BUTTON]. Rejecting non-essential cookies should not prevent access to the core website unless the relevant feature genuinely requires them.
8. Who we share personal data with
We may share personal data where necessary and lawful with:
- website hosting, security, form, email, customer-relationship-management and IT providers;
- email-marketing providers used to send and manage subscriptions;
- professional advisers, insurers, auditors and accountants;
- client organisations where this is necessary for an engagement or requested by you;
- courts, regulators, law-enforcement bodies or public authorities where legally required or permitted; and
- a buyer, prospective buyer or successor in connection with a business transfer, subject to appropriate safeguards.
Our website service provider Hostinger may process data only under appropriate contractual terms and according to our instructions where they act as processors. We do not sell personal data.
9. International transfers
Some providers may process personal data outside the United Kingdom. Where personal data is transferred internationally, we will use a lawful transfer mechanism and appropriate safeguards, such as UK adequacy regulations, UK International Data Transfer Agreements, UK Addendum arrangements or another mechanism recognised by applicable data-protection law.
Details of relevant transfers and safeguards are available from info@buildsecurethinking.com.
10. How long we keep personal data
We keep personal data no longer than is reasonably necessary for the purpose for which it was collected, taking account of legal, accounting, insurance, dispute-resolution and security requirements.
We determine the appropriate retention period by considering the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether those purposes can be achieved by other means, and applicable legal requirements.
This means, for example:
- enquiries are retained while they are being handled and afterwards only as reasonably necessary for follow-up, record-keeping or legal purposes;
- client and consultancy records are retained for as long as reasonably necessary to manage the relationship, meet professional, legal, insurance or dispute-resolution needs;
- account and authentication records are retained while the account is active and afterwards only as reasonably necessary for security, legal or dispute-resolution purposes;
- marketing preferences and suppression records are retained for as long as necessary to respect your choices and demonstrate compliance; and
- security and technical logs are retained only for the period reasonably required for security monitoring, investigation, incident response and legal purposes.
At the end of the applicable period, we securely delete, anonymise or otherwise dispose of personal data unless we need to retain it for a longer period required by law or necessary for a legal claim. Cookie durations are listed in the cookie inventory once completed.
11. Your data-protection rights
Subject to legal exceptions, you may have the right to:
- ask for access to your personal data;
- ask us to correct inaccurate or incomplete data;
- ask us to erase data;
- ask us to restrict processing;
- object to processing based on legitimate interests, and object to direct marketing at any time;
- ask for data portability where the legal conditions apply; and
- withdraw consent where processing is based on consent.
To exercise a right, contact us at info@buildsecurethinking.com. We may need to verify your identity before responding. We will normally respond within one month, although the law allows an extension for complex or multiple requests.
If you receive marketing from us, you can opt out at any time using the unsubscribe link in the message.
You also have the right to complain to the UK's Information Commissioner's Office. Information about the ICO is available at ico.org.uk. We would appreciate the opportunity to address your concern first, but this does not limit your right to complain.
12. Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures may include access controls, authentication, encryption where appropriate, secure configuration, backups, monitoring, staff confidentiality duties and incident-management procedures.
No online service can be guaranteed completely secure. If you believe your information or account has been compromised, contact us promptly at info@buildsecurethinking.com.
13. Automated decision-making and profiling
- We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.
14. Children's data
Our website and services are intended for organisations and professional users. We do not knowingly collect personal data directly from children for a service aimed at children. If you believe a child has provided personal data to us, contact info@buildsecurethinking.com.
15. Changes to this policy
We may update this policy to reflect changes to our services, technology, legal obligations or data practices. We will publish the updated version on this page and update the “Last updated” date. Where appropriate, we will notify you by another channel.
16. Contact us
For privacy questions, rights requests or concerns, contact:
Build Secure Thinking Ltd
Email: info@buildsecurethinking.com
Address: 6a South Street, Leominster, England, HR6 8JB
ICO registration number: ZB788100
Data Protection Officer: Alison Crockford