Introduction

BBSA Associates Limited (“we”, “us” or “our”) provides marketing and related business services. This Privacy Notice explains how we collect, use, share and protect personal data collected through our website and in connection with inquiries, marketing communications and our business activities. It also explains your rights and how to contact us about our privacy practices.

Any personal data collected by us will be used only for the purposes described in this Privacy Notice or as otherwise permitted or required by applicable law. Information that has been effectively anonymized or de-identified so that it no longer identifies an individual is not personal data.

Data controller: BBSA Associates Limited

Our website may contain links to third-party websites, services and social media platforms. This Privacy Notice does not govern the privacy practices of those third parties. We encourage you to review their privacy notices when visiting or using their services.

I. What Personal Data do we collect and process?

The categories of personal data we may collect depend on how you interact with us.

CATEGORY OF PERSONAL DATA	INFORMATION THAT MAY BE PROCESSED
Contact information and identifiers	First name, last name, email address, telephone number, company, job title, online identifiers, IP address and similar identifiers where collected.
Website and usage information	Information generated through cookies, pixels, tags, scripts, log files and similar technologies where used, including website usage and analytics information.
Communications	Information that you provide when contacting us, submitting a form, making an inquiry or otherwise communicating with us.
Marketing information	Contact information and marketing preferences where you register to receive news, offers, updates or other communications from us.
Survey or research information	Information that you voluntarily provide if you participate in a survey or research activity operated by us.

Sources of Personal Data

We may collect personal data:

directly from you when you contact us, submit information through a form, subscribe to communications or otherwise interact with us;
automatically through cookies and similar technologies where these are used;
through service providers and technology platforms supporting our business activities; and
from clients, suppliers, business contacts or other lawful sources where applicable.

II. Purposes of processing and legal basis

PURPOSE	LEGAL BASIS / BASIS FOR PROCESSING
Responding to inquiries and communications	Our legitimate interests and, where applicable, taking steps at your request before entering into a contract.
Providing services and managing business relationships	Performance of a contract, pre-contractual measures and/or our legitimate interests, as applicable.
Responding to privacy rights requests and complying with legal requirements	Compliance with our legal obligations.
Sending marketing communications	Consent where required by applicable law and/or another lawful basis where permitted.
Operating, analyzing, improving and securing our website and business systems	Our legitimate interests and consent where required for cookies or similar technologies.
Internal administration, research, auditing, security, fraud prevention and legal compliance	Our legitimate interests and/or compliance with legal obligations, as applicable.

III. Service providers, suppliers and sharing of Personal Data

We may use third-party service providers, suppliers and technology platforms to support our website, communications, marketing activities and business operations.

PROVIDER / CATEGORY	PURPOSE FOR WHICH IT MAY BE USED
YouTube / Google	Video content and related website functionality where YouTube services are used or embedded.
Leadpages	Landing pages, forms and lead-generation functionality where used.
HubSpot	Customer relationship management, contact management, forms, marketing and related communications where used.
Zapier	Automation of workflows and transfer of information between services where configured by us.
Mailjet	Email delivery and marketing communications where used.
Other suppliers and service providers	We may use additional suppliers, contractors, professional advisers, technology providers and service providers from time to time where required to support our business operations and services.

Where a third party processes personal data on our behalf, access to that personal data will be limited to what is necessary for the relevant service and will be subject to applicable data protection, confidentiality and security requirements.

Certain third-party services may also process personal data as independent controllers for their own purposes. Where this occurs, their own privacy policies and terms apply.

We may also disclose personal data where necessary to comply with applicable law, legal proceedings, court orders or regulatory requirements; to establish, exercise or defend legal rights; to protect our rights, property or security; or in connection with a merger, investment, acquisition, reorganization, sale or other corporate transaction.

IV. International transfers

Some of the service providers and technology platforms used by us may process personal data in countries outside the United Kingdom or the country in which you are located.

Where BBSA Associates Limited transfers personal data internationally, we will address the transfer in accordance with applicable data protection and privacy law and use appropriate safeguards where required.

V. Your rights and choices regarding your Personal Data

Depending on the jurisdiction in which you live and the law applicable to the processing, you may have rights relating to your personal data.

These may include:

The right of access – you may request access to personal data that we hold about you and, where applicable, obtain a copy.
The right to rectification – you may request correction of inaccurate or incomplete personal data.
The right to erasure – you may request deletion of personal data in circumstances provided by applicable law.
The right to object – you may object to certain processing based on legitimate interests or to processing for direct marketing purposes.
The right to restrict processing – you may request that processing of your personal data be restricted in circumstances provided by applicable law.
The right to data portability – where applicable, you may request personal data in a structured, commonly used and machine-readable format.
The right to withdraw consent – where processing relies on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Direct marketing

You may unsubscribe from or object to direct marketing communications at any time by using the unsubscribe mechanism included in the communication or by emailing info@bbsa-marketing.com.

Exercising your rights

Requests concerning your personal data may be sent to info@bbsa-marketing.com. We may need to request information reasonably necessary to verify your identity and respond to your request.

VI. UK and European privacy rights

Where UK GDPR or EU GDPR applies, individuals may have specific rights in relation to their personal data, including rights of access, rectification, erasure, restriction of processing, objection to processing, data portability and withdrawal of consent where processing is based on consent.

These rights are subject to the requirements, conditions and exemptions contained in applicable data protection law.

If you are dissatisfied with the way in which we process your personal data, you may contact us at info@bbsa-marketing.com.

Individuals in the United Kingdom may also lodge a complaint with the Information Commissioner’s Office.

VII. United States

California residents

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to our processing, California residents may have specific rights concerning their personal information.

Depending on the circumstances and applicable law, these may include:

the right to know the categories and specific pieces of personal information collected about you;
the right to know the categories of sources from which personal information was collected;
the right to know the business or commercial purposes for collecting, using or disclosing personal information;
the right to know the categories of third parties to whom personal information has been disclosed;
the right to request deletion of personal information, subject to applicable exceptions;
the right to request correction of inaccurate personal information;
the right to opt out of the sale or sharing of personal information where applicable;
the right to limit certain uses and disclosures of sensitive personal information where applicable; and
the right not to receive unlawful discriminatory treatment for exercising applicable privacy rights.

Verification of California requests

We may take reasonable steps to verify the identity of a person submitting a California privacy request. Where permitted by law, an authorized agent may make a request on behalf of a California resident, subject to applicable verification and authorization requirements.

California Shine the Light

Where California’s “Shine the Light” law applies, California residents may have rights to request information concerning certain disclosures of personal information to third parties for those third parties’ direct marketing purposes. Applicable requests may be submitted to info@bbsa-marketing.com.

Nevada residents

Where Nevada privacy law applies, Nevada residents may submit applicable requests concerning covered information, including requests relating to the sale of covered information as defined by Nevada law.

Nevada privacy requests may be sent to info@bbsa-marketing.com.

Other U.S. privacy rights

Other U.S. state privacy laws may provide additional privacy rights depending on your state of residence, the type of personal information involved and whether the relevant law applies to BBSA Associates Limited. We will respond to applicable requests in accordance with the law governing the request.

VIII. Australia

Where Australian privacy law applies to BBSA Associates Limited, we will handle personal information in accordance with applicable Australian privacy requirements, including the Australian Privacy Principles (“APPs”) where they apply.

Where applicable, individuals may request access to personal information that we hold about them and may request correction of inaccurate, out-of-date, incomplete, irrelevant or misleading information.

Individuals may also raise questions or complaints concerning our handling of personal information by contacting info@bbsa-marketing.com.

Where personal information is disclosed to recipients outside Australia, we will address those disclosures in accordance with applicable Australian privacy requirements. The countries involved will depend on the suppliers, service providers and systems actually used for the relevant processing.

IX. Canada

Where Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) applies, we will handle personal information in accordance with applicable Canadian privacy requirements.

Where applicable, this includes requirements relating to accountability, identifying purposes for collecting information, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and the ability to challenge compliance.

Individuals may request access to personal information that we hold about them and may challenge its accuracy and completeness where permitted by applicable law.

Where consent is relied upon and applicable Canadian law permits withdrawal, individuals may withdraw consent subject to applicable legal or contractual restrictions and reasonable notice.

Questions, requests or complaints concerning Canadian privacy rights may be sent to info@bbsa-marketing.com.

X. Information processed for our clients

Where BBSA Associates Limited processes personal data on behalf of a client rather than determining the purposes and means of processing, the relevant client may be responsible for responding to requests concerning that personal data.

Where appropriate, we may refer a request concerning such personal data to the relevant client and support that client to the extent required by applicable law.

XI. Children

Our website and business services are intended for general or business audiences and are not directed at children. We do not knowingly use our website to collect personal data from children for marketing purposes.

If we become aware that personal data concerning a child has been collected in circumstances where it should not have been collected, we will address the information in accordance with applicable law.

XII. Data retention

Personal data will be retained for as long as reasonably necessary for the purposes for which it was collected and processed, taking into account applicable legal, regulatory, contractual, accounting and operational requirements.

Retention periods may therefore vary according to the type of personal data involved and the purposes for which it is processed.

XIII. Data security

We use appropriate technical and organizational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or other unauthorized processing.

However, transmission of information through the internet and electronic storage systems cannot be guaranteed to be completely secure.

XIV. Cookies, analytics and third-party technologies

Our website may use cookies and similar technologies. Non-essential cookies and similar technologies will be used in accordance with applicable consent requirements.

Third-party services used by us, including YouTube / Google, Leadpages and HubSpot, may use cookies or similar technologies where their functionality is used or embedded in our website.

Information concerning the cookies and similar technologies actually used on our website should be provided through the applicable Cookie Policy and cookie settings.

XV. Social media

If you interact with us through social media or other third-party platforms, the relevant platform may provide information to us depending on your settings, your interaction with our content and the platform’s own policies.

Social media platforms may independently collect and process information about you. Their collection and use of personal data is governed by their own privacy policies and practices.