# Business Made Simpler privacy notice Last updated: 21 October 2026 Document version: 2026-10-21 ## The short version Business Made Simpler provides a platform that helps businesses manage referral relationships, agreements, Partner Workspaces and opportunities. We do not sell personal information. A Business Workspace controls the contact, agreement and opportunity information it enters. Business Made Simpler processes that information to provide the platform. Business Made Simpler separately controls account, subscription, billing, support and security information needed to operate the service. ## Who we are Business Made Simpler Limited operates the referral platform. It is registered in England and Wales under company number 17254146, with its registered office at 8 Harebell Close, Highwoods, Colchester, England, CO4 9RX. For privacy questions, requests or concerns, email sarah@businessmadesimpler.co.uk. If your information was entered by a Business Workspace or shared through a referral, that business is normally responsible for deciding why and how the referral information is used. Its name is shown in the relevant invitation, agreement, Partner Workspace or opportunity journey. You may contact that business directly, or contact us and we will help route your request. ## Information we handle - **Account and workspace details:** name, work email, telephone number, password hash, organisation details, subscription and login information. - **Business contacts:** business or individual name, work contact details, role, company information and addresses. - **Partner Workspace information:** invitee, relationship type, access status, invitation and login dates. - **Agreements:** parties, commercial terms, uploaded or generated documents, approval decisions and signing evidence such as name, email, date, time, IP address and browser information. - **Opportunities:** potential client details, qualification answers, service needs, notes, values, dates, status, outcome and referral fees. - **Support, security and activity information:** messages, audit events, device or browser information and actions needed to protect and support the service. - **Integration information:** connection identifiers and encrypted credentials for an integration that a workspace chooses to enable. Please do not enter special-category information, highly sensitive personal information or information unrelated to a genuine business referral. ## Where information comes from We receive information directly from account holders and Partner Workspace users, from Business Workspaces and referral partners, from people approving agreements or updating opportunities, and from service providers used for account, billing and security operations. A potential client's details may be provided by a referral partner rather than by the potential client. The person submitting the opportunity must confirm that the potential client has agreed to their details being shared with the named receiving business. This workflow permission is not a statement that every use relies on GDPR consent. Each receiving business must identify its own lawful basis and provide its own controller privacy information. This notice does not replace it. For information received indirectly, that business must normally provide its information no later than one month, or earlier at first communication or disclosure, subject to legal exceptions. ## Why we use information ### Provide accounts and the platform To register users, provide Business and Partner Workspaces, manage subscriptions and deliver requested features. Where the individual is personally party to the contract, the lawful basis is performance of that contract or steps they request before entering it. For employees, representatives and invited users who are not personally party to the customer contract, we rely on our legitimate interests in administering business relationships and providing secure, authorised access. We assess necessity and the impact on those people. ### Operate referral workflows To hold contacts, agreements and opportunities and make them available to authorised participants. The Business Workspace determines its lawful basis; Business Made Simpler processes this content under its instructions. ### Protect the service To authenticate users, prevent misuse, investigate incidents and maintain audit records. We rely on our legitimate interests in providing a secure and reliable service and, where applicable, legal obligations. ### Billing and business administration To take payment, administer subscriptions, keep financial records and manage disputes. We rely on contract and legal obligations. For a company's representatives we rely on legitimate interests to administer its subscription; we rely on legal obligations for required accounting records. We retain limited evidence of terms acceptance for contract administration and the establishment, exercise or defence of legal claims, using legitimate interests where applicable. ### Support and service communications To answer questions and send essential messages about accounts, agreements, opportunities and access. We rely on contract and our legitimate interests in supporting the service. ### Maintain and improve the platform To diagnose problems and understand whether core features operate correctly, using the minimum information reasonably needed. We rely on our legitimate interests in maintaining and improving the service. Required fields are needed to create an account, provide secure access or complete the relevant referral workflow. Optional fields may be left blank. We do not use platform information to make solely automated decisions about people that have legal or similarly significant effects. ## Who information is shared with Information is available only to the Business Workspace, authorised Workspace Users and connected Partner Workspaces involved in the relevant relationship. We also use suppliers that help us operate the platform, including: - Render for application hosting, databases and backups; - Stripe for subscription billing and payment administration; - SMTP2GO for transactional email and Microsoft 365 for business correspondence and support. The current supplier list is available at https://app.businessmadesimpler.co.uk/subprocessors. Xero is a planned integration and must remain disabled until its provider review is complete; it is not a current recipient merely because integration code exists. Sharing an agreement or opportunity does not create a permanent copy owned by every participant. Records owned by an originating Business Workspace are removed when that workspace is deleted after its recovery period. Separately owned records in another workspace are not deleted merely because a connected business closes. Participants should obtain any copies they lawfully need before access ends. Controllers must resolve competing retention and deletion instructions; BMS does not decide that a subscription label determines legal ownership or controller status. Deleting a stored copy or closing BMS access does not itself end the separate referral agreement between the businesses or remove their contractual payment obligations. Those are governed by the agreement and applicable law; each party should keep its own copy. We may also share information with professional advisers, courts, regulators or law-enforcement bodies where this is necessary and lawful. We do not sell personal information. ## International processing Our main hosting region is in Germany. Some suppliers operate internationally and may process information outside the UK. Where UK data protection law treats this as a restricted transfer, we use an applicable adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with appropriate security measures. Supplier processing can involve the EEA, United States, New Zealand and other approved provider locations. The supplier list identifies the relevant arrangements. You can request further information or a copy of applicable safeguards by emailing sarah@businessmadesimpler.co.uk; we may redact confidential information while explaining the protection provided. Where contractual safeguards require a transfer assessment, BMS must complete and retain that assessment. A selected EU hosting region alone does not establish that all processing stays in the EU. ## How long information is kept Customer-controlled workspace information, including referral agreements and signing evidence, is normally kept while the owning workspace remains active. Following effective cancellation, the workspace becomes read-only for a 30-day recovery and export period, after which its content is deleted or irreversibly anonymised unless a specific lawful retention requirement applies. Archiving is not deletion. Independently controlled records held by another business follow that business's instructions and retention rules. BMS's own financial and tax records are normally retained for six years from the end of the company financial year they concern, or longer where law requires. This does not impose six-year BMS storage on every customer referral agreement. Non-essential BMS account records are normally retained for up to 24 months after closure, support records for two years after resolution, and security logs for six months. Essential contractual acceptance evidence may be retained for six years after the relevant relationship ends to establish or defend claims. Data-rights and complaint records are normally retained for three years after closure and breach records for six years, subject to necessity reviews and documented legal holds. Contract-linked workflow evidence may remain with the relevant customer record rather than being treated as an ordinary security log. Backup copies are put beyond ordinary use and age out through the provider cycle. The last recorded Render check on 17 October 2026 found three-day point-in-time recovery and seven-day retention for logical exports; these are dated operational observations and must be rechecked when the plan changes. A restoration must reapply deletion instructions before restored data returns to ordinary use. These periods are retention rules; BMS must monitor their execution, including records held in email and supplier systems. The exact period can depend on the record, the instructions of the Business Workspace and whether a legal claim or regulatory obligation applies. ## Your rights Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to the use of your information, and to receive information you provided in a portable format. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. Contact the relevant Business Workspace where the request concerns its referral relationship, or email sarah@businessmadesimpler.co.uk. We may need to verify your identity and may ask the Business Workspace to help locate or assess the relevant records. ## Cookies The platform currently uses a strictly necessary secure sign-in cookie to keep authenticated users signed in. It does not currently use advertising or analytics cookies. If non-essential tracking is introduced, we will update this notice and assess whether consent is required before enabling it. ## Questions and complaints Please contact us first at sarah@businessmadesimpler.co.uk so we can try to resolve your concern. You can raise a data protection complaint by email or by writing to our registered office. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome and any action taken. We start investigating on receipt; the acknowledgement period is not a waiting period. We will help route complaints concerning another business's controller responsibilities without ignoring any complaint about BMS's own actions. You may also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. ## Changes to this notice We review this notice when the platform, suppliers or legal requirements change. Material changes will be brought to affected users' attention before a new use of personal information begins.