PRIVACY NOTICE

The Business Supplies Group Ltd

Privacy Notice

This is the Privacy Notice for The Business Supplies Group Limited. In this document, “we”, “our” or “us” refer to The Business Supplies Group Limited.

The Business Supplies Group Limited are registered in The United Kingdom under company number 13624537 and registered with the Information Commissioners Office (ICO) under number ZB548687. Our registered office is at 107 Longmead Road, Emerald Park East, Emersons Green, Bristol BS16 7FG.

We are committed to protecting the privacy and security of personal data, which is any information about, or can be used to identify, an individual. The purpose of this Privacy Notice is to inform you about how we collect and process any information that we collect from you, or that you provide to us, as well as tell you about your privacy rights and how the law protects you. This Privacy Notice only informs you of our processing where we are a data controller, where we are a data processor please see the data controller’s privacy notice.

In the context of the law and this notice, "process" means collect, store, transfer, use or otherwise act on information. We are the data controller of the personal data that we store and process, and are therefore responsible for making sure that our systems, processes and people comply with the relevant data protection laws in respect of that personal data. Our DPO is Privacy Helper, who can be contacted regarding our use of your personal data through the contact details at the end of this Privacy Notice.

We collect and process data for the following reasons:

  1. Personal data collected and created in relation to our providing services
  2. Personal data relating to people who have asked to attend events run by us, receive our newsletters and other information services or marketing materials
  3. Personal data relating to our people (which means those people working for our business, or providing services to us, or potentially working or providing services to us, including employees, consultants, temporary or casual workers and contractors)
  4. Personal data processed for the purposes of managed print services and hybrid mail solutions provided to our clients

We do not conduct any automated decision-making or profiling that produces a legal or similarly significant effect on you.

 

1. Providing our services

 

What data we collect

  • Tracking information about your visit to our website and emails that we send out
  • Google analytics information
  • Information that you provide to us enquiring about our services, such as names and contact details
  • Information such as usernames, document names, print queue data, document metadata, and log activity related to print and mail management systems (and in some support cases where it is strictly necessary, the document content itself)

We do not collect sensitive or special categories of data to provide our services.

 

How we collect it

 

We collect personal data in a number of ways:

  • Written correspondence
  • Email
  • Phone calls
  • Web forms
  • Video conference calls
  • Meetings
  • Social media
  • Encrypted integration with print and mail systems configured for or on behalf of our customers

We also use software and automated ways of collecting analytics information using cookies. Information about how we use cookies can be found in our Cookie Policy.


How we use it


We will use the personal data to provide our services including our managed print services and hybrid mail workflow, to manage our relationship with our clients, analyse website data and visitor interactions, and comply with legal requirements that we are required to undertake.

We will only use your personal data when the law allows us to, under what’s known as a “Lawful Basis”. Most commonly, we will use your personal data under the following lawful bases:

  • In performance of a contract (the agreement to provide services)
  • Compliance with a legal obligation
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests

We may also use your personal data in the following situations, which are likely to be less common:

  • Where we need to protect your interests (or someone else’s interests)
  • Where it is needed in the public interest


2. Our events, newsletters, other information services & marketing materials (“our Information”)


What data we collect

  • Name
  • Contact details
  • IP address (or similar unique identifiers)
  • Job title
  • The business that you work for
  • Additional information that you provide to us, for example when you let us know those areas of our business that you are interested in receiving information about


For our events, we may collect details of any access or dietary requirements that you have, which may reveal information about the health or religious beliefs of a data subject, which are special categories of data.


We may collect this information from you (whether directly or via automated means such as our website) or from third parties (such as our client).


We will collect personal data in our contact relationship management system when you tell us that you wish to receive all or part of our Information or otherwise give us your personal details. You may at any time tell us that you wish to stop receiving our Information.


How we use it

Personal data will be used to provide you with our Information that you ask for, or that we think are relevant to the preferences that you may have given to us. We may analyse what areas of information are of interest to you so that we can better target the Information that we provide.

We will only use your personal data when the law allows us to, under what’s known as a “Lawful Basis”. Most commonly, we will use your personal data under the following lawful bases:

  • With your consent
  • In performance of a contract (the agreement to provide services)
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests

3. Unsubscribing


From time to time, we may send you emails containing offers and services that we think will be of interest to you. Where we do so, we will offer you the opportunity to either consent to, or where we already have a relationship with you, opt out of such emails at the point we collect your information. If you wish to opt out or withdraw your consent after this point, please contact us directly or click on the Unsubscribe link at the foot of any marketing email, from where you can update your preferences.


4. Disclosure of your personal data


We may share personal data with third parties in respect of the provision of our services or our Information, including to third parties who provide services to us such as:

  • IT suppliers
  • Website hosting
  • Email delivery
  • Cloud storage hosting

In respect of all disclosures of personal data, we will only share the personal information which is absolutely necessary for the particular purpose for which it is provided, or where we must do so to comply with any legal requirements.


5. Retention periods


We will keep personal data only for as long as is necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements. Specific retention periods include:

  • For marketing information, we will stop sending you our Information within 2 years of last engagement with it, and/or delete your personal data either at the end of our relationship with you, or within 3 years after you’ve last engaged with it.
  • For information related to our transactions we will keep limited information required for our legal reporting purposes for up to 7 years

For print and mail metadata, data is typically retained only for operational or audit purposes and for a limited period, as defined in agreements with our customers.


6. Changes to your personal data


It is very important that the personal information that we hold about you is accurate and current. Please tell us if your personal information changes during your relationship with us.


7. Data Security


We have put in place measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our people and other third parties who have a business need to know. They will only process your personal data on our instructions and where they have agreed to treat the information confidentially and to keep it secure. We have put in place procedures to deal with any suspected data security breach and will notify you and the ICO of a suspected breach where we are legally required to do so.


8. Where we store your personal data


We principally store data, both electronically and on file, at our offices in the UK, with archive storage for files locally. Other locations data may be stored includes:

  • Google data centres (USA/Worldwide)
  • Microsoft data centres (USA)
  • Squarespace data centres (USA)
  • ECI data centres (which could be outside the UK)
  • Other third-party processors as used for managed print and hybrid mail systems as specified in contractual agreements with our customers (which could be outside the UK)

Where personal data is transferred outside of the UK by processors acting on our behalf, we will ensure that personal data is adequately protected, as required by the UK GDPR. Where the countries of storage have been deemed to not provide an adequate level of data protection by the ICO, this would include the use of mechanisms to ensure the same level of data protection, such as the EU-US Data Privacy Framework (including UK Extension), EU Standard Contractual Clauses (plus UK Addendum), or UK International Data Transfer Agreements (IDTA).


9. Your rights


Under the UK GDPR you have the right by law to request:

  • Access to your personal data. This enables you to ask to receive a copy of the personal data that we hold about you and to check that we are lawfully processing it
  • Correction of the personal data that we hold about you
  • Erasure of your personal data
  • Object to processing of your personal data where we are relying on our legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes
  • Restriction of processing of your personal data
  • Transfer of your personal data in a portable manner to another party
  • Not be subject to solely automated processing, including profiling under certain circumstances and where this processing produces legal or similarly significant effects

Some of these rights are only applicable under certain circumstances. Where we act as a processor on behalf of our customers (such as in relation to managed print services), your rights may need to be exercised through the data controller who engaged us. We will assist that controller in facilitating your rights request.


10. Right to make a complaint


In addition to the rights detailed above, you also have the right to make a complaint if you believe we have made an error with your data. Please contact us on the details listed at the end of this Privacy Notice if you would like to make a complaint about how we are using your personal data.

If you are not satisfied with the result of your complaint to us, you have the right to make a further complaint to the Information Commissioner’s Office. Their details are:

The Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Phone number: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/


11. Links from our website

Our website may, from time to time, contain links to and from the websites of third parties that we permit to make such links. If you follow a link to any of these websites, please note that these websites have their own privacy notices and that we do not accept any responsibility or liability for these notices. We recommend that you check these before you submit any personal data to these websites.


12. Changes to this Privacy Notice

This Privacy Notice was last updated in April 2026. We reserve the right to update this Privacy Notice at any time. Any changes we may make to our privacy notice in the future will be posted on our website, so please ensure that you are viewing the correct version.

Please contact us on dataprivacy@tbsg.co.uk if you have any questions, comments or requests regarding this Privacy Notice. Or contact our DPO, Privacy Helper andrewm@privacyhelper.co.uk