This policy sets out how POLYMATH BMC collects, uses, and protects the personal information you share with us through this site or when engaging our services.
Who we are
POLYMATH BMC is a business management consultancy operating in the United Kingdom. The data controller for personal information collected through this site is Lucy Drury, trading as POLYMATH BMC. You can reach us at hello@polymath-bmc.com.
Information we collect
We collect information in three ways:
- Information you give us — when you complete our contact form or book a discovery call, you provide your name, email address, company (optional), and the details of your enquiry.
- Information collected automatically — standard web analytics covering pages visited, referring source, approximate location at country level, and device or browser type.
- Cookies — see the Cookies section below.
How we use your information
- To respond to your enquiry and arrange calls or meetings.
- To deliver consulting services under a signed engagement.
- To send you materials you've specifically requested, such as case studies or proposals.
- To improve our website and understand what's useful to visitors.
We do not sell your data. We do not share your data with third parties for marketing purposes.
Legal basis for processing
Under UK GDPR, we rely on the following lawful bases, depending on context:
- Legitimate interests — responding to your enquiry, running our business, and keeping our site functional and secure.
- Contract — delivering services you've engaged us for, and taking steps before entering a contract at your request.
- Consent — where we ask you directly, for example if you subscribe to email updates. You can withdraw consent at any time.
- Legal obligation — where we're required to retain records for tax, accounting, or regulatory purposes.
Who we share your information with
We use trusted third-party processors to run our business:
- Formspree — processes contact form submissions before forwarding them to our inbox.
- Calendly — schedules discovery calls and video meetings.
- Google Workspace — hosts our email and productivity tools.
- Netlify — hosts this website.
Each processor handles your data under their own privacy terms, and we've selected them for their compliance posture. Where any of them process data outside the UK or EEA, they do so under approved safeguards such as Standard Contractual Clauses or equivalent.
How long we keep your information
- Enquiries that don't progress to an engagement: up to 24 months, then deleted.
- Active and past client records: for the duration of the engagement plus 7 years, to meet UK accounting and tax requirements.
- Analytics data: aggregated and anonymised after 14 months.
Your rights
Under UK GDPR, you have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Request deletion ("right to erasure").
- Restrict or object to certain processing.
- Request a copy of your data in a portable format.
- Withdraw consent where processing is based on consent.
To exercise any of these rights, email us at hello@polymath-bmc.com and we'll respond within one calendar month.
Cookies
This site uses a minimal set of cookies:
- Essential cookies — required for basic site functionality.
- Analytics cookies — anonymised measurement of traffic patterns.
We do not use advertising cookies or cross-site tracking. You can disable cookies in your browser at any time without losing access to the site.
International transfers
Some of our processors are based outside the UK, primarily in the United States. Where personal data is transferred internationally, we rely on the UK Government's adequacy decisions or approved Standard Contractual Clauses to ensure your data remains protected.
Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), access controls, and carefully chosen processors. No system is perfectly secure, but we take this seriously.
Complaints
If you're unhappy with how we've handled your data, please contact us first — we'd like the chance to put it right. You also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.
Updates to this policy
We may update this policy from time to time. Material changes will be flagged on the site. The date at the top of this page reflects the most recent revision.