Last updated: 19 April 2026

This Privacy Statement explains how the Great British Business Council ("GBBC", "we", "us", "our") collects, uses, stores and protects personal data when you visit gbbc.uk, sign up to our newsletter, contact us, or otherwise interact with our website.

We are the data controller for the personal data we process through this website, within the meaning of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

1. Who we are and how to contact us

Great British Business Council
Website: https://gbbc.uk
Email: [email protected]

If you have any questions about this statement, want to exercise your rights under UK GDPR, or wish to make a complaint, please use the email address above.

2. The personal data we collect

Depending on how you use the site, we may collect the following categories of personal data:

2.1 Information you give us

• Contact form submissions (via Contact Form 7 / Gravity Forms): name, email address, organisation (where provided), message content, and any other information you voluntarily include.
• Newsletter sign-up: email address and the fact that you have consented to receive our newsletter.
• Correspondence: the content of any email or other communication you send us.

2.2 Information we collect automatically

• Technical data: IP address (truncated where possible), browser type and version, device type, operating system, language settings, referring URL, and the pages you view.
• Usage data: how you interact with the site, including session duration, events, and navigation paths, collected via Google Analytics (see section 5).
• Cookie and consent data: the choices you make in our cookie banner, stored by our consent management platform (Complianz).
• Server and security logs: records of requests to the site, used to protect against abuse and for troubleshooting.

2.3 Information from third parties

If you interact with embedded content (for example YouTube videos, or social media links to Facebook, LinkedIn, X, Bluesky or TikTok), those platforms may share limited data with us in aggregated form. We do not buy personal data from third parties.

3. Why we use your personal data and our lawful basis

Under UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:

We will not use your personal data for a new purpose that is incompatible with the purpose for which it was collected without telling you and, where required, seeking your consent.

4. Cookies and similar technologies

We use cookies and comparable technologies to run the site, remember your preferences, measure usage, and, where you consent, to support marketing. You can review and change your choices at any time using the cookie banner on the site.

Our cookies fall into the following categories, aligned with our consent management platform:

• Functional - always on. Strictly necessary to deliver the service you have requested (for example, loading pages, keeping sessions secure, submitting forms).
• Preferences - remember choices such as language or display preferences.
• Statistics - help us understand how visitors use the site in aggregate. Set only with your consent.
• Marketing - used to build an audience profile or track visitors across sites for advertising and campaigns. Set only with your consent.

For the full, live list of cookies used on the site, including names, providers, duration and purpose, please see the "View preferences" section of the cookie banner.

5. Third parties that process data on our behalf

We use the following service providers ("processors") to operate the website. They act on our instructions under written contracts that meet the requirements of UK GDPR.

• Website hosting and CDN - our hosting provider and Cloudflare, Inc. (content delivery, DDoS protection, email obfuscation). Cloudflare processes technical connection data necessary to deliver the site.
• Google LLC / Google Ireland Limited - Google Analytics and Google Tag Manager, accessed via the Google Site Kit plugin, used for measurement and consent-aware tag management.
• Complianz B.V. - consent management platform, storing your cookie choices.
• Contact form providers - Contact Form 7 and Gravity Forms process submissions within our WordPress installation.
• Automattic Inc. / WordPress.org - WordPress core and related services (including Gravatar for comment avatars, if enabled).
• Embedded social platforms - YouTube (Google), Facebook (Meta), LinkedIn, X, Bluesky and TikTok, when you view embedded content or follow our profile links. These platforms act as independent controllers for any data they collect directly.

6. International transfers

Some of the providers listed above are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on safeguards approved under UK GDPR, which may include:

• UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the receiving organisation is certified);
• the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
• other safeguards permitted by law.

If you would like further information about the specific safeguards in place for any transfer, contact us using the details in section 1.

7. How long we keep your data

• Contact enquiries: kept for up to 24 months after the last contact, then deleted or anonymised, unless we need to keep them longer for legal or accounting reasons.
• Newsletter subscribers: kept until you unsubscribe, plus a short period to process the unsubscribe and avoid re-adding you in error.
• Analytics data: kept in line with the retention period configured in Google Analytics (typically no longer than 14 months) and in aggregated form beyond that.
• Consent records: kept for as long as required to demonstrate compliance, in line with ICO guidance.
• Server and security logs: typically kept for up to 12 months.

8. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• be informed about how your data is used (this statement);
• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where the law permits;
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable format, where applicable;
• withdraw any consent you have given, at any time, without affecting the lawfulness of processing before the withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not currently carry out such processing).

To exercise any of these rights, email [email protected]. We will respond within one month, as required by UK GDPR. We may need to verify your identity before providing information.

9. How to complain

You have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk

We would appreciate the chance to address any concerns before you contact the ICO, so please consider raising the matter with us first.

10. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including HTTPS encryption in transit, access controls, reputable hosting, and regular software updates. No online service is entirely risk-free, and we cannot guarantee absolute security.

11. Children

The website is not directed at children under 13, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Links to other websites

Our website contains links to third-party websites, including social media platforms. We are not responsible for the privacy practices of those sites. Please review their privacy notices before providing personal data.

13. Changes to this statement

We may update this Privacy Statement from time to time. The "Last updated" date at the top of the page reflects the latest version. Material changes will be highlighted on the site or, where appropriate, communicated to you directly.