Privacy Policy

The data controller responsible for your personal data is BO Principal Holdings, a privately held technology and strategic architecture group. This Website is operated solely for informational purposes and to facilitate confidential private inquiries from qualified principals.

For all privacy-related matters, data subject requests, or complaints, you may contact us through the Private Access channel at boprincipalholdings.com/private-access.

We have not appointed a Data Protection Officer as we are not required to do so under applicable law. All data protection enquiries should be directed to us through the Private Access channel.

We collect personal data only in the following circumstances:

Information you provide voluntarily. When you submit a private inquiry through our contact form, we may collect:

• —Full name
• —Email address
• —Office or institutional affiliation (if provided)
• —Nature of the matter (if provided)
• —Message content

Technical and usage data. When you visit this Website, our servers and analytics tools may automatically collect:

• —IP address (anonymised where technically feasible)
• —Browser type and version
• —Operating system
• —Pages visited and time spent on each page
• —Referring URL
• —Date and time of access
• —Device type and screen resolution

We do not collect sensitive personal data (special category data as defined under UK GDPR Article 9) unless you voluntarily include it in your inquiry message. If you do so, we will treat it with the highest degree of confidentiality.

This Website uses cookies and similar tracking technologies. Cookies are small text files placed on your device that help us operate the Website and understand how it is used.

Analytics cookies. We use Google Analytics 4 (GA4), a service provided by Google LLC, to collect anonymised data about how visitors use this Website. GA4 may collect information such as pages visited, session duration, approximate geographic location (country/region level), device type and referral source. This data is processed by Google on our behalf and is subject to Google's Privacy Policy. We have configured GA4 with IP anonymisation enabled. We do not use GA4 data for advertising, remarketing or profiling purposes.

Essential cookies. Certain cookies are strictly necessary for the Website to function correctly. These cannot be disabled without affecting the Website's operation.

Managing cookies. You may control or disable cookies through your browser settings at any time. Most browsers allow you to refuse cookies, delete existing cookies or be notified when a cookie is set. Please note that disabling analytics cookies will not affect your ability to use this Website. Instructions for managing cookies in common browsers are available at aboutcookies.org.

You may also opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on.

We use the personal data we collect for the following purposes:

• —To receive, review and respond to private inquiries submitted through the contact form
• —To assess whether an engagement or relationship is appropriate
• —To maintain records of correspondence for legal and compliance purposes
• —To analyse Website usage in aggregate and anonymised form to improve the Website experience
• —To monitor and maintain the security and integrity of the Website and our systems
• —To comply with applicable legal and regulatory obligations
• —To enforce our Terms of Use and protect the rights, property and safety of the Group and others

We do not use your personal data for marketing, advertising, automated decision-making, profiling or any purpose other than those stated above. We do not sell, rent, license or otherwise transfer your personal data to any third party for commercial purposes.

We process your personal data only where we have a valid legal basis to do so under UK GDPR. The legal bases we rely on are:

• —Legitimate interests (UK GDPR Article 6(1)(f)) — to review and respond to private inquiries, to protect the security and integrity of our operations, and to analyse Website usage in anonymised form. We have assessed that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.
• —Legal obligation (UK GDPR Article 6(1)(c)) — to comply with applicable laws and regulations, including record-keeping requirements.
• —Consent (UK GDPR Article 6(1)(a)) — where you have voluntarily submitted information through our contact form, and in relation to non-essential analytics cookies where your consent is required under PECR.

Where we rely on consent as a legal basis, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact us through the Private Access channel.

We do not disclose your personal data to third parties except in the following limited circumstances:

• —Service providers — trusted third-party providers who assist in operating this Website and delivering communications (including hosting providers and email delivery services), subject to strict data processing agreements and confidentiality obligations. These providers act as data processors on our behalf and may only process your data in accordance with our instructions.
• —Analytics providers — Google LLC, as processor for Google Analytics 4, processes anonymised usage data on our behalf as described in Section 3 above.
• —Legal requirements — where disclosure is required by applicable law, court order, regulatory authority or government request, or where necessary to protect the rights, property or safety of the Group, our personnel or others.
• —Business transfers — in connection with a merger, acquisition, restructuring, sale of assets or other corporate transaction, subject to equivalent confidentiality and data protection protections.

In all cases, disclosure is limited to what is strictly necessary for the stated purpose and is subject to appropriate safeguards.

Some of our service providers, including Google LLC (Google Analytics), are based outside the United Kingdom and the European Economic Area. Where personal data is transferred to a country that does not provide an equivalent level of data protection, we ensure that appropriate safeguards are in place, including:

• —Standard contractual clauses approved by the UK Information Commissioner's Office (ICO) or the European Commission
• —Adequacy decisions issued by the UK Secretary of State or the European Commission
• —Other lawful transfer mechanisms as permitted under applicable data protection law

For information about the safeguards applicable to transfers to Google, please refer to Google's Privacy Policy.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. Our retention periods are as follows:

• —Inquiry correspondence and associated personal data — retained for up to seven (7) years from the date of receipt for legal and compliance purposes, after which it is securely deleted or irreversibly anonymised.
• —Server access logs — retained for up to ninety (90) days for security and operational purposes, then automatically deleted.
• —Anonymised analytics data — retained in accordance with Google Analytics retention settings, which we have configured to a maximum of fourteen (14) months.

Where we are required by law to retain data for a longer period, we will do so and will inform you if this affects a data subject request you have made.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include:

• —Encrypted transmission using Transport Layer Security (TLS) for all data in transit
• —Server-side security headers including X-Content-Type-Options, X-Frame-Options and Referrer-Policy
• —Access controls restricting access to personal data to authorised personnel only
• —Regular security assessments and vulnerability management
• —Secure deletion procedures for data that has reached the end of its retention period

No method of transmission over the internet or electronic storage is completely secure. While we take all reasonable precautions, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals in accordance with applicable law.

Under UK GDPR and applicable data protection law, you have the following rights in relation to your personal data:

• —Right of access (Article 15) — to request a copy of the personal data we hold about you and information about how we process it.
• —Right to rectification (Article 16) — to request correction of inaccurate or incomplete personal data.
• —Right to erasure (Article 17) — to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing.
• —Right to restriction of processing (Article 18) — to request that we limit the processing of your personal data in certain circumstances.
• —Right to object (Article 21) — to object to processing based on legitimate interests or for direct marketing purposes.
• —Right to data portability (Article 20) — to receive personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller.
• —Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
• —Right not to be subject to automated decision-making — we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, please contact us through the Private Access channel. We will respond within one calendar month of receipt of your request, as required by UK GDPR Article 12. We reserve the right to verify your identity before processing any request and to extend the response period by a further two months where requests are complex or numerous, in which case we will notify you within the initial one-month period.

We will not charge a fee for handling data subject requests unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

If you are located in the United Kingdom and believe that we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters:

• —Website: ico.org.uk
• —Telephone: 0303 123 1113
• —Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the European Economic Area, you may also have the right to lodge a complaint with the supervisory authority in your country of residence or place of work.

We would, however, appreciate the opportunity to address your concerns before you approach the ICO or another supervisory authority. Please contact us in the first instance through the Private Access channel.

This Website does not currently contain links to third-party websites, with the exception of links to Google's privacy policy and opt-out tools referenced in Section 3 above. If additional third-party links are added in the future, we will not be responsible for the privacy practices or content of those linked sites. We encourage you to review the privacy policies of any external sites you visit.

This Website is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you are under 18, please do not submit any personal information through this Website. If we become aware that we have inadvertently collected personal data from a minor, we will take prompt steps to delete it. If you believe we have collected such data, please contact us immediately through the Private Access channel.

We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, applicable law or the services we use. Material changes will be posted on this page with an updated effective date. Where required by applicable law, we will provide more prominent notice of material changes.

Your continued use of this Website following the publication of any changes constitutes your acknowledgement of the revised Policy. We encourage you to review this page periodically. The date at the top of this page indicates when this Policy was last reviewed.

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales, without prejudice to your right to lodge a complaint with the Information Commissioner's Office or another competent supervisory authority.