Privacy Policy

Last updated: June 2026

Bury St Edmunds Business Exchange CIC (“we”, “our”, “us”) is committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, contact us, register for events, purchase tickets, or otherwise engage with our activities. It also explains your rights and how you can raise concerns or complaints about the way we process your personal information.

 

Who We Are

Bury St Edmunds Business Exchange CIC is a Community Interest Company registered in England and Wales.

Company name: Bury St Edmunds Business Exchange CIC
Company number: 17238340
Registered office address: 5 Downing Drive, Great Barton, Bury St. Edmunds, England, IP31 2RP

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at:

Email: info@burybusinessexchange.co.uk

 

The Information We Collect

We may collect and process the following personal information:

  • Name

  • Business name

  • Email address

  • Telephone number

  • Billing address

  • Job title

  • Information you provide when contacting us

  • Information provided when registering for events or purchasing tickets

  • Payment and transaction information

  • Marketing preferences

  • Website usage information, including IP address, browser type and pages visited

We only collect information that is necessary for the purposes outlined in this policy.

 

How We Use Your Information

We may use your personal information to:

  • Respond to enquiries and requests for information

  • Process ticket purchases and event registrations

  • Send booking confirmations and event-related communications

  • Administer and manage events, meetings and activities

  • Communicate with attendees about relevant event updates

  • Improve our website, services and user experience

  • Monitor website performance using Google Analytics

  • Meet our legal and regulatory obligations

 

Lawful Basis for Processing

Under UK data protection law, we rely on the following lawful bases:

Contract

Where we need to process your information to provide tickets, event access, booking confirmations, or services you have requested.

Legitimate Interests

Where processing is necessary for the operation and development of Bury St Edmunds Business Exchange CIC, including responding to enquiries, managing events, improving our website, and communicating with our network.

Consent

Where you have actively agreed to optional cookies or future marketing communications.

Legal Obligation

Where we are required to process information to comply with applicable laws and regulations.

 

Ticket Purchases and Payments

Tickets for events may be purchased through our website using WooCommerce.

When you purchase a ticket, we collect the information needed to process your order, confirm your booking, and manage your attendance at the event.

Payments may be processed through third-party payment providers, depending on the payment option selected at checkout. We do not store full payment card details on our website.

Payment providers will process your information in accordance with their own privacy policies and security standards.

 

Marketing Communications

We do not currently use a newsletter platform.

If we introduce email marketing in the future, we will only send marketing communications where we have a lawful basis to do so. Where consent is required, you will be able to opt in and unsubscribe at any time.

 

Sharing Your Information

We do not sell your personal information.

We may share your information with trusted third-party service providers who support our operations, such as:

  • Website hosting providers

  • Website developers or technical support providers

  • WooCommerce and related website plugins

  • Payment processing providers

  • Google Analytics

  • Professional advisers where necessary

These organisations will only process your information where necessary and are expected to keep it secure.

 

Website Analytics and Cookies

Our website uses Google Analytics to understand how visitors use the website and to help us improve the user experience.

Google Analytics may collect information such as pages visited, time spent on the website, device type, browser type and general location information.

Our website may also use cookies and similar technologies to support website functionality, process ticket purchases, and analyse website performance.

You can manage or disable cookies through your browser settings. Where required, we will request your consent for non-essential cookies.

 

Event Photography and Promotion

We may take photographs or video at events for promotional purposes, including use on our website, social media, email updates, and printed materials.

Where possible, we will make attendees aware when photography or filming is taking place.

If you do not wish to be photographed or featured in promotional content, please let us know before or during the event.

 

International Transfers

Some of our third-party providers, including Google Analytics and payment providers, may store or process personal information outside the UK.

Where this occurs, we expect appropriate safeguards to be in place to protect your information in accordance with UK data protection legislation.

 

How Long We Keep Your Information

We will only retain personal information for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting or reporting requirements.

Order, ticket and transaction records may be kept for accounting and legal purposes.

General enquiry information will only be kept for as long as necessary to respond to the enquiry and manage any ongoing relationship.

 

Your Rights

Under UK data protection law, you have the right to:

  • Request access to your personal information

  • Request correction of inaccurate information

  • Request erasure of your personal information in certain circumstances

  • Request restriction of processing

  • Object to the processing of your personal information

  • Request the transfer of your personal information to another organisation

  • Withdraw consent where consent is the basis for processing

If you wish to exercise any of these rights, please contact us at:

Email: info@burybusinessexchange.co.uk

 

Data Security

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

 

Data Protection

Data protection at Bury St Edmunds Business Exchange CIC is the responsibility of:

Responsible person:

Email: info@burybusinessexchange.co.uk

Address:              Bury Business Exchange CIC, 5 Downing Drive, Great Barton, Bury St Edmunds, Suffolk, IP31 2RP

You do not need to use a particular form or follow a set format to make a complaint. You can contact us by email, or by post.

What counts as a data protection complaint

A data protection complaint is any concern you raise about how we have handled your personal data. This is broad – it covers a wide range of situations, not just formal data breaches.

Examples of the types of concern we can look into

  • We did not respond to a data subject access request (a request to see what information we hold about you) within the required time, or the response was incomplete.
  • We shared your personal data with someone we should not have, or without a lawful reason to do so.
  • We did not action a request to delete your personal data when we were required to.
  • We did not correct personal data that was inaccurate when you asked us to.
  • You continued to receive marketing from us after you had opted out.
  • Our privacy notice was unclear, incomplete or did not accurately describe how we use your data.
  • We kept your personal data for longer than we should have.
  • A data breach or security incident affected your personal data, and we did not handle it correctly.

What we cannot investigate through this process

  • General customer service complaints that do not involve the handling of your personal data.
  • Complaints about the outcome of a data subject access request that was handled correctly and on time.
  • Employment or HR grievances – these follow a separate process.

If you are not sure whether your concern counts as a data protection complaint, please contact us and we will help you work it out.

How to raise a complaint with us

To help us look into your concern as quickly as possible, it helps if you can tell us:

  • Your name and contact details.
  • A description of your concern – what happened, when it happened, and who was involved.
  • What you would like us to do about it.
  • Any relevant reference numbers, dates or other details that might help us investigate.

You do not need to provide all of this to make a valid complaint. If you are not sure what to include, just get in touch and we will help you from there.

What happens when we receive your complaint

Here is what you can expect from us, step by step:

Step 1 – Acknowledgement

We will send you a written acknowledgement within 30 calendar days of receiving your complaint. Day one of that period is the day after we receive it.

Our acknowledgement will confirm:

  • That we have received your complaint and the date we received it.
  • The name of the person who will be handling it.
  • What happens next and an expected timescale.

Step 2 – Investigation

We will look into your complaint fairly and thoroughly. This means reviewing the relevant information, speaking to the right people internally, and assessing what happened against our data protection obligations.

 We aim to complete our investigation and send you an outcome within three months of receiving your complaint. For straightforward complaints this will often be sooner. For more complex matters it may take longer – if so, we will keep you updated and explain why.

Step 3 – Keeping you informed

We will not go silent while we are investigating. If we need more time, or if anything changes, we will contact you to let you know and give you a revised timescale.

If we need any further information from you to complete our investigation, we will get in touch to ask.

Step 4 – Our outcome

We will send you a written outcome that explains:

  • What we investigated and how.
  • What we found.
  • What we decided, and the reasons for our decision.
  • What action (if any) we have taken or will take as a result.

Your right to take your complaint to the ICO if you are not satisfied with our response.

If you are not satisfied with our response

If you are unhappy with how we have handled your complaint, or with the outcome we have given you, you have the right to refer the matter to the Information Commissioner’s Office (ICO) – the UK’s independent data protection regulator.

You can contact the ICO at any time. You do not have to wait for us to complete our process before going to the ICO, and you are not required to raise your concern with us first – though we would always appreciate the opportunity to try to put things right.

ICO Website: https://ico.org.uk

Helpline: 0303 123 1113

Our ICO Registration

Bury Business Exchange CIC is registered with the Information Commissioner’s Office under registration number XXXXXXXXXX.

Accessibility

We want this process to be accessible to everyone. If you need this notice in a different format – for example, in large print, or if you would like to speak to someone directly rather than communicate in writing – please let us know, and we will do our best to help.

Contact us at: info@burybusinesschange.co.uk

 

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our activities, legal requirements, or the way we process personal information.

Any updates will be published on this page. We encourage you to review this policy periodically.

Last updated: June 2026