Privacy Notice

Bespoke Integrity Solutions Limited

Last updated: 30 October 2026

1. Who we are

Bespoke Integrity Solutions Limited (BIS) provides workplace mediation, independent investigations, ISO internal auditing and related professional services. We take the privacy and security of personal information seriously, particularly where our work involves sensitive workplace matters.

Bespoke Integrity Solutions Limited | Company number 11897288 | Registered in England and Wales. Registered office: 124 City Road, London EC1V 2NX, United Kingdom.

For questions about this notice or about your personal information, email peter@bespokeintegritysolutions.com. Our website is www.bespokeintegritysolutions.com.

2. When this notice applies and our role

This notice explains how BIS uses personal information in relation to website visits, enquiries, prospective and existing clients, professional contacts, suppliers and professional assignments where BIS determines the purposes and means of processing.

BIS is generally a data controller for its own business enquiries and administration. For client commissions, including mediation, investigations or ISO audits, BIS may act as a controller or as a processor for an instructing organisation. The role and relevant responsibilities are assessed for each engagement. Where another organisation is the controller, its privacy notice and instructions may also apply, and BIS may provide or help deliver additional case-specific privacy information.

This general notice may be supplemented by privacy information provided for a particular investigation, mediation or other assignment.

3. The personal information we use

Depending on your dealings with BIS, the information may include:

Contact and identity information: names, job titles, employer or organisation, email addresses, telephone numbers and business contact details.
Enquiries and correspondence: information provided through our website form, by telephone, email, appointment booking or professional introductions.
Commercial information: instructions, contracts, invoices, payment and accounting records, and supplier or associate details.
Professional assignment information: meeting arrangements, participant details, correspondence, reports, interview records, witness accounts, documentary references, evidence and other material relevant to an authorised assignment.
Special-category or criminal-offence information: where necessary in a particular assignment, information such as health details, employment grievances, allegations or suspected misconduct. These categories require additional assessment and safeguards.
Website and security information: technical information associated with visits and website operation, which may include IP addresses, browser and device details and usage information collected by Squarespace or related services.

4. Where the information comes from

We obtain personal information directly from people contacting or dealing with BIS, and, where relevant, from commissioning organisations, mediation participants, witnesses, representatives, professional advisers, records supplied for assignments and lawfully available public sources. We may also receive information through website technologies.

If we obtain information about you from someone else, we will provide appropriate privacy information where the law requires it. Some limited legal exemptions may apply, for example in particular investigative circumstances; any reliance on an exemption is considered individually.

5. Our purposes and lawful bases

We use personal information for the following purposes. The legal basis depends on the circumstances:

To respond to enquiries, consider instructions and communicate with prospective clients — generally our legitimate interests in responding to business enquiries, or steps requested before entering into a contract with an individual.
To provide and manage agreed services, meetings, reports and professional relationships — the performance of a contract with an individual where applicable, legitimate interests, or another lawful basis identified for the particular engagement.
To administer contracts, invoices, accounting and tax obligations — contractual necessity where applicable and compliance with legal obligations, including relevant accounting and tax duties.
To manage our systems, control access, protect records and deal with complaints or legal claims — our legitimate interests in operating and protecting the business, or compliance with applicable legal obligations.
To make appropriate professional or marketing communications — legitimate interests or consent as applicable, subject to the rules governing electronic marketing and the right to object.
To operate and understand use of our website — the applicable lawful basis and any required consent or statutory exception for particular cookies or similar technologies, as explained in our Cookie Notice.

Where we rely on legitimate interests, these include responding to people who contact BIS, delivering professional services, managing commercial relationships, protecting confidential information and establishing or defending legal rights. We assess these interests against the rights and freedoms of the people concerned.

For sensitive assignment information, BIS documents a case-specific assessment of the Article 6 basis and any additional Article 9 or Article 10 / Data Protection Act 2018 condition required. We do not treat a general enquiry as permission to process all sensitive information for any purpose.

6. Mediation, investigations and audit assignments

Professional assignments can involve information about people who did not contact BIS themselves. We seek to collect and disclose information that is relevant, necessary and proportionate to the particular instruction.

In mediation, temporary handwritten working notes are normally securely destroyed at the conclusion of the mediation. BIS may retain the formal mediation agreement and outcome report under its records-retention policy. The mediation agreement is normally supplied to the participants. A commissioning employer may receive a brief confirmation that mediation occurred and whether an agreement was reached. The full agreement is supplied to the employer only where the participants have agreed to its wider sharing; any additional account of discussions or agreed actions is shared only where the participants agree.

For independent investigations, the handling of interview notes, witness accounts, evidence and reports depends on the client instructions, BIS’s data-protection role and the agreed case arrangements. In subcontracted cases, the instructing organisation’s systems may hold the authoritative case file; temporary BIS copies are reviewed at handover. For ISO audits, BIS generally records references and observations rather than routinely copying all client source documents.

BIS may need to disclose information to the instructing client or other appropriate recipients where justified and lawful. Confidentiality arrangements do not prevent disclosures required by law or necessary to protect legal rights.

7. Who may receive information

We share information only where there is a suitable purpose and legal basis. Depending on the circumstances, recipients may include:

Website hosting and form services (Squarespace), Microsoft 365 services for email and OneDrive document storage, appointment-booking services, and relevant security services such as Google reCAPTCHA.
A commissioning organisation and authorised participants or representatives in a professional assignment.
Authorised professional associates, advisers, accountants, insurers or other service providers where appropriate safeguards and contractual arrangements apply.
Courts, regulators, law-enforcement bodies or others where disclosure is required or otherwise justified by law.

Our use of linked external services, such as Microsoft Bookings and LinkedIn, may also involve those providers processing information under their own privacy notices when you choose to use them. We do not treat information sent to BIS as unrestricted permission to share it.

8. Use of AI-assisted tools

BIS uses AI-assisted tools for activities such as research, drafting, website development and business administration. We retain human responsibility for reviewing outputs and professional decisions.

Our internal AI policy restricts the use of identifiable or sensitive client information. Any proposed exceptional use involving such information requires a documented assessment of necessity, confidentiality, contractual permissions, lawful bases, service-provider arrangements and safeguards. We do not rely solely on AI to make decisions about a person’s employment, credibility or alleged misconduct.

Where AI-related processing of personal information is relevant to a particular engagement, we will explain the arrangements as appropriate.

9. International data transfers

Some providers supporting BIS may store or make personal information accessible outside the United Kingdom. Where BIS initiates a restricted transfer, it must have an appropriate legal route, such as UK adequacy regulations, approved safeguards or an applicable exception. The actual arrangements depend on the provider and service.

You can contact us to request information about the transfer arrangements and any safeguards applicable to your personal information.

10. How long we keep information

BIS has adopted a documented retention and secure-disposal policy. Its normal periods are summarised below. Different periods may apply where required by law, applicable client instructions, professional obligations or a justified need to preserve information for an ongoing or reasonably anticipated dispute or claim. We review sensitive information sooner where it is no longer needed.

Older records previously retained without formal time limits are subject to a controlled review before any deletion; adopting the schedule does not authorise automatic or indiscriminate disposal.

Normal retention periods:

Unsuccessful business enquiries: Normally 12 months from last substantive contact.
Client contracts and commercial correspondence: Normally 6 years from closure or the end of the engagement.
Formal mediation agreements and outcome reports: Reviewed at 3 years after conclusion; normally deleted by 6 years.
Temporary handwritten mediation notes: Normally securely destroyed at the conclusion of mediation.
Direct investigation records held by BIS as controller: Reviewed at 3 years after case closure; normal 6-year upper limit.
Subcontracted investigation data held as processor: Returned or deleted according to lawful client/controller instructions and any legal preservation requirement.
ISO audit plans, reports and working papers: Reviewed at 3 years; normal 6-year upper limit after audit completion.
Company accounting, tax and VAT records: Generally at least 6 years, subject to the applicable statutory rules and starting dates.
Data-protection rights requests and complaints: Normally 3 years from closure.
Security incident records: Normally 6 years from closure.

11. How we safeguard information

BIS uses appropriate organisational and technical measures according to the sensitivity of the information involved. These include restricted access to client and case information, account multifactor authentication, encryption on BIS computers, secure handling of temporary paper notes and secure information-transfer methods suited to the assignment.

Electronic client information is principally stored using Microsoft 365 business email and OneDrive, or authorised client-controlled systems. BIS uses OneDrive synchronisation and available recovery facilities as part of its documented business arrangements. No electronic communication or system can be guaranteed to be completely secure.

Please do not send detailed allegations, medical information or confidential evidence in an initial website enquiry. We can arrange a more appropriate route for sensitive material where necessary.

12. Cookies and website analytics

Our website uses Squarespace and related services for operation, security and website analytics. The website may use cookies and other technologies that store or access information on a visitor’s device.

Our separate Cookie Notice explains the particular technologies used and the choices available to visitors. Where consent is required, appropriate controls must be provided; where a statutory exception applies, the applicable information and objection requirements will be addressed.

13. Your rights

Subject to the applicable law and circumstances, you may have rights to be informed; access your personal information; have inaccurate information corrected; request deletion or restriction; object to processing; and, in some cases, receive information in a portable format. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

YOUR RIGHT TO OBJECT: Where BIS relies on legitimate interests, you may object on grounds relating to your particular situation. You have an unconditional right to object to processing for direct marketing.

Please contact peter@bespokeintegritysolutions.com if you wish to exercise a right. We may need to confirm your identity. Where another organisation controls the relevant information, we may refer your request to that organisation or assist it in responding.

14. Data protection complaints

If you are concerned about BIS’s use of personal information, please contact peter@bespokeintegritysolutions.com with details of your concern. You may complain by email or another appropriate communication method.

BIS will acknowledge a data-protection complaint within 30 days of receipt, investigate as appropriate without undue delay, keep you informed and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk. We encourage you to raise concerns with us first so that we have an opportunity to address them.

15. Changes to this notice

We review this notice when our services, systems, legal requirements or personal-data processing change. The date on the published notice will show when it was last updated. Where the law requires us to tell people directly about a material change, we will do so.