Your details, in plain English.

Who we are

BBI (Build Buy Invest) is a trading name of Blue Puffin Stays Ltd. Blue Puffin Stays Ltd is the controller of your personal information. That means it decides how and why your details are used, and is responsible for looking after them.

Company

Blue Puffin Stays Ltd, registered in England and Wales, company number 13454752

Trading as

BBI (Build Buy Invest)

Registered office

Norcote Farmhouse, Norcote, Cirencester GL7 5RH

Email

revenue-ops@buildbuyinvest.co.uk

Phone

01285 429015

ICO registration

ZB088407

We don't have to appoint a Data Protection Officer. For any privacy question or request, use the details above.

If we contacted you first

BBI builds AI systems that save small businesses time and find them new clients. To find businesses we might help, we contact a small number of limited companies by email, and sometimes by post or on LinkedIn. If one of those messages brought you here, this part is for you.

What we hold

• Your name and your role in the business, for example director or owner.
• The company's name, number, registered office, website, type of business, rough size (from the accounts it files) and the area it's in.
• Your business email address.
• If we've connected on LinkedIn, the address of your public LinkedIn profile.
• The messages we've sent you, and any reply.

Our copy of the Companies House register also includes what Companies House publishes about directors and owners, such as a correspondence address and month and year of birth. We don't use those to contact you.

Where we found it

• Companies House, the public register of UK companies: company details, the names of directors and people with significant control, and the accounts companies file.
• Your company's own website.
• Anymail Finder, a service that finds a business email address from a name and a company, and checks it works.
• For a few people, their public LinkedIn profile, found with a web search service (Exa).

Why we use it, and our lawful reason

We use it to tell you, briefly, about a service that could save your business time or win it new clients, and to reply if you answer. Our lawful reason is legitimate interests: we have a genuine business interest in finding customers, and UK data protection law accepts direct marketing as one. We think it's fair to you because:

• we only use business details, about your role in the business;
• we contact one person per business, usually an owner or director;
• you get up to four short emails over about three weeks, and then we stop;
• we don't track whether you open our emails or click their links;
• one word stops it.

You can ask us for more detail about how we weighed this. You also have an absolute right to object to direct marketing: tell us and we stop, no questions asked.

The rules on marketing emails

The Privacy and Electronic Communications Regulations (PECR) let us email limited companies and limited liability partnerships without asking first, as long as we say who we are and give you a simple way to stop. PECR treats sole traders and some partnerships as individuals, so we don't send them marketing emails unless they've agreed. If you're a sole trader and we emailed you, please tell us and we'll remove you straight away.

LinkedIn and post

Andrew may view your LinkedIn profile, follow you or send you a connection request from his own LinkedIn account. You can simply ignore or decline it. LinkedIn's own privacy policy covers what LinkedIn does with your information. Sometimes we write to a company's registered office by post instead of emailing.

If you get in touch with us

What we collect

• The form on our website: your name, business name, email address, phone number if you give it, the problems you tick and your message. We also note the page you sent it from, how you reached the site (for example a search engine or one of our emails) and your country, which our web host works out from your connection.
• Email or phone: your contact details and what you tell us. We don't record calls.
• Booking a call: Google's booking page asks for your name and email address, and the call takes place on Google Meet.

What we do with it

• Reply to you with a written plan. An AI tool (Claude, made by Anthropic) writes a first draft from what you sent us. Andrew reads it, corrects it and sends it himself. The AI doesn't make any decision about you.
• Keep a record of your enquiry so we can follow it up.
• If you become a client: carry out our agreement with you, send invoices and keep the records the law requires.

Our lawful reasons are: taking steps you've asked for before an agreement; our legitimate interest in replying to people who contact us; our contract with you; and our legal duties under tax and accounting law.

Please don't send sensitive details, such as health information, in a message. If you do, we'll only use them to reply to you.

If you're a client

Systems we run for you

When we build a system that handles information about your customers, staff or contacts (for example an inbox assistant, payment matching, or emails sent in your name), we act as your processor. In practice:

• your business decides what the system is for, and stays responsible for the information (you are the controller);
• we only use it to do the job you've asked for, never for our own purposes;
• before we start, we sign a data processing agreement with you that says what we handle, how we keep it safe and which tools we use;
• when the work ends, we return or delete it, as you choose.

Your own privacy notice covers that information, not this one.

Finding new clients for you

If we find new clients for you, responsibility is shared in two steps:

• Building the list. We gather business contact details from public sources like the ones in section 2, and we're responsible for how we gather them.
• Using the list. Once we hand a list over, or send messages in your name, your business is responsible for how it's used. Your privacy notice needs to cover it, your first message needs to say where the details came from and how to opt out, and every opt-out must be honoured. PECR also means no marketing emails to sole traders or some partnerships unless they've agreed. We set the outreach up to do all of this, and we'll talk you through each point before anything is sent.

If another business contacted you with our help

That business is responsible for your details, and its name will be on the message. You can contact it directly. Or tell us, and we'll pass your request on and keep you off any lists we build in future.

Who else handles your details

We use a small number of service providers. They may only use your details to provide their service to us.

• CloudflareHosts this website, receives the enquiry form and counts visits.
• GoogleOur email (Google Workspace), the call booking page, Google Meet and the fonts on this site.
• AirtableWhere we keep a record of enquiries.
• AnthropicIts AI, Claude, drafts our first reply to an enquiry.
• Salesforge and WarmforgeSend our outreach emails and LinkedIn requests, keep our sending mailboxes healthy, and hold the list of who we're contacting.
• Anymail FinderFinds and checks business email addresses.
• ExaA search service we use to find public LinkedIn profiles.
• 123-reg (GoDaddy)Hosts our buildbuyinvest.co.uk mailbox, where replies arrive.
• SonetelRuns our phone line, 01285 429015.
• Xero and our accountantsOnly if you become a client, for invoices and accounts.

The automations that move enquiries between these tools run on our own computer in the UK, not on someone else's service. We may also share information with our professional advisers or insurers if needed for a dispute, and with the police, courts or regulators where the law requires it.

We never sell your details or pass them to anyone for their own marketing.

Outside the UK

Some of these providers store or access information outside the UK, mainly in the United States and the European Economic Area. When they do, it's protected in one of the ways UK law allows: the country has been approved by the UK government as giving adequate protection (as the EEA has), the provider is certified under the UK Extension to the EU-US Data Privacy Framework, or the provider has signed the UK's approved contract terms.

How long we keep it

• Outreach, if you don't reply: up to 12 months after our last message, then we delete it from our outreach tools.
• If you tell us to stop: only your email address, your name and the company's name, on our do-not-contact list, so we never contact you again.
• Enquiries that don't lead to work: up to 2 years.
• Clients: agreements, invoices and payment records for 6 years after the end of the financial year they relate to, as tax and accounting law requires. Information we handle for you as your processor: as set out in our agreement with you.

This website

• No cookies. This website doesn't set any cookies, which is why there's no cookie banner.
• Visitor numbers. Cloudflare Web Analytics counts visits without cookies and without identifying you.
• Delivering the site. To show you the site and protect it from attacks, our host, Cloudflare, processes your IP address and browser details. The page loads its fonts from Google and some of its code from Cloudflare's public code library, so those services also see your IP address.
• Booking a call. The booking link takes you to Google's own booking page, which Google's privacy policy covers.

Your rights

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything that's wrong or incomplete;
• ask us to delete your information, where we no longer need it;
• ask us to restrict how we use it, or object to our use of it, including an absolute right to object to marketing;
• ask for information you gave us to be sent to you or another organisation in a portable format;
• withdraw your consent at any time, where we rely on consent;
• not be subject to a decision made only by a computer that has a legal or similarly serious effect on you. We don't make decisions like that.

To use any of these rights, email revenue-ops@buildbuyinvest.co.uk or ring 01285 429015. We'll reply within one month, and there's usually no charge. Some rights have limits: for example, we must keep invoices and payment records for tax purposes.

Complaints and changes

If you're unhappy with how we've handled your details, please tell us first so we can put it right. Email revenue-ops@buildbuyinvest.co.uk with "Privacy complaint" in the subject. We'll acknowledge it within 30 days, look into it without undue delay, keep you updated and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

We'll update this notice when what we do changes. The date at the top shows when it last changed.