Business Quest privacy policy

Last updated 30 October 2026

This policy explains how BUSINESS QUEST LTD uses personal information when you visit our website, contact us, take part in a BHGI assessment, use BTIO services, join a Business Quest Game session or apply to work with us. It also explains your choices and how to raise a concern. Reading this policy does not amount to consent to marketing or optional cookies.

1 Who we are

BUSINESS QUEST LTD, trading as Business Quest, is registered in England and Wales under company number 17376281. Our registered office and correspondence address is 128 City Road, London EC1V 2NX, United Kingdom. Our website is businessquest.co.uk.

For privacy enquiries, rights requests or complaints, email policy@businessquest.co.uk with the subject "Privacy", call +44 7348 556953 or write to the address above, marked for the Privacy Lead. You do not need an account or a paid service to contact us about your information.

We are the controller for information we use to operate our website, manage enquiries and accounts, deliver our own assessments, administer client relationships and recruit. This means we decide why and how that information is used. If a client instructs us to handle personal information solely on its behalf during a BTIO project or another agreed activity, we act as its processor for that activity under a separate data processing agreement. The client remains responsible for its own privacy information and instructions. We can help you identify the appropriate contact.

2 The information we collect

• Contact and business details: your name, work email, telephone number, role, organisation, operating location and information you provide in an enquiry.
• Account and access records: account identifiers, email-verification and sign-in records, access permissions, invitations and security events.
• BHGI information: business-profile answers, questionnaire responses, supporting comments, uploaded evidence, respondent roles, assessment progress, scores, confidence indicators, reviewer notes and reports. Business records can contain personal information about employees, customers, suppliers or sole traders.
• BTIO information: project contacts and leads, agreed priorities, responsibilities, milestones, progress, comments, decisions and project documents.
• Commercial records: quotations, agreements, invoices, payment references, payment confirmations and correspondence about cancellations or refunds. Pilot payments are handled manually. We do not request payment-card details through our website.
• Participation and recruitment information: playtest registrations and feedback, CVs, professional profiles, experience, applications and interview records where relevant.
• Website information: IP address, browser and device information, access times, pages requested, error records and cookie preferences. Optional analytics information is collected only where the relevant feature is enabled and you have agreed to it.

We collect information from you and from the way you use our services. We may also receive it from your organisation, an authorised person who invites you to an assessment, other participants, or an introducer acting with appropriate authority. Where relevant to an enquiry or engagement, we may check public business information, such as Companies House records or a professional profile you provide.

Please provide only information needed for the task. Remove unnecessary names and identifiers from evidence. Do not upload passwords, full payment-card details, identity documents, information about children, criminal-offence information or sensitive details such as health or ethnicity unless we have specifically agreed a lawful and secure way to handle them. If sensitive information is needed, we will explain the purpose and relevant legal condition before requesting it.

3 Why we use information and our lawful bases

UK data protection law requires a lawful basis for each use of personal information. The basis depends on the activity and your relationship with us.

Purpose	Lawful basis and reason
Answer enquiries and arrange requested services	Steps towards, or performance of, a contract when you are personally the contracting party. Otherwise, our legitimate interests in responding to business enquiries and arranging services with your organisation.
Manage accounts and deliver BHGI or BTIO	Contract where you are personally a party. Otherwise, our legitimate interests, and those of the client organisation, in administering access, assessing the business, reviewing evidence and delivering the agreed work.
Keep services secure and handle support or complaints	Our legitimate interests in protecting information, investigating misuse and resolving problems. Legal obligation where a specific duty requires action, including handling data protection complaints and rights requests.
Maintain invoices and accounting records	Legal obligation to keep required tax and accounting records. Contract or legitimate interests, as applicable, for collecting payments and resolving commercial queries.
Review and improve the service	Our legitimate interests in checking quality, correcting errors and improving the assessment process. We minimise personal information and use anonymised information where possible. This does not authorise unrelated AI-model training.
Send optional updates or future playtest invitations	Consent. These choices are separate from assessment access, recruitment applications and service communications. You can withdraw them at any time.
Consider an application for a specific role	Steps towards a contract at your request and our legitimate interests in assessing suitability and managing recruitment. Legal obligations apply to checks where required. Future talent-pool retention is based on your separate consent.
Use optional analytics or advertising technologies	Consent, where these technologies are enabled. Necessary security and access functions operate on our legitimate interests, or contract where applicable, with the relevant cookie exemption.
Establish or defend legal claims	Our legitimate interests in protecting legal rights. A legal obligation may also require us to preserve or disclose particular records.

Where we rely on legitimate interests, we assess whether the activity is necessary and balance those interests against your rights. You can ask us about that assessment and object to the processing. We do not treat a contract with a limited company as a contract with every employee or respondent.

Some information is needed to provide the service, such as a contact address, account-verification information and the answers required for an assessment. If you do not provide it, we may be unable to create your account, complete the work or issue a meaningful report. Optional marketing and cookie choices are not conditions of using BHGI or BTIO.

4 BHGI scoring and the use of AI

BHGI assesses a business rather than rating an individual employee. Approved routing rules select relevant questions. Defined scoring rules calculate results from the submitted answers. Evidence coverage, confidence and risk indicators are considered separately from the health score.

Where enabled, AI can help interpret supporting information, select relevant recommendations and draft report explanations. It does not independently change a respondent's answers, the scoring rules or the calculated score. Paid reports require human review before an authorised release. The report identifies the assessment scope and relevant limitations; a free or preliminary result is not presented as independently verified.

We use only the information needed for an enabled AI task. We do not use identifiable client or respondent information to train general-purpose AI models, or authorise our AI providers to use it for that purpose. Anonymous statistics may support service evaluation, but information that is merely pseudonymised remains personal information and is protected accordingly.

Our pilot solution is not intended to make solely automated decisions about an individual that have legal or similarly significant effects, such as employment, credit or access to essential services. If a result appears wrong or affects you unfairly, contact us to request an explanation, correction or human consideration. A customer must not use BHGI as the sole basis for such a decision.

5 Who can see assessment and project information

Access within Business Quest is limited to authorised people who need the information for their role, including assigned assessors, reviewers and administrators. Technical support access is limited to what is needed to resolve an issue or maintain the service.

An assessment or project is commissioned for an organisation. Its authorised contacts receive the agreed reports and project information. Individual responses, names or evidence may be visible where the agreed workflow requires them; do not assume a submission is anonymous or confidential from your organisation. We explain the applicable visibility before you submit. Other respondents do not automatically receive access to everyone's answers or documents.

Reports and exports can contain personal and confidential business information. Once an authorised client downloads or shares a copy, that organisation is responsible for its own lawful use, access controls and retention. Contact us before submitting if you have a concern about who will see your contribution.

6 Service providers and other recipients

We use providers for website hosting, application infrastructure, email, file storage, security, support and, where enabled, AI processing and consented analytics. Providers acting as processors must follow our instructions and appropriate contractual safeguards. Banks and professional advisers may act as independent controllers for their own legal and professional duties.

We may share relevant information with authorised contractors, accountants, legal advisers, insurers, regulators or public authorities where needed for the purposes in this policy or where disclosure is required by law. If the business is sold or reorganised, necessary information may be shared with advisers and a prospective or actual successor, subject to appropriate confidentiality and data protection safeguards.

We do not sell personal information or raw respondent data. We do not publish identifiable client results, testimonials or case studies without separate permission. Links to services such as WhatsApp or other external platforms take you to providers with their own privacy terms; avoid sending sensitive evidence through those channels.

7 Processing outside the UK

Our providers or authorised support personnel may process information outside the UK. Remote access from another country can also be an international transfer, even if a server is located in the UK.

Where a restricted transfer occurs, we use a lawful transfer arrangement. Depending on the destination and recipient, this may be UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses. Where required, we assess the protection available and apply additional safeguards. You can ask us which countries and safeguards apply to your information and request a copy of the relevant safeguards, with confidential details redacted where necessary.

8 How long we keep information

We keep information only for the purpose for which it is needed. The normal periods below apply to records for which Business Quest is the controller. A documented legal hold, statutory requirement or active dispute may justify keeping particular records for longer, this does not justify retaining every associated document.

Record	Normal retention period
Enquiries that do not become engagements	12 months after the last meaningful contact.
Abandoned or incomplete assessments	6 months after the last activity, unless we agree that the assessment is continuing.
Completed free Quick Checks	12 months after the last assessment activity, unless the result becomes part of an agreed paid engagement or you ask us to delete it sooner and no retention exception applies.
Core paid client record and final report	Up to 6 years after the engagement ends, where needed to evidence the work, respond to complaints or establish or defend claims. We keep only the necessary record.
Raw evidence and working files	Normally 12 months after the final report or project closure, unless a shorter agreed period applies or a specific ongoing need is documented. Necessary extracts may form part of the core record.
Invoices and required accounting records	Normally 6 years from the end of the company financial year to which they relate, or longer where tax law requires.
Routine security and access logs	Up to 12 months. Records relevant to an incident may be retained while it is investigated and resolved.
Unsuccessful applications and talent pool	Specific-role applications: normally 6 months after the recruitment decision. Optional talent pool: 12 months after you opt in or renew your permission, unless you withdraw sooner.
Optional updates and playtest mailing lists	Until you unsubscribe, withdraw consent or the list is closed. We review contacts after 24 months without meaningful interaction.
Consent and suppression records	A limited record for as long as needed to demonstrate compliance and honour your communication choices. Suppression records are not used to send marketing.

When an account closes, we remove or restrict access to records that no longer need to be available. Closure does not automatically erase records that we must or are entitled to retain. Deleted information may remain in restricted backups until those backups expire; it is not used for routine business activity, and deletion is reapplied if a backup is restored. We can explain the applicable backup cycle on request.

For information processed solely on a client's instructions, the agreed data processing terms govern return and deletion. Anonymised information may be kept for longer only where people cannot reasonably be identified from it.

9 Cookies and optional communications

Necessary cookies and similar technologies support functions such as security, sign-in and saved choices. We ask for your permission before enabling optional analytics or advertising technologies. You can reject optional technologies without losing access to the core service and change your choice through Cookie settings. Our Cookie Policy explains the technologies in use and their duration.

Marketing consent is separate from submitting an enquiry, completing an assessment or applying for a role. Where you choose updates, you can unsubscribe using the link provided or by contacting us. We may still send non-marketing messages needed for your account, an active service or a session you have booked.

10 Security

We apply technical and organisational measures appropriate to the information and the risks, including access restrictions and procedures for handling incidents. No online service is completely secure. Protect your sign-in details, use the agreed evidence-upload route and tell us promptly if you suspect unauthorised access. We assess incidents and notify affected people and the regulator where the law requires.

11 Your rights

Depending on the circumstances, you can ask to access your personal information, correct inaccuracies, erase information, restrict its use, object to processing based on legitimate interests, or receive and transfer certain information in a usable format. You can withdraw consent without affecting processing that was lawful before withdrawal. You can object to direct marketing at any time, including related profiling.

These rights are not absolute. For example, a legal obligation or a justified need to defend a claim may require us to keep a limited record. We will explain any refusal or restriction and your right to complain. We normally respond within one month, subject to lawful extensions or pauses where additional information is needed. We may ask for proportionate information to verify your identity and protect other people's information. Requests are normally free of charge.

Use the contact details in section 1. If we are acting solely as a processor for your organisation, we will help route the request to the responsible controller and assist it as required.

12 Complaints

You have the right to complain to us about how we handle your personal information. Email policy@businessquest.co.uk, telephone us or write to our registered office. Explain what happened and the outcome you are seeking; you do not need to use a particular form.

We will acknowledge a privacy complaint within 30 days, investigate and respond without undue delay, keep you informed of progress and explain the outcome. You also have the right to complain to the UK's independent data protection regulator through ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. Contacting us does not remove that right.

13 Children and changes to this policy

Our business platform is intended for adult professional users. We do not knowingly seek children's information through business assessments or project uploads. If a recruitment or learning opportunity is open to people under 18, we will provide suitable privacy information before collecting their details. Contact us if you believe a child's information has been submitted inappropriately.

We may update this policy as our services or legal obligations change. The date at the top shows the latest version. Where a change materially affects how we use your information, we will provide an appropriate notice before the new use begins and obtain fresh consent where required.