Who is responsible
BDG, Dublin, Ireland, is the data controller for the information described here. For anything on this page, including a request to see or delete your data, write to .
What we collect, and only when you send it
This site has no analytics, no advertising pixels, no embedded third-party widgets and no tracking cookies. Reading it leaves nothing behind, which is why there is no cookie banner: there is nothing to consent to.
The contact form is the only place we collect anything. It takes:
- your name and email address, which we need to reply at all;
- your company and phone number, if you choose to give them;
- the service you selected and the message you wrote;
- the IP address the message was sent from.
If the enquiry turns into a conversation about actual work, we write a statement of work: a document setting out what we would deliver, what it excludes, what we need from you and what it costs. It carries your name, your company and your email address alongside the description of the work. It is a separate record from the enquiry, and it is kept for longer — see below.
Why we are allowed to hold it
When you ask a consultancy to look at a problem, handling your enquiry is the thing you asked for. We rely on our legitimate interest in responding to and keeping track of business enquiries, and on taking steps at your request before entering a contract. We do not send marketing to people who have only made an enquiry.
The IP address is kept for a different and narrower reason: the form is a public target, and an address is the only way to look into abuse of it.
A statement of work rests on something different again. Before you agree to it, it exists because you asked us to price the work. Once you agree to it, it is the contract between us, and holding it is necessary to perform that contract and to answer for it afterwards.
Who else sees it
We do not sell anything to anyone, and we do not share enquiries with other clients. The services that necessarily touch your data are:
- Our hosting and email providers, which store the enquiry and carry our reply to you.
How long we keep it
The IP address is erased 30 days after the enquiry arrives, because after that it can tell us nothing useful.
The enquiry itself is erased 24 months after we finish with it — that is, 24 months after it is marked won or lost. An enquiry nobody has answered yet is left alone, because it is still live work. If you become a client, records connected to that work are kept under the terms of that engagement instead.
A statement of work has its own clock, and it is deliberately not the same one. A draft we wrote but never sent you is erased 12 months after it was last touched — a proposal nobody acted on has no reason to hold your details. One that was issued is kept for 7 years from the day it went out, because it describes work that was agreed, and a question about that work can be raised long after the work itself is finished.
This means a statement of work outlives the enquiry that started it. If you ask us to erase your enquiry, the enquiry goes; a document recording work you agreed to does not, for as long as the period above. Everything is erased automatically on the dates described here — none of it waits for someone to remember.
Your rights
Under the GDPR you can ask us to show you what we hold about you, correct it, delete it, restrict what we do with it, hand it to you in a portable form, or object to us holding it at all. Where we rely on legitimate interest — which is most of what is described here — you can object, and we will stop unless we have a reason that overrides yours.
Ask by writing to . We will answer within one month. There is nothing to prove and no form to fill in; deleting an enquiry takes us less time than reading the request.
If we handle it badly, you can complain to the Irish Data Protection Commission at dataprotection.ie, or to the supervisory authority where you live.
Changes
If this page changes in a way that affects what happens to data we already hold, we will say so here and date it.