Privacy Policy_
1. Introduction
Brimstone Site Investigation Limited (“Brimstone”, “we”, “our”, “us”) is committed to protecting the privacy and security of the personal data of visitors to our website.
This Privacy Notice explains how we collect, use, store and otherwise process personal data of users of www.brimstoneuxo.com (the “Site”). It is issued in accordance with Articles 13 and 14 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).
This Notice applies to data we collect through the Site, including via our contact forms, newsletter signup (Brimstone Members Club), careers enquiries, cookies and analytics. It does not apply to personal data processed under our separate employee, sub-contractor or client engagement arrangements, which are governed by their own privacy notices.
Please read this Notice carefully. By using our Site you confirm that you have read and understood it.
2. Who is the Data Controller?
Brimstone Site Investigation Limited is the Data Controller of personal data collected through the Site.
Brimstone Site Investigation Limited
Innovation Centre Medway, Unit S2C
Maidstone Road, Chatham, ME5 9FD
Company Number: 10253758
Email: enquire@brimstoneuxo.com
If you have any questions about this Notice or how we handle your personal data, please contact us using the details above.
3. Categories of Personal Data We Collect
We may collect, store and process the following categories of personal data about you, depending on how you use the Site.
3.1 Information You Provide Directly
When you submit a contact form, sign up to the Brimstone Members Club, or otherwise communicate with us via the Site, we collect:
- First name and last name
- Company name
- Job title
- Email address
- Telephone number (where provided)
- The content of any message or enquiry you send to us
- Any supporting documents you upload (jpg, png, pdf, docx)
3.2 Marketing Preferences
Where you opt in to receive marketing emails from Brimstone, we record your consent and the date it was given.
3.3 Careers Applications
If you apply for a role with Brimstone via the Site, we collect the personal data you provide in your application, including:
- Name and contact details
- CV, covering letter and any supporting documents
- Employment history, qualifications and right to work information
- Any other information you choose to provide
3.4 Technical and Analytics Data
When you visit the Site we automatically collect technical information, including:
- IP address
- Web browser type and version
- Operating system and device type
- Pages visited, time spent and navigation paths
- Referring website (including UTM source, medium, campaign, term and content parameters)
- Cookie identifiers (see Section 9)
4. Purposes and Lawful Bases for Processing
We process your personal data for the purposes set out in the table below. Each purpose is supported by a specific lawful basis under Article 6 UK GDPR.
| Purpose | Lawful Basis | Further Detail |
|---|---|---|
| Responding to enquiries submitted via contact forms | Article 6(1)(b) UK GDPR – steps prior to entering into a contract; or Article 6(1)(f) – legitimate interests | To handle your enquiry and provide information about our services |
| Sending marketing emails (Brimstone Members Club and equivalent) | Article 6(1)(a) UK GDPR – consent | You may withdraw consent at any time by clicking unsubscribe in any email or contacting us directly |
| Operating, securing and improving the Site | Article 6(1)(f) UK GDPR – legitimate interests | Our legitimate interest in providing a functional, secure website to visitors |
| Website analytics and performance measurement | Article 6(1)(a) UK GDPR – consent (where required); Article 6(1)(f) – legitimate interests (essential analytics) | Subject to your cookie preferences. See Section 9 and our Cookies Policy |
| Processing careers applications | Article 6(1)(b) UK GDPR – steps prior to entering into a contract | To assess your suitability for the role you have applied for |
| Compliance with legal obligations | Article 6(1)(c) UK GDPR – legal obligation | Including responses to lawful requests from regulators, courts or law enforcement |
| Defending or bringing legal claims | Article 6(1)(f) UK GDPR – legitimate interests | Our legitimate interest in protecting our legal rights |
We do not use the Site to collect Special Category Data or criminal offence data. Where you voluntarily provide such information (for example in the body of an enquiry), we will process it only to the extent necessary to respond to you, in accordance with the conditions set out in DPA 2018 Schedule 1.
5. Sharing Your Personal Data
We may share your personal data with the following categories of recipients:
- IT, hosting and software service providers (including our website host, contact form provider and email infrastructure)
- Email marketing platforms, including MailChimp (Intuit), where you have opted in to receive marketing communications
- Website analytics providers, including Google Analytics, subject to your cookie preferences
- Professional advisers (legal, accounting, insurance) where reasonably necessary
- Regulatory, governmental or law enforcement bodies where required by law
- Prospective purchasers of Brimstone or any part of its business, subject to appropriate confidentiality protections
All third parties are required to handle your personal data securely and in accordance with applicable law. We do not sell your personal data to third parties.
6. International Transfers
Some of our service providers (including MailChimp and Google) may store or process personal data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including (where applicable) UK adequacy regulations, the International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms.
7. Data Retention
We retain your personal data only for as long as is necessary for the purposes for which it was collected. Indicative retention periods are as follows:
- Contact form enquiries and supporting documents: 24 months from last contact, then deleted unless required for an ongoing engagement
- Marketing subscribers (Brimstone Members Club): until you withdraw consent or unsubscribe, after which your data is deleted within 30 days
- Unsuccessful careers applications: 12 months from the date of application, after which data is deleted unless you have consented to retention for future opportunities
- Website analytics data: up to 26 months (Google Analytics default retention)
- Records required for legal or regulatory purposes: as required by the relevant law (typically 6 to 7 years)
At the end of the applicable retention period, your personal data is securely deleted or permanently anonymised.
8. Your Rights
Under UK GDPR you have the following rights in relation to your personal data:
- Right to be informed – to receive clear information about how your personal data is used (this Notice)
- Right of access – to request a copy of the personal data we hold about you
- Right to rectification – to request correction of inaccurate or incomplete data
- Right to erasure – to request deletion of your data in certain circumstances (the “right to be forgotten”)
- Right to restriction – to request that we limit processing of your data in certain circumstances
- Right to data portability – to receive your data in a structured, machine-readable format where processing is based on consent or contract
- Right to object – to object to processing based on legitimate interests, to direct marketing, or to processing for statistical or research purposes (in each case subject to applicable exemptions)
- Right to withdraw consent – where processing is based on consent, you can withdraw it at any time
- Rights in relation to automated decision-making – to not be subject to solely automated decision-making that produces legal or similarly significant effects
Some rights are subject to legal exemptions and may not apply in all circumstances. To exercise any of your rights, please contact us using the details in Section 2. We will respond within one month of receipt of your request.
9. Cookies and Similar Technologies
Our Site uses cookies and similar technologies to operate, analyse usage and (where you consent) deliver tailored content. Full details, including the specific cookies we use and how to manage your preferences, are set out in our separate Cookies Policy available at www.brimstoneuxo.com/cookies.
You can manage your cookie preferences at any time via the cookie banner or your browser settings. Restricting cookies may affect the functionality of the Site.
10. Automated Decision-Making
We do not carry out solely automated decision-making or profiling via the Site that produces legal or similarly significant effects on you.
11. Children’s Data
The Site is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us and we will take steps to delete it.
12. Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, secure hosting, encryption in transit and confidentiality obligations on personnel and processors.
No transmission of data over the internet can be guaranteed to be entirely secure. While we take reasonable steps to protect your personal data, we cannot guarantee absolute security of any data transmitted to or from the Site.
13. Changes of Business Ownership
From time to time we may expand, reduce or restructure our business, which may involve the sale or transfer of all or part of Brimstone. Personal data may be transferred as part of any such transaction, subject to appropriate confidentiality protections. Any recipient will be permitted to use the data only for the purposes set out in this Notice (or as separately notified to you).
14. Complaints
If you have concerns about how your personal data is processed, please contact us in the first instance using the details in Section 2. We will investigate and respond promptly.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Tel: 0303 123 1113
Website: https://ico.org.uk
15. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in law, our practices or our services. The current version is available at all times on the Site. Material changes will be flagged on the Site and, where appropriate, communicated by other means.
This Notice was last updated on 15 May 2026.