Last updated: May 2026

1. Introduction Welcome to Spire Business Management Solutions Ltd ("Spire BMS", "we", "our", or "us"). We are committed to protecting and respecting your privacy. This policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://www.spirebms.co.uk (the "Website").

Spire Business Management Solutions Ltd is the data controller responsible for your personal data. We are registered in England and Wales (09298215), and our registered office is Unit 11-13 Elgar Business Centre, Moseley Rd, Hallow, Worcester WR2 6NJ, United Kingdom.

This policy applies to the Website only. If you use any of our customer portals, support platforms, or other online services, separate privacy terms may apply and will be provided at the point of access.

---

2. Information We Collect We collect and process the following types of personal data:

• Personal Information: When you contact us via forms, email, or phone, we may collect your name, email address, phone number, company name, and any message content you provide.
• Technical Data: When you visit our Website, we automatically collect certain data through cookies and analytics, including your IP address, browser type and version, device information, pages visited, referring URLs, and time spent on our Website.
• Cookies and Tracking Technologies: We use cookies and similar technologies to enhance your browsing experience and analyse Website usage. For more information, see the Cookies and Analytics section below.

---

3. Lawful Basis for Processing Under the UK General Data Protection Regulation (UK GDPR), we must have a valid legal basis for processing your personal data. The bases we rely on are:

• Legitimate Interest: We process technical data and analytics information to maintain, improve, and secure our Website. We also use this basis when responding to general enquiries from prospective customers where no contract is yet in place. We have assessed that these interests do not override your rights and freedoms.
• Contractual Necessity: Where you are an existing customer or are taking steps to engage our services, we process your personal data as necessary to fulfil our obligations or to take pre contractual steps at your request.
• Consent: Where we use non essential cookies (such as analytics cookies), we rely on your consent, which you can provide or withdraw at any time through our cookie settings.
• Legal Obligation: We may process your data where required to comply with a legal or regulatory obligation.

---

4. How We Use Your Information We use your data for the following purposes:

• To provide and manage our Website and services.
• To respond to your enquiries and provide customer support.
• To improve our Website through analytics and user feedback.
• To send you information about our services where you have given consent or where we have a legitimate interest to do so (you can opt out at any time).
• To comply with legal obligations.

---

5. Cookies and Analytics Our Website uses cookies and analytics tools to collect information about your browsing behaviour. These tools are only activated after you have given your consent through the cookie notice displayed when you first visit the Website.

• Essential Cookies: These are necessary for the Website to function properly and cannot be switched off. They do not store any personally identifiable information.
• Analytics Cookies: These allow us to measure and understand how visitors use our Website. They are only placed with your consent.
• Google Analytics: We use Google Analytics (GA4) to track website performance and visitor interactions. Google acts as a data processor on our behalf under a Data Processing Agreement. Analytics data is retained for 14 months. Google may collect data such as your IP address and browsing habits. You can opt out by using the Google Analytics Opt out Browser Add on: https://tools.google.com/dlpage/gaoptout.
• Microsoft Clarity: We use Microsoft Clarity to understand how visitors interact with our Website through session replays and heatmaps. Clarity may record mouse movements, clicks, scrolls, and page content to help us identify usability issues and improve the user experience. Microsoft acts as a data processor on our behalf. Clarity does not collect passwords or payment details, and data is processed in accordance with Microsoft's privacy practices. You can learn more at https://clarity.microsoft.com.

You can manage your cookie preferences at any time through the cookie notice displayed on our Website. When you first visit, all non essential tracking is disabled by default and will only activate if you choose to accept. You can also disable cookies through your browser settings.

---

6. How We Share Your Data We do not sell or rent your personal data. However, we may share your information in the following situations:

• With service providers that help us operate our Website and deliver our services. These currently include Google (analytics) and Microsoft (analytics and session replay). These providers only process your data on our instructions and are bound by contractual obligations to keep it secure.
• When required by law, regulation, or legal process, or to protect our rights and safety.
• In connection with a merger, acquisition, or sale of all or part of our business, in which case you would be notified of any change in data controller.

---

7. International Data Transfers Some of our service providers, including Google (Analytics) and Microsoft (Clarity), may process your data outside the United Kingdom. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as UK approved Standard Contractual Clauses or reliance on a UK adequacy decision for the receiving country. If you would like further details about the safeguards we use, please contact us using the details in section 13.

---

8. Data Retention We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy. As a guide:

• Enquiry and contact data is retained for 24 months after your last communication with us, unless a customer relationship is established.
• Customer data is retained for the duration of our business relationship and for up to 6 years afterwards to comply with legal and accounting obligations.
• Analytics data is retained in line with Google Analytics default retention settings (14 months). Microsoft Clarity retains session data for 30 days.

When personal data is no longer required, it is securely deleted or anonymised.

---

9. Your Rights Under UK GDPR You have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of any inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data where there is no compelling reason for us to continue processing it.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Object: Object to processing based on legitimate interest or for direct marketing purposes.
• Right to Data Portability: Request that we transfer your data to you or another provider in a structured, commonly used format.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at info@spirebms.co.uk. We will respond to your request within one month.

If you are not satisfied with how we handle your data or respond to your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

---

10. Security Measures We implement appropriate technical and organisational measures to protect your data from unauthorised access, alteration, disclosure, or destruction. These include secure hosting, encrypted connections (SSL/TLS), and access controls on our systems. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

---

11. Third Party Links Our Website may contain links to third party websites. We are not responsible for the privacy practices of external sites, and we recommend reviewing their privacy policies before submitting any personal data.

---

12. Changes to This Privacy Policy We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last updated" date. Where changes are significant, we will take reasonable steps to bring them to your attention.

---

13. Contact Us If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

Spire Business Management Solutions Ltd
Unit 11-13 Elgar Business Centre, Moseley Rd, Hallow, Worcester WR2 6NJ
Website: https://www.spirebms.co.uk
Email: info@spirebms.co.uk
Telephone: 0330 205 0250