External Privacy Notice

1. Purpose of this Policy

Brilliant & Bloom Limited respects your concerns about privacy. This privacy and cookie policy (“Privacy Policy”) applies to personal information (also called personal data) we obtain from any person who visits any of our websites (together, the “Websites” and each a “Website”) and who uses the services that we make available from any of our Sites (our “Services”).

This Privacy Policy describes the types of personal information that we might obtain through a Website, how we may use that information, with whom we may share it and the choices you may have regarding our use of the information. We also describe the measures we take to safeguard the information. Please take a moment to read and understand it.

2. Who are we and what do we do?

Brilliant & Bloom Limited and any subsidiary from time to time of Brilliant & Bloom Limited.

This privacy policy is issued on behalf of Brilliant & Bloom Limited so when we mention “we”, “us” or “our” in this Privacy Policy, we are referring to the Brilliant & Bloom Limited as responsible for processing your data:

For personal data collected by Brilliant & Bloom Limited, we are the data controller responsible for your personal information and are registered at the UK Information Commissioner’s Office with registration number CSN6328174. Brilliant & Bloom Limited is registered with company number 15817389 and its registered company address is at 167 City Road London, EC1V 1AW, United Kingdom.

3. How to contact us?

If you have any questions about this Privacy Policy or want to exercise any of your legal rights, please contact us by sending an e-mail to hello@brilliantandbloom.com.

4. What personal information do we collect?

The types of personal data that we collect and use will depend on various circumstances. The data may include, for example: contact information, such as your name, postal address, email address and telephone number, the company you work for, your job title and department; personal information in content you provide on our Website; IP address (a unique identifier for your computer or other device); mobile device ID; and any other personal data we may obtain through you interacting with us.

If you apply to us for any employment, the Recruitment Privacy Notice set out below will apply to your application.

We do not knowingly collect personal data from children under the age of 13 and we do not target our website to children under 13. If you are under 13 and want to ask us a question or use the Website in any way that means you have to provide any personal information, please get your parent or guardian to contact us or provide the information instead.

5. How do we use your personal information?

We may use your personal information for a number of different purposes. In some countries, we are also required by law to state a “legal basis for processing” i.e. to tell you on what grounds we are allowed to use your information, and this is set out below:

How we will use your personal information?

Client services enquiries:
Our Websites provide multiple email addresses for you to contact us, depending on your request. If you submit your personal information via email, we will use it to enable us to respond to your request.

Marketing Communications:
To provide you with email marketing materials e.g. a newsletter, bulletins.

Business administration and legal compliance:
We use your personal information for the following business administration and legal compliance purposes:

to comply with our legal obligations;
to enforce our legal rights;
to protect rights of third parties; and
in connection with a business transition such as a merger, acquisition by another company, or sale of all or a portion of our assets.

Who do we share your information with?

We may share your personal information with our vendors and service providers, such as third party email marketing providers who assist us in delivering our email marketing campaigns, but they are not authorised by us to use such information for their own benefit.

We may share your personal information with professional advisers such as lawyers and accountants and/or governmental or regulatory authorities.

Our legal basis for processing

It is in our legitimate interest to use your personal information in such a way to ensure that we can respond to your enquiry.

Where your personal information is completely anonymised, we do not require a legal basis to use it as the personal information will no longer constitute personal information that is regulated under data protection laws. However, our collection and use of such anonymised personal information may be subject to other laws where your consent is required. Please see Section 12 below for further details about cookies.

Where your personal information is not in an anonymous form, it is in our legitimate interest to use your personal information for marketing purposes.

We will only send you marketing communications via email where you have consented to receive such marketing communications, or where we have a lawful right to send this information.

Where we use your personal information in connection with a business transition, enforce our legal rights, or to protect the rights of third parties it is in our legitimate interest to do so. For all other purposes described in this section, it is our legal obligation to use your personal information to comply with any legal obligations imposed upon us such as a court order.

Where we share your sensitive personal information, we shall obtain your consent to do so.

6. Our use of cookies and similar technologies

Our Websites use certain cookies, pixels, beacons, log files and other technologies of which you should be aware. Please see section 12 below to find out more about the cookies we use and how to manage and delete cookies.

7. Third Party Links and Services

Our Websites may contain links to third party websites and services. Please remember that when you use a link to go from our Websites to another website or you request a service from a third party, this Privacy Policy no longer applies. Instead, your browsing and interaction on any other websites, or your dealings with any other third party service provider, is subject to that website’s or third party service provider’s own rules and policies. Please note that we do not monitor, control, or endorse the privacy practices of any third parties.

We encourage you to become familiar with the privacy practices of every website you visit or third party service provider that you deal with and to contact them if you have any questions about their respective privacy policies and practices.

8. How long do we keep your personal information for?

We do not keep your personal data for any specific period but will not keep it for longer than is necessary for our purposes.

9. Confidentiality and security of your personal information

We are committed to keeping the personal information you provide to us secure and we will take reasonable precautions to protect the personal information that we have under our control from:

unauthorised access;
improper use or disclosure;
unauthorised modification; and
unlawful destruction or accidental loss.

All of our employees and data processors (i.e. those who process your personal information on our behalf, for the purposes listed above), who have access to, and are associated with the processing of personal information, are obliged to respect the confidentiality of the personal information of all users of our Websites and Services.

10. Transfers of personal data outside the EEA

Some of the personal information we collect about you through the Website will be transferred to countries other than the country in which the information originally was collected. Those countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your personal information to other countries, we will ensure that the transfer is lawful and that there are appropriate security arrangements in place.

11. How to access your information and your other rights?

To the extent provided by the law of your jurisdiction, you may (i) have the right to access certain personal information we maintain about you and obtain a copy of that information, (ii) update or correct inaccuracies in that information, (iii) object to our use of your personal information, and (iv) delete your personal information from our database. To exercise these rights, please contact us using the details above. To help protect your privacy and maintain security, we may take steps to verify your identity before granting you access to the information. A charge may be applicable before we provide you with a copy of any of your personal information that we maintain.

If you are located in the UK, EEA or Switzerland, you have the following rights in relation to the personal information we hold about you:

Your right of access.

If you ask us, we’ll confirm whether we’re processing your personal information and, if so, provide you with a copy of that personal information (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.

Your right to rectification.

If the personal information we hold about you is inaccurate or incomplete, you’re entitled to have it rectified. If we’ve shared your personal information with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal information with so that you can contact them directly.

Your right to erasure.
You can ask us to delete or remove your personal information in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable). If we’ve shared your personal information with others, we’ll let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal information with so that you can contact them directly.

Your right to restrict processing.
You can ask us to ‘block’ or suppress the processing of your personal information in certain circumstances such as where you contest the accuracy of that personal information or you object to us processing it. It won’t stop us from storing your personal information though. We’ll tell you before we lift any restriction. If we’ve shared your personal information with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal information with so that you can contact them directly.

Your right to data portability.
You have the right, in certain circumstances, to obtain personal information you’ve provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.

Your right to object.
You can ask us to stop processing your personal information, and we will do so, if we are: (a) relying on our own or someone else’s legitimate interests to process your personal information, except if we can demonstrate compelling legal grounds for the processing; or (b) processing your personal information for direct marketing.

Your rights in relation to automated decision-making and profiling.
You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.

Your right to withdraw consent.
If we rely on your consent (or explicit consent) as our legal basis for processing your personal information, you have the right to withdraw that consent at any time.

Your right to lodge a complaint with the supervisory authority.
If you have a concern about any aspect of our privacy practices, you can report it to the UK Information Commissioner’s Office (ICO) or any other supervisory authority or regulator responsible for data protection and privacy in your jurisdiction. If you are based in the UK, you can find details about the ICO on the ICO website at https://ico.org.uk or by contacting them at https://ico.org.uk/global/contact-us/

SPECIFIC PRIVACY RIGHTS OF UNITED STATES RESIDENTS

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another U.S. state with a similar comprehensive consumer privacy law, you are granted specific rights regarding access to your personal information.

What categories of personal information do we collect?

We have collected the following categories of personal information in the past twelve (12) months:

Categories:

A. Identifiers

Example: Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name.

Collected: YES

B. Protected classification characteristics under state or federal law

Example: Gender and date of birth

Collected: NO

C. Commercial information

Example: Transaction information, purchase history, financial details, and payment information

Collected: NO

D. Biometric information

Example: Fingerprints and voiceprints

Collected: NO

E. Internet or other similar network activity

Example: Browsing history, search history, online behaviour, interest data, and interactions with our and other websites, applications, systems, and advertisements

Collected: YES

F. Geolocation data

Example: Device location

Collected: YES

G. Audio, electronic, visual, thermal, olfactory, or similar information

Example: Images and audio, video or call recordings created in connection with our business activities

Collected: NO

H. Professional or employment-related information

Example: Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us

Collected: YES

I. Education Information

Example: Student records and directory information

Collected: NO

J. Inferences drawn from collected personal information

Example: Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics

Collected information: NO

K. Sensitive personal information

Collected: NO

L. Personal information as defined in the California Customer Records statute

Example: Name, contact information, education, employment, employment history, and financial information

Collected: YES

We will use and retain the collected personal information as needed to provide the Services or for:

A. Identifiers - As long as the user has consented to their personal data being processed by us
F. Geolocation data - As long as the user has consented to their personal information being processed by us

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

Receiving help through our customer support channels;
Participation in customer surveys or contests; and
Facilitation in the delivery of our Services and to respond to your inquiries.

How do we use and share your personal information?

Learn about how we use your personal information in the section, 'HOW DO WE USE YOUR INFORMATION?'

More information about our data collection and sharing practices can be found in this privacy notice.

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about who we disclose personal information to in the section, HOW DO WE USE YOUR PERSONAL INFORMATION?'

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be 'selling' of your personal information.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers.

California Residents

California Civil Code Section 1798.83, also known as the 'Shine The Light' law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have supplied personal information in connection with the Services, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided below and include the user name associated with your personal information and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g. backups, etc.).

CCPA Privacy Notice

The California Code of Regulations defines a 'resident' as:

(1) every individual who is in the State of California for other than a temporary or transitory purpose and

(2) every individual who is domiciled in the State of California who is outside of the State of California for a temporary or transitory purpose

All other individuals are defined as 'non-residents'.

If this definition of 'resident' applies to you, we must adhere to certain rights and obligations regarding your personal information.

Your rights with respect to your personal data

Right to request deletion of the data — Request to delete.

You can ask for the deletion of your personal information. If you ask us to delete your personal information, we will respect your request and delete your personal information, subject to certain exceptions provided by law, such as (but not limited to) the exercise by another consumer of his or her right to free speech, our compliance requirements resulting from a legal obligation, or any processing that may be required to protect against illegal activities.

Right to be informed — Request to know.

Depending on the circumstances, you have a right to know:

whether we collect and use your personal information;
the categories of personal information that we collect;
the purposes for which the collected personal information is used;
whether we sell or share personal information to third parties;
the categories of personal information that we sold, shared, or disclosed for a business purpose;
the categories of third parties to whom the personal information was sold, shared, or disclosed for a business purpose;
the business or commercial purpose for collecting, selling, or sharing personal information; and
the specific pieces of personal information we collected about you.

In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified in response to a consumer request or to re-identify individual data to verify a consumer request.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights.

We will not discriminate against you if you exercise your privacy rights.

Right to Limit Use and Disclosure of Sensitive Personal Information

We do not process consumer's sensitive personal information.

Verification process

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with information you have previously provided us. For instance, depending on the type of request you submit, we may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g. phone or email) that you have previously provided to us. We may also use other verification methods as the circumstances dictate.

We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes. We will delete such additionally provided information as soon as we finish verifying you.

Other privacy rights:

You may object to the processing of your personal information.

You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the information.
You can designate an authorised agent to make a request under the CCPA on your behalf. We may deny a request from an authorised agent that does not submit proof that they have been validly authorised to act on your behalf in accordance with the CCPA.
You may request to opt out from future selling or sharing of your personal information to third parties. Upon receiving an opt-out request, we will act upon the request as soon as feasibly possible, but no later than fifteen (15) days from the date of the request submission.

To exercise these rights, you can contact us by email at hello@brilliantandbloom.com, or by referring to the contact details at the bottom of this document. If you have a complaint about how we handle your data, we would like to hear from you.

Virginia Residents

Under the Virginia Consumer Data Protection Act (VCDPA):

'Consumer' means a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.

'Personal data' means any information that is linked or reasonably linkable to an identified or identifiable natural person. 'Personal data' does not include de-identified data or publicly available information.

'Sale of personal data' means the exchange of personal data for monetary consideration.

If this definition 'consumer' applies to you, we must adhere to certain rights and obligations regarding your personal data. Your rights with respect to your personal data:

Right to be informed whether or not we are processing your personal data:

Right to access your personal data
Right to correct inaccuracies in your personal data
Right to request deletion of your personal data
Right to obtain a copy of the personal data you previously shared with us
Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ('profiling')

Exercise your rights provided under the Virginia VCDPA

You may contact us by email at hello@brilliantandbloom.com

If you are using an authorised agent to exercise your rights, we may deny a request if the authorised agent does not submit proof that they have been validly authorised to act on your behalf.

Verification process

We may request that you provide additional information reasonably necessary to verify you and your consumer's request. If you submit the request through an authorised agent, we may need to collect additional information to verify your identity before processing your request.

Upon receiving your request, we will respond without undue delay, but in all cases, within forty-five (45) days of receipt. The response period may be extended once by forty-five (45) additional days when reasonably necessary. We will inform you of any such extension within the initial 45-day response period, together with the reason for the extension.

Right to appeal

If we decline to take action regarding your request, we will inform you of our decision and reasoning behind it. If you wish to appeal our decision, please email us at hello@brilliantandbloom.com. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may contact the Attorney General to submit a complaint.

Colorado Residents

This section applies only to Colorado residents. Under the Colorado Privacy Act (CPA), you have the rights listed below. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

Right to be informed whether or not we are processing your personal data

Right to access your personal data
Right to correct inaccuracies in your persona data
Right to request deletion of your personal data
Right to obtain a copy of the personal data you previously shared with us
Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that product legal or similarly significant effects ('profiling')

To submit a request to exercise these rights described above, please email at hello@brilliantandbloom.com If we decline to take action regarding your request and you wish to appeal our decision, please email us at hello@brilliantandbloom.com

Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

Connecticut Residents

This section applies to Connecticut residents. Under the Connecticut Data Privacy Act (CTDPA), you have the rights listed below. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law:

Right to be informed whether or not we are processing your personal data
Right to access your personal data
Right to correct inaccuracies in your personal data
Right to request deletion of your personal data
Right to obtain a copy of the personal data you previously shared with us
Right to opt out of the processing of your personal data if it is used from targeted advertising, the sale of personal data, or profiling in furtherance of decisions that product legal or similarly significant effects ('profiling')

To submit a request to exercise these rights described above, please email at hello@brilliantandbloom.com

If we decline to take action regarding your request and you wish to appeal our decision, please email us at hello@brilliantandbloom.com

Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

Residents of other U.S. states

If you are a resident of another state with a similar comprehensive consumer privacy law that applies to us, we shall provide you with the applicable rights that are similar to those set forth above.

To submit a request to exercise these rights, please email hello@brilliantandbloom.com

12. Cookies

Information about of use of cookies:
“Cookies” are pieces of information that may be placed on your computer by a website for the purpose of collecting data to facilitate and enhance your communication and interaction with that website. Cookies contain information that is transferred to your computer’s hard drive. For more details on cookies and similar technologies please visit All About Cookies.

Our Websites use cookies to distinguish you from other users of our Websites. This helps us to provide you with a good experience when you browse our Websites and also allows us to improve our Websites. By continuing to browse any of our Websites, you are agreeing to our use of cookies. We use the following cookies:

Strictly necessary cookies.
These are cookies that are required for the operation of our Website.
Analytical/performance cookies.

They allow us to recognise and count the number of visitors and to see how visitors move around our Website when they are using it. This helps us to improve the way our Website works, for example, by ensuring that users are finding what they are looking for easily. These cookies generally do not collect information that identifies a user.

You can find more information about the individual cookies we use and the purposes for which we use them in the list below:

Google Analytics, Used to distinguish users More Information

From time to time we may also use functionality cookies. These are used to recognise you when you return to our Websites. This enables us to personalise our content for you and remember your preferences (for example, your choice of language or region).

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our Website.

13. Changes to this Privacy Policy

We may make changes to this Privacy Policy from time to time. We encourage you to review this Privacy Policy periodically to be informed of how we use your personal information.

Brilliant & Bloom Limited Group Recruitment Privacy Notice.

1. Who will hold your data?

If you are applying to work for any company within Brilliant & Bloom Limited (“we”, “us”, “our”) we will be required to collect and process your personal data.

2. What will we hold and why?

When you make an application to work for us, we may collect the following information:

contact information including name, address, email addresses and phone number;
qualifications details e.g. skills, experience and employment history;
current salary and benefits information;
information about any disabilities which we need to make reasonable adjustments during the recruitment process; and/or
information confirming your right to work in the relevant country of your employment.

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process as this allows us to manage the recruitment process and assess and confirm a candidate’s suitability for a role. We may also need to process data from job applicants to respond to and defend against legal claims.

In some cases, we need to process data to ensure that we are complying with our legal obligations such as checking a successful applicant’s eligibility to work in the relevant country before your employment starts.

3. Sensitive and special categories of data

If your application to work for us is successful, we may also need to obtain and process special categories of information such as ethnic origin, sexual orientation or religion/belief so that we can monitor recruitment statistics. We may also collect information regarding disabilities to make reasonable adjustments for candidates who require it. We process this information to carry out our obligations and exercise specific rights in relation to employment. This information will only be collected with your further consent.

Depending on the role, we may also need to obtain information concerning past criminal convictions or carry out financial checks to comply with contractual obligations to clients or regulatory requirements as an employer.

4. What if I am not successful?

If your application is unsuccessful, we may keep your personal data on file in case there are future employment opportunities for which you may be suited. The organisation will ask for your consent before it keeps your data for this purpose and you are free to withdraw your consent at any time.

5. Where do you collect the data from?

We may collect your data from the following sources:

your CV;
recruitment agents you are using;
identity documents you provide to us;
interviews with you; and/or
once you have been offered and accepted a role we may, with your consent, collect data from:
referees/previous employers
background checker providers/criminal records checks (if applicable).

6. Who will see the data?

Your information may be shared internally for the purposes of the recruitment process. This includes members of the People team, interviewers, managers in the relevant business area and IT staff if access to the data is necessary for the performance of their roles. We may transfer your personal data outside the EEA to members of Brilliant & Bloom Limited where this is necessary for the recruitment process. We will ensure that the transfer is lawful and that there are appropriate security arrangements in place.

We will not share your data with third parties, unless your application is successful and you are offered employment. We will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records checks.

7. How will the data be stored and for how long?

Data will be stored in a range of different places, including our IT systems (including email) which includes the holding of emails on servers which may be outside the EEA.

If your application is unsuccessful, we will hold your data on file for 3 months after the end of the relevant recruitment process. If you agree to allow the organisation to keep your personal data on file, the organisations will hold your data on file for a further 12 months for consideration for future employment opportunities. At the end of that period or once you withdraw your consent, your data will be deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment in accordance with our internal retention policy, of which you will be notified.

8. What if I don’t provide personal data?

You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.

9. Access to your personal data and other rights.

As a data subject, you have a number of rights. You can:

access and obtain a copy of your data on request;
require the organisation to change incorrect or incomplete data;
require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing.

If you would like to exercise any of these rights, please use the contact details below. If you believe that Brilliant & Bloom Limited has not complied with your data protection rights, you have the right to complain to your local regulator responsible for data protection and privacy matters.

10. How to contact us

In processing your personal data for the purposes of recruitment, we act as a data controller.

If you have any questions or want to exercise any of your legal rights, please contact us by sending an e-mail to hello@brilliantandbloom.com.

Last updated: November 2024.