Privacy Policy

Business Technologies NI Ltd (“BTNI”, “we”, “us”) of Suite 111, Lisburn Enterprise Organisation, Lisburn BT28 2BP, Northern Ireland is the data controller for personal data collected through this website and the TechState Portal. This policy explains what we collect, why, how long we keep it, and the rights you have. The short version: we collect only what we need to respond to you and deliver our services, we never sell personal data, and we don’t use it for third-party advertising.

What we collect and why

Booking a Business Technology Review. When you book a review we ask for your name, business name, email, phone number, team size, industry and anything you tell us about what’s prompting the review. If you choose to attach a TechState™ self-assessment result, that comes too. We use these details to respond to your enquiry and arrange the review — nothing else. Enquiries are stored securely in our systems so they can’t be lost, and are emailed to our team.

The Business Technology Buyer’s Guide. When you request the guide we ask for your name and email so we can send it to you. As with a review enquiry, we store your request securely and notify our team so we can help if you have questions. We won’t add you to a marketing list without your permission.

Discover Your TechState™ Index. If you ask for an emailed copy of your Index result, we use the name and email you provide to send it, and we keep a record of the result and the address it was sent to so we can answer any follow-up questions.

The complimentary external security assessment. If you request our complimentary email-domain and external security assessment, we collect the websites, domains and public IP addresses you ask us to assess, together with your name, business name, email address, any phone number you provide and any additional information included with your request. We use this information to carry out the assessment, contact you if we need clarification and send you the results. This offer is available only to organisations that are not already BTNI customers.

Security testing must only be carried out with proper authorisation, so we keep a record of the authorisation you provide — including the wording you agreed to, the systems you submitted, and the date, time, IP address and browser information associated with the submission. Our lawful basis for this is our legitimate interests in responding to your request, delivering the assessment, ensuring that we test only systems we are authorised to assess, and maintaining evidence that the testing was properly authorised. We will assess only the systems you identify and confirm that you are entitled to authorise.

We retain complimentary security-assessment requests and results for 12 months after the results are delivered, and the associated authorisation record for six years after the testing is completed, so that we can demonstrate that the assessment was properly requested and authorised. We may retain information for longer where reasonably necessary to establish, exercise or defend legal claims, comply with a legal obligation, or investigate suspected misuse.

The TechState Portal. If your organisation is a BTNI customer, we process your account details (name, work email, sign-in identifiers), the support requests you raise, documents shared with your organisation, and an audit trail of account activity. This is how we deliver the service your organisation has contracted for.

Technical and security data. Like most websites, our systems record technical information such as IP addresses in server logs and use it for security — for example, protecting our forms against abuse. We use essential cookies only; see our Cookie Policy for details.

Our lawful bases

• Responding to enquiries and arranging reviews — legitimate interests, and taking steps you’ve requested before entering a contract.
• Delivering the portal and our services — performance of a contract with your organisation.
• Running an external security assessment you request, and keeping the record of your authorisation — our legitimate interests in responding to your request, delivering the assessment, testing only systems we are authorised to assess, and keeping evidence that the testing was properly authorised.
• Security, logging and abuse prevention — legitimate interests in keeping our systems and your data safe.
• Anything based on consent (such as optional marketing, if you ever opt in) — consent, which you can withdraw at any time.

Who we share it with

We never sell personal data. We share it only with the service providers that run our systems — hosting and database providers, our email delivery provider, and Microsoft (which handles sign-in to the TechState Portal via Microsoft Entra ID) — each acting under contract on our instructions, and with professional advisers or authorities where the law requires.

Where it lives and how long we keep it

We choose providers that store data in the UK or European Economic Area wherever possible; where data is transferred outside the UK, we make sure appropriate safeguards recognised under UK data protection law are in place. As a general rule we keep website enquiry information for two years after our last meaningful contact with you, and portal data for the duration of your organisation’s agreement with us plus any period we must keep it by law. Some services set their own retention periods, which we state alongside them — for example, the complimentary external security assessment above. We review stored data periodically and delete or anonymise what we no longer need.

Your rights

Under UK GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, restrict or object to how we use it, or ask for it in a portable format. Just contact us using the details below — we’ll respond within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Security

We protect personal data with the same layered approach we bring to our clients — encrypted connections, access controls, audit logging and regular backups. No system is perfectly secure, but if a breach ever put your rights at risk, we would tell you and the ICO as the law requires.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last reviewed.

Contact us

Questions about your data? Contact Business Technologies NI Ltd, Suite 111, Lisburn Enterprise Organisation, Lisburn BT28 2BP — call 028 9244 3424 or email [email protected].