Privacy Policy

Business Technologies NI Ltd (“BTNI”, “we”, “us”) of Suite 111, Lisburn Enterprise Organisation, Lisburn BT28 2BP, Northern Ireland is the data controller for personal data collected through this website and the TechState Portal. This policy explains what we collect, why, how long we keep it, and the rights you have. The short version: we collect only what we need to respond to you and deliver our services, we never sell personal data, and we don’t use it for third-party advertising.

What we collect and why

Booking a Business Technology Review. When you book a review we ask for your name, business name, email, phone number, team size, industry and anything you tell us about what’s prompting the review. If you choose to attach a TechState™ self-assessment result, that comes too. We use these details to respond to your enquiry and arrange the review — nothing else. Enquiries are stored securely in our systems so they can’t be lost, and are emailed to our team.

The Business Technology Buyer’s Guide. When you request the guide we ask for your name and email so we can send it to you. As with a review enquiry, we store your request securely and notify our team so we can help if you have questions. We won’t add you to a marketing list without your permission.

Discover Your TechState™ Index. If you ask for an emailed copy of your Index result, we use the name and email you provide to send it, and we keep a record of the result and the address it was sent to so we can answer any follow-up questions.

The complimentary external security assessment. If you request our complimentary email-domain and external security assessment, we collect the websites, domains and public IP addresses you ask us to assess, together with your name, business name, email address, any phone number you provide and any additional information included with your request. We use this information to carry out the assessment, contact you if we need clarification and send you the results. This offer is available only to organisations that are not already BTNI customers.

Security testing must only be carried out with proper authorisation, so we keep a record of the authorisation you provide — including the wording you agreed to, the systems you submitted, and the date, time, IP address and browser information associated with the submission. Our lawful basis for this is our legitimate interests in responding to your request, delivering the assessment, ensuring that we test only systems we are authorised to assess, and maintaining evidence that the testing was properly authorised. We will assess only the systems you identify and confirm that you are entitled to authorise.

We retain complimentary security-assessment requests and results for 12 months after the results are delivered, and the associated authorisation record for six years after the testing is completed, so that we can demonstrate that the assessment was properly requested and authorised. We may retain information for longer where reasonably necessary to establish, exercise or defend legal claims, comply with a legal obligation, or investigate suspected misuse.

The TechState Portal. If your organisation is a BTNI customer, we process your account details (name, work email, sign-in identifiers), the support requests you raise, documents shared with your organisation, and an audit trail of account activity. This is how we deliver the service your organisation has contracted for.

Technical and security data. Like most websites, our systems record technical information such as IP addresses in server logs and use it for security — for example, protecting our forms against abuse. We use essential cookies and one first-party visit-statistics cookie you can switch off; see our Cookie Policy for details.

Visit statistics. We count visits to this website ourselves, on our own systems, to understand which pages are useful and how people find us. For each page we record the page, the website you came from and any campaign tags in our own links, your device and browser type (not their full details), your screen size and your country — which our network provider works out from your connection. We never store your IP address for this. If you allow it, a first-party cookie lets us recognise a returning browser and group the pages of one visit together; you can switch it off at any time on our Cookie Policy page, and we honour your browser’s Global Privacy Control signal automatically. We use these statistics only in aggregate, to improve our website — never to identify you, never for advertising, and never shared with anyone. When you make an enquiry we note where your first visit came from alongside it. We keep individual visit records for up to 13 months, then daily totals only.

Search engines and AI services. We also record requests from search engines and AI services that read our website, by the name they give (for example Googlebot or GPTBot). This involves no personal data.

Our lawful bases

• Responding to enquiries and arranging reviews — legitimate interests, and taking steps you’ve requested before entering a contract.
• Delivering the portal and our services — performance of a contract with your organisation.
• Running an external security assessment you request, and keeping the record of your authorisation — our legitimate interests in responding to your request, delivering the assessment, testing only systems we are authorised to assess, and keeping evidence that the testing was properly authorised.
• Security, logging and abuse prevention — legitimate interests in keeping our systems and your data safe.
• Visit statistics — our legitimate interests in understanding and improving our own website. The statistics cookie is used under the statistics exception in the Privacy and Electronic Communications Regulations, with a free opt-out at any time.
• Anything based on consent (such as optional marketing, if you ever opt in) — consent, which you can withdraw at any time.

Who we share it with

We never sell personal data. We share it only with the service providers that run our systems — hosting and database providers, our email delivery provider, and Microsoft (which handles sign-in to the TechState Portal via Microsoft Entra ID) — each acting under contract on our instructions, and with professional advisers or authorities where the law requires.

Where it lives and how long we keep it

We choose providers that store data in the UK or European Economic Area wherever possible; where data is transferred outside the UK, we make sure appropriate safeguards recognised under UK data protection law are in place. As a general rule we keep website enquiry information for two years after our last meaningful contact with you, and portal data for the duration of your organisation’s agreement with us plus any period we must keep it by law. Some services set their own retention periods, which we state alongside them — for example, the complimentary external security assessment above. We review stored data periodically and delete or anonymise what we no longer need.

Your rights

Under UK GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, restrict or object to how we use it, or ask for it in a portable format. Just contact us using the details below — we’ll respond within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Security

We protect personal data with the same layered approach we bring to our clients — encrypted connections, access controls, audit logging and regular backups. No system is perfectly secure, but if a breach ever put your rights at risk, we would tell you and the ICO as the law requires.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last reviewed.

Contact us

Questions about your data? Contact Business Technologies NI Ltd, Suite 111, Lisburn Enterprise Organisation, Lisburn BT28 2BP — call 028 9244 3424 or email [email protected].