Introduction

Bohr Group Limited, referred to as ‘Bohr’ here after, is committed to protecting data and respecting the privacy of persons and organisations it deals with. This privacy policy explains when and why we: 

• collect personal information about individuals;
• how we use it; 
• the conditions under which we may disclose it to others; 
• the lawful basis for processing; 
• retention periods; 
• how we keep it secure.  

This policy is primarily intended to explain how Bohr processes personal data under UK data protection law, including the UK GDPR and the Data Protection Act 2018. Where Bohr processes personal data relating to individuals in the European Economic Area in circumstances where the EU GDPR applies, Bohr will also comply with applicable EU GDPR requirements.

Bohr has assessed whether it is required to appoint an EU representative under Article 27 of the EU GDPR. Bohr is not currently required to appoint an EU representative because its processing of personal data relating to individuals in the European Economic Area is occasional, does not involve large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to individuals’ rights and freedoms. Bohr will keep this assessment under review.

Personal Data

We hold names, phone numbers, addresses and email addresses for those that we provide products and services to and for those who request information from us, through the likes of our website. We also hold accountancy information for clients that have procured our products and services and for third party suppliers that we work with. Occasionally we may need to hold the country of residence if this is required for tax purposes.  

 Your personal information will be used:  

1. To provide you with products, services and/or support as you requested. 
2. To satisfy our legal obligations, for example in relation to tax records. 
3. To answer queries or provide information about our products and services when requested by you. 
4. For accounting purposes.  

If you are a supplier or a client, we usually keep your details >5 years from the last exchange, as this allows us to provide ongoing support and information as needed.  

We only process personal data where we have a lawful basis to do so under UK GDPR and, where applicable, EU GDPR. The lawful basis depends on the purpose for which the personal data is used. Where we rely on legitimate interests, we consider and balance our business need against the rights and freedoms of the individual. Where we rely on consent, the individual may withdraw consent at any time.

Access to Personal Information

Individuals have the right to request access to personal data that Bohr holds about them. This is commonly known as a Subject Access Request. We will normally respond without undue delay and within one month of receiving the request.

Where a request is complex, or where we have received a number of requests from the same individual, we may extend the response period by up to a further two months. If an extension is needed, we will inform the individual within one month of receiving the request and explain the reason for the delay.

We will not usually charge a fee for responding to a request. However, where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on the request, in accordance with applicable data protection law.

We may need to verify the requester’s identity before responding. In some cases, we may withhold limited information where disclosure would adversely affect the rights and freedoms of others, reveal legally privileged material, or where another lawful exemption applies.

Individuals also have the right to complain to the Information Commissioner’s Office if they are unhappy with how we handle their personal data or respond to a request.

Individuals may also have the right to request correction of inaccurate personal data, erasure of personal data, restriction of processing, data portability, withdrawal of consent, and objection to processing, including objection to direct marketing. Where automated decision-making or profiling produces legal or similarly significant effects, individuals may also have rights in relation to that processing. These rights are subject to conditions and exemptions under applicable data protection law.

To submit a Subject Access Request or to correct data, please put your request in writing to our Data Protection Officer at privacy@bohr.uk or by writing to Bohr Group Limited, The Curve, Diamond Way, Stone, Staffordshire, ST15 0SD.

Data Processing

Bohr uses selected third-party service providers to support the operation of its business, website, finance, IT, security, communication and customer-management activities. These providers may process personal data on Bohr’s behalf as processors or, in some cases, as independent controllers.

Bohr only uses service providers where there is an appropriate business need and where suitable contractual, security and data protection safeguards are in place. This includes, where applicable, data processing agreements, confidentiality obligations, access controls and supplier assurance checks.

Key categories of providers may include accounting and finance platforms, cloud hosting providers, productivity and email services, website analytics providers, security tools, customer relationship management systems, and social media platforms.

Bohr maintains oversight of its suppliers and sub-processors through its supplier management and information security processes. Further details of relevant suppliers can be made available where appropriate. Our Cookie Policy, POL035 – Cookie Policy, is available on request.

International Processing

Some of the third-party services used by Bohr may process or store personal data outside the United Kingdom or European Economic Area. Where this occurs, Bohr will ensure that appropriate safeguards are in place before personal data is transferred.

These safeguards may include an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under applicable data protection law.

Bohr will also consider transfer risk where required and will take appropriate steps to protect personal data when using suppliers who process data internationally.

Registration to Access Information

Where an individual or organisation submits an enquiry, registers to access information, or asks us to contact them, we will use the contact details provided to respond to that request and provide the relevant information.

We may also use business contact details to send information about Bohr’s products, services or updates where we have a lawful basis to do so. This may be based on consent or, for existing business contacts, our legitimate interests in promoting relevant services, subject to applicable electronic marketing rules.

We will not send electronic direct marketing where consent is required unless that consent has been obtained. Where we rely on consent, consent may be withdrawn at any time. Where we rely on legitimate interests, individuals may object to receiving marketing at any time.

All marketing communications will include a clear way to unsubscribe or opt out. We will maintain suppression records where necessary to ensure that marketing preferences are respected.

Personal data collected for enquiries or marketing will not be sold to third parties.

Links to other Websites

This privacy policy does not cover the links within our website or media which redirect you to other websites. We encourage you to read the privacy statements on any other websites you visit, to satisfy yourself that those organisations comply with protecting your personal information under UK GDPR. 

Social Media

We use third party providers such as LinkedIn, YouTube, and other social media as platforms for our social media interactions. If you send us a private or direct message via social media, the message will be stored by these sites in accordance with their privacy policies. 

Employee Data

If you are recruited by Bohr, we will process your personal data to fulfil our contractual obligations to you as an employee and to comply with our legal obligations (for example under tax and employment law). We retain employee data only for as long as necessary for these purposes. In some cases, we are required by law to keep certain records for a defined period after employment ends.

Where appropriate, we may retain limited information after your employment for purposes such as providing employment references or defending legal claims, in accordance with our legitimate interests and applicable law.

Further details of specific retention periods or the criteria used to determine them are available upon request.   

Intellectual Property

We may process limited personal data in connection with the creation, management and protection of intellectual property developed during employment. This processing is carried out in accordance with our contractual obligations and legitimate interests in protecting our business assets.

Data Security

Bohr have implemented a secure data storage infrastructure, restricting access to only those that need it. Further to this, we have password protection on all of our IT systems, and we have IT security software to protect all company held data.  Where applicable, we align our security practices with recognised standards such as Cyber Essentials, SOC 2 and ISO/IEC 27001.

Changes to this Privacy Policy

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We will also notify you in other ways from time to time about the processing of your personal information. 

Signed on behalf of Bohr Group Limited,

Daniel Siviter

14 September 2026

Revision 2