Privacy Policy

Last updated: 29 October 2026

1. About this notice

The Beacon Group (trading as “Beacon”) is committed to protecting and respecting your privacy. This notice explains how we collect, use and otherwise process personal data about you, and what rights you have. It applies when:

• you visit our website at beacon.com (the “Website”);
• you use our supply chain platform at app.beacon.com, our computer or mobile applications (the “Apps”), or any of our services, including our supply chain visibility and supply chain finance services (together, the “Platform” and “Services”);
• you contact us, including by email, telephone, live chat or our social media pages;
• we carry out sales and marketing activities, including at events;
• you apply for a job with us;
• you otherwise deal with us for business purposes (for example, if you work for one of our suppliers or partners); and
• users of our Platform share your personal data with us.

“Beacon”, “we”, “us” and “our” means The Beacon Group, which includes Beacon Technologies Limited (incorporated in England and Wales with company number 11664346) and Beacon Capital Solutions Limited (incorporated in England and Wales with company number 13384299), and any other companies in The Beacon Group from time to time.

Who is responsible for your data

Beacon Technologies Limited is the controller of personal data processed through the Website, our sales and marketing, recruitment and supplier activities, and our relationship with Platform customers and users. Where we provide supply chain finance, Beacon Capital Solutions Limited is also a controller of the personal data it processes for that purpose. [Confirm which Beacon company is the controller for each activity.]

When our customers upload or manage personal data inside the Platform (for example, contact details of their own suppliers or colleagues), we usually process that data on our customer’s behalf as a processor, under our data processing addendum. In that case our customer is the controller, and their own privacy notice applies. [Confirm this processor position for Platform data.]

In this notice, “personal data”, “processing”, “controller” and “processor” have the meanings given to them in the UK General Data Protection Regulation (UK GDPR). We also follow the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Where we process personal data of people in the European Union, the EU GDPR may also apply.

2. What personal data we collect

2.1 Information you give us

The personal data we collect depends on how you deal with us. It may include:

• Customers and Platform users: your first and last name, work email address, postal address, telephone number, job title, company, log-in details, and information about our dealings with you and the transactions you carry out using the Platform and Services.
• Supply chain finance customers: names, addresses, dates of birth and identification documents (including passports) of directors and other key individuals, so we can carry out anti-money laundering, sanctions, credit and other relevant checks.
• Job applicants: your name, email address, postal address, telephone number, identification details, job title, employment history and education, the names and contact details of referees, next of kin details, salary information, National Insurance number and any other information required by law.
• Suppliers and other business contacts: your name, work email address, postal address, telephone number, job title and information about our dealings with you.
• Forms and enquiries: information you give when you fill in forms on the Website or Platform, for example to request a demo, download a guide, sign up for our newsletter, use one of our calculators, request information, or enter a competition or promotion.
• Communications: the content of emails, live chat conversations and other messages you send us, for example when you report a problem or ask a question.
• Calls and meetings: recordings, and where used, transcripts, of telephone and video calls that we record. We will tell you at the start of a call if it is being recorded.
• Social media: information in messages you post on or send to our social media pages.
• Feedback: your answers to surveys, ratings and feedback requests that we run from time to time, if you choose to take part.

If you choose not to give us information we ask for, you may not be able to use all of the Platform’s features, and we may not be able to provide our Services to you.

2.2 Information we get from other sources

We also collect personal data about business contacts from other sources. This mainly covers people who work in supply chain, logistics, procurement, finance and related roles at organisations that may be interested in Beacon. The categories of data and their sources are:

[Confirm the list of sources and providers above matches what Beacon actually uses.]

2.3 Information we collect automatically

When you use the Website or Platform, we collect information about your device and how you use them, such as your IP address, approximate location, browser and device type, referral source, pages viewed, links clicked and how long you spend on the site. Some of this is collected through cookies and similar technologies, which we only use where you have consented, unless they are strictly necessary. See section 5 and our cookie policy for more detail.

3. How we use personal data and our legal bases

Data protection law requires us to have a legal basis for each way we use your personal data. We rely on the following:

Contract

Where we need to use your data to enter into or perform a contract with you, or to take steps you ask for before entering into a contract, we use it to:

• provide the Platform and Services you or your organisation have signed up for, including setting up and managing your account;
• respond to your queries and provide information, products or services you request from us;
• process payments and manage billing; and
• provide supply chain finance under the agreements we have with you or your organisation.

Where the contract is with your employer rather than with you, we rely on our legitimate interests in performing that contract.

Legitimate interests

Where it is necessary for our legitimate interests (or those of a third party), and those interests are not overridden by your rights and interests, we use your data to:

• send business-to-business marketing about our products and services to people at organisations that may benefit from them (see section 4);
• understand our market and identify organisations and roles that may be interested in Beacon, including using the third-party sources in section 2.2;
• provide information to you at the request of users of our Platform and Services;
• check the creditworthiness of potential supply chain finance customers;
• notify you about changes to the Website, Platform and Services;
• keep the Website, Platform and Services safe and secure, and prevent misuse;
• manage recruitment and assess candidates;
• improve our Services, including by reviewing recorded calls and customer feedback;
• keep records of facts relevant to our business, and train our staff, including through recorded calls; and
• protect our business and enforce our legal rights.

You can ask us for more information about how we have balanced our interests against yours. You have the right to object to processing based on legitimate interests (see section 13).

Consent

We ask for your consent to:

• set non-essential cookies and similar technologies on the Website, including for analytics, session recording, A/B testing and advertising (see section 5);
• send marketing emails or texts where PECR requires consent, for example to people using personal email addresses who are not existing customers; and
• any other purpose where we tell you we are relying on consent when we collect your data.

You can withdraw your consent at any time. This does not affect anything we did with your consent before you withdrew it.

Legal obligation

Where we must use your data to comply with the law, we use it to:

• carry out checks and submit reports to relevant authorities as required by law;
• comply with our anti-money laundering and counter-terrorist financing obligations;
• take measures to detect and prevent fraud where the law requires this; and
• keep financial, tax and employment records.

4. Marketing

We market our Services to businesses. We may contact people at organisations that we reasonably believe would be interested in Beacon, using business contact details, by email, telephone, LinkedIn or post. We rely on our legitimate interests to do this, and we follow PECR as follows:

• Corporate email addresses: we may send marketing emails to individuals at companies and other corporate bodies (for example, name@company.com) without prior consent, but we will always identify ourselves and give you a simple way to opt out in every message.
• Soft opt-in: if you are an individual or sole trader who has bought from us or negotiated to buy our Services, we may email you about similar Services. You will be given the chance to opt out when we collect your details and in every message.
• Other cases: where PECR requires consent, for example for individuals using personal email addresses who are not customers, we will only email you if you have consented.
• Telephone: we screen numbers against the Telephone Preference Service and Corporate Telephone Preference Service where required, and will not call you if you have asked us not to.

You have an absolute right to object to direct marketing at any time. You can do this by clicking the unsubscribe link in any marketing email, by replying to tell us, or by emailing info@beacon.com. Once you object, we will stop sending you marketing. We will keep a minimal record of your details on a suppression list, so that we can make sure we do not contact you again.

5. Website analytics, optimisation and advertising

We use a number of tools to understand how the Website is used, improve it, support visitors and measure our marketing. Apart from strictly necessary cookies, these tools are only used if you consent through our cookie banner, which is run by Cookiebot by Usercentrics. The tools include:

• Analytics: Google Analytics and Google Tag Manager, to measure visits and how people use the Website.
• Session recording and heatmaps: Hotjar, which records how visitors move, click and scroll on our pages and creates heatmaps. We use this to find and fix problems with our pages. [Confirm that Hotjar is set to mask keystrokes and form fields.]
• A/B testing: VWO (Visual Website Optimizer), which shows different versions of a page to different visitors so we can see which works better.
• Customer data platforms: Segment and RudderStack, which collect and organise Website activity data and send it to our other tools.
• Live chat: Intercom, which runs the chat and help widget on our Website. Conversations you have with us through Intercom are stored so we can respond and follow up.
• CRM and forms: HubSpot, which runs many of our forms and stores the information you submit, and tracks how known contacts interact with our Website and emails.
• Advertising and retargeting: Google Ads, LinkedIn (Insight Tag), Microsoft Advertising and Meta (Meta Pixel), which measure how well our adverts work and let us show Beacon adverts to people who have visited our Website, or to similar audiences, on other websites and platforms.
• B2B intent and profiling: 6sense, which identifies the organisation a visitor is likely to work for (for example from their IP address) and combines this with intent data to suggest which organisations are interested in our Services.

Profiling

Some of these tools involve profiling. This means we, and our providers, analyse Website activity, email engagement, company information and intent data to build a picture of which organisations and contacts are likely to be interested in Beacon, and how interested they might be. We use this to decide who our sales team contacts, which content and adverts to show, and how to prioritise follow-up. We rely on your consent for the cookies and similar technologies that collect this data, and on our legitimate interests for the analysis we do with it afterwards.

You can object to this profiling at any time, and if you do, we will stop it for marketing purposes. We do not make any decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you. [Confirm this also holds for credit decisions in supply chain finance.]

6. AI tools and service providers

We use carefully selected service providers, including some that use artificial intelligence, to process personal data on our behalf. For example, we may use tools that record and transcribe calls and meetings, summarise conversations, help draft emails, and enrich and research business contact data. These providers act on our instructions under contracts that protect your data, and are not allowed to use it for their own purposes. [Confirm the AI tools and providers Beacon uses, and that their contracts prevent them using Beacon data to train their models.]

7. How we share personal data

We may share personal data with third parties, including:

• suppliers who provide services that you request through Beacon, such as shipping companies, or others you ask us to share your data with [add any other partner types, for example carbon credit providers, if still relevant];
• service providers who help us run our business, such as hosting, IT, CRM, analytics, communication and payment providers, including other companies in The Beacon Group. Our main providers are listed in our sub-processor list;
• advertising and analytics partners, as described in section 5, where you have consented to the relevant cookies;
• where you are a supply chain finance customer, our third-party debt providers, including Beacon Financial Holdings Limited;
• our professional advisers, including lawyers, accountants, tax advisers and auditors;
• insurance brokers and providers, and credit reference or credit assessment agencies;
• law enforcement bodies, agencies and courts, or others where required or authorised by law or regulation;
• anyone we must disclose information to in connection with litigation, arbitration, administrative or other investigations or proceedings; and
• regulatory or government bodies, to resolve complaints or disputes or to comply with an investigation.

Where we provide supply chain finance, we may also share personal data with:

• other parties involved in the financing arrangements, including any actual or potential assignee of rights or obligations under the facility agreement or loan, and any participant or sub-participant in a transaction under which payments are or may be made by reference to a facility agreement;
• third parties who carry out our checks, including know-your-client, credit, anti-money laundering, counter-terrorist financing and sanctions checks;
• our open banking and open accounting partners, whose services we use as part of our credit checks; and
• investors and potential investors, and anyone else, to help arrange funding for the facility or loan.

We may also share personal data:

• if we sell any business or assets, with the prospective buyer and their advisers;
• if we, or substantially all of our assets, are acquired by a third party, in which case personal data we hold will be one of the transferred assets;
• if we restructure our business or integrate it with another group of companies, with the new owner, who will use it in the same ways set out in this notice;
• if we seek investment, with investors, potential investors and their advisers; and
• if we have to, to comply with a legal or regulatory obligation, to enforce our terms, or to protect the rights, property or safety of Beacon, our customers or others. This includes exchanging information with other organisations for fraud protection and credit risk reduction.

Before we share personal data, we take steps to make sure the recipient will protect it in line with data protection law and this notice, and only use it for the purpose we shared it for. We do not sell your personal data.

8. External links

The Website and Platform may link to websites run by our partners, distributors, advertisers and other organisations. These websites have their own privacy notices, and we are not responsible for them. Please check their notices before you give them any personal data.

9. Social media

When you interact with us on social media platforms such as LinkedIn, X (formerly Twitter), YouTube or Facebook, the platform’s own terms and privacy notice also apply.

10. International transfers

Some of our service providers, and some Beacon staff, are based outside the UK, so your personal data may be transferred to, stored in or accessed from other countries, including the United States [and add any other main countries, for example where Beacon has staff or support teams]. When we transfer personal data outside the UK, we make sure it is protected by one of the following safeguards:

• Adequacy regulations: the country has been recognised by the UK government as providing an adequate level of protection, such as countries in the European Economic Area;
• UK–US Data Bridge: for transfers to US organisations certified under the UK Extension to the EU–US Data Privacy Framework;
• International data transfer agreement (IDTA) approved by the Information Commissioner; or
• UK Addendum to the EU Standard Contractual Clauses, used together with the European Commission’s standard contractual clauses.

Where we rely on the IDTA or the UK Addendum, we also assess whether extra measures are needed. For EU visitors, we use the equivalent EU safeguards, such as adequacy decisions, the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. Contact us if you would like more information or a copy of the relevant safeguards.

11. How we protect personal data

We use appropriate technical and organisational measures to protect personal data, including encryption in transit using industry-standard technology such as TLS, access controls, and secure servers. Any payment transactions carried out by us or our payment provider are encrypted. However, no transmission over the internet is completely secure, so we cannot guarantee the security of data sent to us. You can read more on our data security page.

Where we have given you, or you have chosen, a password for the Platform, you are responsible for keeping it confidential. Please do not share your password with anyone.

12. How long we keep personal data

We keep personal data only for as long as we need it for the purposes in this notice, including to meet legal, accounting and reporting requirements. When we no longer need it, we securely delete or anonymise it. Our usual retention periods are:

13. Your rights

You have the following rights over your personal data. Some only apply in certain circumstances.

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct personal data that is inaccurate or incomplete.
• Erasure: ask us to delete your personal data.
• Restriction: ask us to limit how we use your personal data.
• Data portability: ask us to give you personal data you have provided to us in a structured, commonly used, machine-readable format, or send it to another organisation.
• Objection: object to our use of your personal data where we rely on legitimate interests, including profiling. You can object to direct marketing, and profiling for direct marketing, at any time, and we will always stop.
• Withdraw consent: where we rely on your consent, withdraw it at any time, for example by unsubscribing from emails or changing your cookie settings.
• Automated decision-making: rights relating to decisions based solely on automated processing. As explained in section 5, we do not make such decisions.

To use any of these rights, email us at info@beacon.com or write to us at the address in section 17. You do not normally have to pay a fee. We may need to check your identity before we act on your request. We will respond within one month, although we may extend this by up to two further months for complex requests, in which case we will tell you why. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it.

We also want to make sure the personal data we hold about you is accurate and up to date, so please tell us if anything changes.

14. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can try to put things right. You can complain by emailing info@beacon.com with “Data protection complaint” in the subject line, [or by using our online complaint form at [form URL]]. We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome without undue delay.

If you are still not satisfied, you have the right to complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk/concerns/. If you live in the European Union, you can also contact your local data protection authority.

15. Cookies

We use cookies and similar technologies on the Website. Non-essential cookies are only used if you consent. Our cookie policy explains which cookies we use and why, and how long they last. You can change your cookie choices at any time: Change your consent.

16. Changes to this notice

We review and update this notice from time to time. We will post any changes on this page and update the “last updated” date at the top. If we make significant changes, we will tell you by email or through the Website or Platform where appropriate. Please check this page from time to time.

17. Contact us

If you have any questions about this notice or how we handle your personal data, please contact us:

• Email:info@beacon.com
• Post: The Beacon Group, Beacon Technologies Limited, 42 Berkeley Square, London W1J 5AW, United Kingdom
• [Data protection lead or DPO: add a name or role, if Beacon has one]
• [EU representative: if Beacon has appointed a representative in the EU under Article 27 of the EU GDPR, add their name and contact details here; otherwise delete this line.]