Legal
Privacy policy
How Bexus Systems handles personal information, and what you can ask for. Last updated 5 October 2026.
1. Who we are
This website is operated by Josh Guinney trading as Bexus Systems, a software and systems business based in Nailsea, near Bristol, United Kingdom. For the purposes of UK data protection law we are the data controller for personal information collected through this site.
Carl Guinney handles personal information and privacy enquiries for Bexus Systems. You can contact him about anything on this page at carl@bexus.co.uk.
2. What we collect
We keep this deliberately small. We collect:
- Enquiry details. When you email us, or complete the enquiry form at /start: your name, email address, and the optional details you choose to give — phone number, business name, and your answers about your business, what you would like help with, timing and budget. We use them to reply to your enquiry and to discuss possible work, and for nothing else. There are no required questions beyond your name, your email address and a short description of your business.
- Correspondence. Emails and messages exchanged with you, kept so we have a record of what was discussed and agreed.
- Technical logs. Our hosting provider records standard server logs, which may include IP address, browser type, pages requested and timestamps. These are used for security and diagnosing faults.
We do not collect special category data through this website, and we do not ask for payment card details here.
3. Cookies and analytics
This site does not set advertising or tracking cookies, and it does not use third-party analytics that profile you across sites. If that changes, this page will be updated and a cookie notice will be shown before any non-essential cookie is set.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry and discussing possible work | Legitimate interests, and steps taken at your request before entering a contract |
| Delivering and supporting work you have engaged us for | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Keeping the site secure and diagnosing faults | Legitimate interests |
We do not send marketing emails, and we will not add you to a mailing list because you made an enquiry.
5. How long we keep it
- Enquiries that do not lead to work: up to 12 months, then deleted.
- Enquiry form submissions: normally the email is the only copy — the form does not keep a database of what you sent. If the email cannot be sent at that moment, your answers are held on our server so the enquiry is not lost, and are deleted once they have reached us.
- Client records and correspondence: for the duration of the engagement and for 6 years afterwards, which reflects UK accounting and limitation requirements.
- Server logs: typically 30 days, as set by our hosting provider.
6. Who we share it with
We do not sell personal information, and we do not share it for anyone else's marketing. We do use a small number of service providers who process data on our behalf, under contract:
- Website and application hosting providers
- Email and file storage providers
- Accounting software, where an engagement leads to invoicing
The enquiry form is not handled by a third-party form service. It is received by our own server and sent straight to us by email, so the only provider involved is the email provider named above.
We may also disclose information where we are legally required to do so. Where a provider processes data outside the UK, we rely on UK adequacy regulations or standard contractual clauses with the UK addendum.
7. Client data in systems we build
Where we build or host software for a client, that client is normally the data controller for the personal data held in it, and we act as their data processor. That relationship is governed by the written agreement between us, not by this policy.
If you are a customer or employee of one of our clients and want to exercise your rights over data held in their system, please contact that business directly. We will support them in responding.
8. Security
Data is transmitted over HTTPS. Access to systems is limited to those who need it and protected by multi-factor authentication. Backups are encrypted, and restores are tested rather than assumed. No system is perfectly secure, but we will tell you promptly and honestly if a breach affects your data, and notify the ICO where required.
9. Your rights
Under UK GDPR you have the right to:
- Ask what personal data we hold about you, and get a copy
- Have inaccurate data corrected
- Ask us to erase data, where there is no overriding reason to keep it
- Ask us to restrict how we use it, or object to processing based on legitimate interests
- Ask for your data in a portable format, where applicable
To exercise any of these, email carl@bexus.co.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or by calling their helpline on 0303 123 1113. We would appreciate the chance to put things right first.
10. Changes to this policy
If this policy changes materially we will update the date at the top of the page. This version was last updated on 5 October 2026.