This policy covers only the BullmanBrown website — enquiries submitted through its contact form, and marketing emails sent to prospects and contacts. Personal data collected once someone becomes a client, or as part of placing and servicing a policy, is covered by a separate client privacy notice, not this one.
1. Who we are
BullmanBrown is the trading name of Minotaur Broking Ltd, a company registered in England and Wales, company number 17320302, registered office 33 Wealden Close, Hildenborough, Kent, TN11 9HB. In this policy, "BullmanBrown", "we", "us" and "our" mean Minotaur Broking Ltd.
We are the data controller for the personal data described in this policy: we decide why and how it is used. You can contact us about privacy matters at privacy@bullmanbrown.com or by post at the registered office address above.
2. Information we collect
Through the contact form
- Your name, company name, email address and telephone number (where you provide them).
- Whatever you tell us in the free-text enquiry field.
- The date and time you submitted the form.
Please don't put health information, or anything else you'd consider sensitive, into the enquiry form — it isn't designed to receive it, and if you need to share that kind of detail as part of an insurance enquiry, we'll ask for it through a secure channel once we're in direct contact.
If you sign up for marketing updates
- Your name, email address and company.
- Whether you've opened or clicked our emails, if our email platform reports this to us.
Automatically
When you submit the contact form, the message is sent to us using Resend, an email delivery service. Resend generates standard delivery data (timestamps, delivery and open status, technical routing information) in the course of sending that email — see section 4.
3. How we use it, and why we're allowed to
Responding to your enquiry
We use the information in a contact form submission to read, route internally, and reply to your enquiry. Where your enquiry is a step toward us providing a quotation or acting for you, this is necessary to take steps toward a contract at your request (UK GDPR Article 6(1)(b)); otherwise, we rely on our legitimate interest in running a responsive brokerage and dealing properly with people who contact us (Article 6(1)(f)).
Marketing emails
Where you're contacting us, or we're contacting you, as a limited company or LLP (a "corporate subscriber"), the Privacy and Electronic Communications Regulations (PECR) don't require your consent for us to send marketing emails to a work address, provided we identify ourselves clearly and give you a straightforward way to opt out — which we do on every email. Our lawful basis under UK GDPR is legitimate interests.
Where you're an individual, sole trader or partner (PECR treats these the same as consumers), we'll only send marketing emails with your consent, or where you're an existing client and we're marketing similar services to those you've already used from us (the PECR "soft opt-in"), and always with a clear opt-out.
Running and improving the site
We look at enquiry volumes and patterns in aggregate to understand demand and improve how the site and our response process work. This is a legitimate interest and doesn't involve using your details for any purpose beyond that stated here.
4. Email delivery and Resend
We use Resend, Inc., a US-based email infrastructure provider, to send emails generated by the website — the acknowledgement or forwarding of a contact form enquiry, and any marketing emails. Resend acts as our data processor for this purpose: it handles the message on our instructions and doesn't use its content for its own purposes.
Resend retains the content, metadata, delivery status and logs of emails sent through it for 30 days across all of its account plans, after which that copy is deleted from Resend's systems. Anything we keep for longer than 30 days is held in our own systems, not Resend's — see section 6.
5. International transfers
Because Resend is based in the United States, sending an email through it involves transferring personal data outside the UK. This transfer is covered by a Data Processing Addendum that Resend puts in place with every customer, incorporating Standard Contractual Clauses for UK, EU and Swiss transfers, and by Resend's participation in the EU–U.S. Data Privacy Framework. These are mechanisms UK GDPR recognises as providing an adequate level of protection for personal data sent outside the UK.
6. How long we keep your data
- Contact form enquiries: kept for as long as needed to deal with your enquiry, and for 24 months afterwards in case you follow up or a related matter arises, then deleted — unless it turns into a client relationship, at which point our client-file retention rules apply instead.
- Marketing contacts: kept until you unsubscribe, or until we no longer have an active reason to keep contacting you, whichever is sooner — reviewed periodically rather than held indefinitely.
- Resend's own copy: 30 days from sending, regardless of what we hold on our side (see section 4).
7. Who we share your data with
We don't sell personal data, and we don't share it with third parties for their own marketing purposes. We share it only with:
- Resend, to deliver emails, as described above.
- Other IT and software suppliers who host our website or store enquiry and marketing data on our behalf, bound by contract to use it only as we instruct.
- Anyone we're required to share it with by law, regulation, or a valid order of a court or regulator.
8. Security
We use technical and organisational measures appropriate to the risk — including access controls, encryption in transit, and reputable third-party processors who are themselves contractually bound to protect the data — to keep the personal data we hold secure against loss, misuse and unauthorised access.
9. Your rights
Under UK GDPR, you have the right to:
- be told how your data is used (this policy is part of that);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, in certain circumstances;
- restrict or object to certain processing, including direct marketing — you can object to marketing at any time, no reason needed;
- receive certain data in a portable format;
- withdraw consent at any time, where consent is what we're relying on, without affecting anything done before you withdrew it.
We don't make any decisions about you using automated processing alone. To exercise any of these rights, contact us at privacy@bullmanbrown.com. If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) — see section 12.
10. Cookies and analytics
This site doesn't set any cookies on your device, and doesn't use advertising or cross-site tracking scripts.
We use Vercel Web Analytics and Vercel Speed Insights, provided by Vercel Inc., the company that hosts this website, to understand how the site is used and how quickly its pages load. Neither uses cookies or stores anything on your device, and neither identifies you personally. They record:
- the page you visited and the website that referred you;
- your approximate location (country, region and city), browser, operating system and device type;
- page-loading performance measurements, such as how long a page took to display;
- when an enquiry is sent through the contact form, the type of enquiry you selected — never your name, contact details or message.
To count visits without cookies, Vercel Web Analytics creates a temporary identifier from your browser's request, which is discarded after 24 hours. We only see the results as aggregated statistics.
11. Children
This site and our services are directed at businesses and business contacts, not children. We don't knowingly collect personal data from anyone under 18 through the site.
12. How to complain
If you have concerns about how we've handled your personal data, contact us first at privacy@bullmanbrown.com so we can try to put it right. You also have the right to complain directly to the Information Commissioner's Office:
- ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
13. Changes to this policy
We may update this policy from time to time — for example, if we change email providers, add cookies or analytics, or our data protection registration changes. The current version will always be available on our website, dated at the top.