Privacy notice
Last updated: 10 October 2026
This notice explains what personal data I hold, why, how long I keep it, and what you can ask me to do with it. I only collect what I need to run the business. I don't sell or rent personal data to anyone.
Who I am
I'm Beresford Salmon, a sole trader trading as Midlands Legal BI. I'm the data controller for the personal data described here. That means I decide how it's used, and I'm responsible for it.
- Email: beresford.salmon@midlandslegalbi.co.uk
- Business address: 2 Haweswater Grove, Nuneaton, Warwickshire CV11 6TW
- ICO registration: ZC095108 (registered as “Mr Beresford Salmon”, other name “Midlands Legal BI”)
What I hold and why
| Who you are | What I hold | Why | Legal basis |
|---|---|---|---|
| A client contact | Name, job title, work email and phone number | To deliver the work we've agreed and send invoices | Contract |
| A client | Invoices and payment records | To keep the accounts HMRC requires | Legal obligation |
| Someone I might work with | Name, job title, firm and work email | To contact law firms and collection agencies whose work I think I could help with | Legitimate interests |
| Someone who emails me | Your name, email address and what you wrote | To reply, and to prepare a quote if you ask for one | Legitimate interests, or steps before a contract |
| Someone who asked me not to contact them | Name and work email | To make sure I don't contact you again | Legitimate interests |
| A website visitor | Your IP address, held in the host's server logs (see below) | To keep the site running and secure | Legitimate interests |
You don't have to give me any personal data. But I need a client's contact details to do the work and send invoices, and an email address to reply to you.
Where I rely on legitimate interests, I've weighed my interest in running the business against your privacy, and I only contact people in their work role. You can object at any time (see Your right to object).
Where I get prospect details
If I've contacted you without you contacting me first, I got your details from public sources: the Solicitors Regulation Authority's register of solicitors and firms, and your firm's own website. I only email people at companies and limited liability partnerships (LLPs), and every email tells you how to opt out.
Data I handle for clients
When I build reports for a client, I may handle personal data in their files, such as the names and balances of their own customers or debtors. For that data the client is the controller and I act on their instructions only. Their privacy notice explains how it's used. I keep it in the business's Microsoft 365 account and nowhere else.
Who else sees it
- Microsoft provides my business email and file storage (Microsoft 365). Files and email are stored in Microsoft's UK data centres.
- GitHub hosts this website. It logs visitors' IP addresses for security, as any web host does.
- HMRC, the ICO, courts or the police, if the law requires me to share information.
I don't use any other service providers for personal data.
Data outside the UK
Files and email are stored in the UK. Microsoft may access some data from outside the UK for things like spam filtering, support and security, under its data protection terms and the UK's approved safeguards.
GitHub is a US company, so its website logs are held in the United States. GitHub is certified under the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework), which the UK government recognises as protecting personal data adequately.
How long I keep it
| What | How long |
|---|---|
| Invoices and accounting records | 7 years from the end of the financial year they relate to |
| Client contacts and project files | While we work together, then 2 years |
| Prospect details | 2 years from the last contact, unless you become a client |
| The do-not-contact list | For as long as I do outreach, so I never contact you again |
| Emails from people who don't become clients | 6 months |
After that I delete it.
How I keep it safe
- Business data stays in Microsoft 365. It's never copied to personal accounts, personal email, USB sticks or personal storage.
- Every account needs a second sign-in step (multi-factor authentication).
- The computer I use for business data is encrypted with BitLocker.
- Every password is unique and kept in a password manager (1Password).
- Email is encrypted in transit.
Cookies
This website doesn't set any cookies. It has no analytics, tracking or advertising code, and it loads nothing from other companies.
If you use the light and dark switch, your browser remembers your choice on your own device. It's never sent to me.
Automated decisions
I don't make any decisions about people by automated means alone, and I don't profile anyone.
Your right to object
You can tell me to stop using your details at any time. If it's about marketing, I'll stop straight away, with no exceptions. For anything else I do under legitimate interests, I'll stop unless I have a strong reason not to, and I'll tell you what it is.
Your rights
You can ask me to:
- send you a copy of the personal data I hold about you
- correct anything that's wrong or incomplete
- delete it
- limit how I use it
- send it to you, or to someone else, in a common file format
- stop using it, including stopping all marketing straight away
Email me at beresford.salmon@midlandslegalbi.co.uk. It's free. I'll reply within one month, and I'll tell you if I need longer and why. Some rights only apply in certain circumstances; if one doesn't apply, I'll explain why.
Complaints
If you're unhappy with how I've handled your data, please email me first. I'll acknowledge your complaint within 30 days and tell you what I'm doing about it.
You can also complain to the Information Commissioner's Office (ICO):
- ico.org.uk/make-a-complaint
- 0303 123 1113
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes
If I change how I use personal data, I'll update this page and its date. If a change affects you significantly and I have your details, I'll tell you directly.