Privacy Policy
Read what personal information we collect, how we use it and how to contact us about your data.
Last updated: 22 October 2026 · Version 2026-10-22
This notice explains how BPS Designs Limited, trading as PlanMan, collects and uses personal information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable privacy and electronic communications rules. Where we rely on consent, we ask for it separately. Using our website does not by itself give consent.
1. Who we are and what this notice covers
BPS Designs Limited is registered in England and Wales, company number 05360014. Our registered office is 2A Swordfish Business Park, Swordfish Close, Higgins Lane, Burscough, Lancashire, L40 8JW, United Kingdom. Contact Ben Snape about privacy at [email protected], by post at that address, or on 01695 302040.
We are the controller of personal information used to run our website, handle enquiries, arrange demos, manage our customer relationships, administer billing and send our newsletter. This notice covers those activities, including our dealings with trial users and users of our web and mobile applications.
When a business uses PlanMan to store or manage personal information about its clients, staff and other contacts, that business normally decides why the information is used. We process it on the business’s instructions under our Data Processing Schedule. Ask that business about its own use of your information. We will help route requests received by us and remain responsible for our own controller activities.
2. Information we collect and why
We receive information from you, from your organisation and authorised account users, from service providers involved in payments or bookings, and automatically when you use our services. We use only information relevant to the purpose.
| Information and purpose | Lawful basis |
|---|---|
| Names, business contact details and messages, to respond to enquiries and arrange demonstrations. | Steps you request before entering a contract where you are the prospective contracting individual; otherwise our legitimate interests in responding to business enquiries and arranging demonstrations. |
| Account, organisation and user details, support communications and service records, to provide trials, administer accounts and support customers. | Contract where we contract with you personally; legitimate interests in providing and supporting services to an organisation when you are its representative or user. |
| Billing contacts, invoices, subscription details and payment status, to collect fees, administer payments and keep accounting records. | Contract where applicable, legitimate interests in managing corporate customer payments, and legal obligations to keep relevant tax and accounting records. |
| Newsletter name and email address, subscription choices and confirmation records, to send PlanMan articles, tutorials and news. | Your consent. We also have a legitimate interest in keeping proportionate consent evidence and opt-out records to demonstrate compliance and respect your preferences. |
| IP addresses, request and device information, security check results and relevant activity logs, to protect services, investigate misuse and manage access. | Legitimate interests in keeping our services and users secure, preventing fraud and investigating incidents; legal obligations where applicable. |
| Website page views, link interactions and technical information collected through Matomo, to understand and improve this website. | Consent. We do not load the analytics tracker until you allow it through our cookie controls. |
| Referral codes supplied in affiliate links, to attribute a subsequent signup and administer referral rewards. | Consent for the optional referral cookie; legitimate interests in administering and checking referral rewards already associated with an account. |
Our legitimate interests are managing business relationships, delivering and protecting our services, receiving payment and respecting communication choices. We consider these interests against your rights and reasonable expectations. We do not use the newsletter permission as permission for unrelated third-party marketing.
Where details are needed to answer an enquiry, create an account or fulfil a contract, we may be unable to do that without them. Forms identify required fields. Please avoid including unnecessary sensitive information in enquiry messages.
Payment providers handle card or bank-payment credentials. We receive the billing and transaction information needed to administer subscriptions and reconcile payments. Providers may also use information for their own regulatory and fraud-prevention purposes, as explained in their privacy notices.
We do not ask for special-category information, such as health or religious information, for ordinary website enquiries or newsletter subscriptions. Customer content can include personal information chosen by the customer; customers must have the appropriate lawful basis and any additional conditions for that content. If we need to use special-category information as controller, we identify both a lawful basis and the relevant additional legal condition.
3. Newsletters and service messages
Website newsletter subscriptions use email confirmation before they become active. You can withdraw consent using the unsubscribe link in any newsletter or by emailing us. We retain limited suppression information to avoid sending further marketing after an opt-out.
We may send necessary service, security, billing and contractual messages independently of a newsletter subscription. If we undertake other direct email marketing, we apply the rules relevant to the recipient: individuals, sole traders and some partnerships require consent or all conditions of a permitted soft opt-in; corporate subscribers have different electronic marketing rules. We identify ourselves, provide an opt-out and respect objections to direct marketing. You can object at any time.
4. Who receives information
We use service providers where needed for hosting, communications, security, payments, booking and administration. They receive information needed for their role. Relevant services include:
- Microsoft Azure: hosting and database services for the PlanMan application.
- Cloudflare: website hosting, request handling, Turnstile security checks and newsletter database/services.
- Amazon Web Services: Amazon SES delivery of enquiry, confirmation and newsletter emails.
- Matomo: our analytics service at analytics.bpsdesigns.com, enabled only with your permission.
- TidyCal and meeting services: demo booking and delivery of the requested online meeting.
- Google: authentication for our newsletter administrator. This does not mean Google login is used for PlanMan customer accounts.
- Payment providers, banks and professional advisers: payment administration, accounting and appropriate legal or professional advice.
Some providers process information on our instructions; others act as controllers for their own legal or service purposes. We may also disclose relevant information where required by law, to protect legal rights, or in a business transaction subject to appropriate confidentiality and data protection safeguards.
Services you choose to load or visit
YouTube videos and the TidyCal calendar are held back until you press their load button. The explanation beside the button describes that provider’s device access. Loading a player or calendar allows that service to receive technical information such as your IP address and to use storage or cookies for that service. Information you enter into a booking is also processed by the booking provider. Depending on the provider and its settings, its processing may include its own analytics or advertising, as described in its privacy notice. Loading these optional services is your choice.
These choices apply to the loaded service on the current page. You can unload it by reloading the page, or use “Unload videos and calendar” in Cookie settings. That stops further use on this page; it does not delete information already received by the provider. Direct links take you to the provider’s own website. Read Google/YouTube’s privacy notice and TidyCal’s privacy notice for their processing and choices.
5. Storage locations and international transfers
PlanMan’s primary application hosting is Microsoft Azure North Europe in Dublin, Ireland. Uploaded documents are stored separately in Azure Blob Storage. Database backups and document storage use geo-redundancy with the paired West Europe region in the Netherlands. Website enquiries, newsletters, security and administration use separate systems. Our Amazon SES email delivery is configured in the London region; our newsletter database has a Western Europe location preference. A regional setting does not mean that every related support, security or operational activity is confined to that region.
Suppliers may operate internationally, including outside the UK. Where we make a restricted transfer of personal information, we must have a lawful route: applicable UK adequacy regulations, or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, with the required data protection assessment and supplementary measures where needed. We do not rely on your acceptance of this notice as general transfer consent. Contact us for information about the arrangements and copies of safeguards relevant to your information.
6. How long we keep information
| Records | Period or criteria |
|---|---|
| Ordinary enquiries and demo correspondence | Up to 24 months after the last substantive contact, unless the correspondence becomes part of an active customer relationship or is needed for a legal matter. |
| Expired trial content | A 30-day export window after trial expiry, then scheduled live deletion, unless the trial becomes a paid account or a lawful customer instruction requires earlier deletion. |
| Closed paid-account content | A 60-day export window after the subscription ends, then scheduled live deletion. A lawful instruction for earlier deletion is handled under the Data Processing Schedule. |
| Tax and accounting records | Six years after the end of the relevant financial year, or longer where a specific legal obligation requires it. |
| Website email delivery and newsletter administration logs | Up to 12 months, unless a particular record is needed for an ongoing incident or legal matter. |
| Newsletter membership, consent evidence and suppression records | Membership while subscribed; afterwards only information needed to evidence the subscription history, handle legal claims and honour opt-outs. We review the need for these limited records rather than reusing them for marketing. |
| Database backups and uploaded documents | SQL point-in-time recovery is configured for 35 days for the main database and seven days for the administration database. Supporting backup chains may remain for up to an additional week. Data awaiting backup expiry is protected and excluded from ordinary use; any restoration must reapply relevant deletions. Uploaded documents are stored separately and are not covered by SQL backups. See our current document recovery arrangements and document-access limitations. |
We retain other technical and security records only for the period needed to investigate issues, protect services and meet legal requirements. We restrict information needed for a specific dispute or legal hold and remove it when that need ends. Cookie and browser-storage durations are described below.
7. Security
We apply technical and organisational measures appropriate to the information and risks, including encrypted connections, access restrictions and backup arrangements. No internet service can promise absolute security. This does not remove our legal responsibilities. Keep your account credentials private and contact us promptly about suspected unauthorised access. See our security and data-handling information.
8. Your data protection rights
Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal information and object to its use. You can object to the use of your personal information for direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Contact [email protected] or use the postal address above. We may need proportionate information to verify your identity. We normally respond without undue delay and within one calendar month, subject to applicable statutory timing rules. We explain any lawful extension, clarification or limitation. Requests are normally free; any lawful exception will be explained.
Erasure is not absolute: we may need to keep limited information for legal obligations, claims or suppression. If your request concerns information a customer controls, we help that customer respond under our processing agreement.
9. Complaints
You can raise a data protection complaint by email, telephone or post using the contact details above. We acknowledge complaints within 30 days, investigate without undue delay, keep you informed and explain the outcome. This acknowledgement period is separate from the deadline for rights requests.
You also have the right to complain to the UK data protection regulator. Visit ico.org.uk/make-a-complaint for its current contact details and process.
10. Cookies and browser storage
These controls cover this marketing website. Authentication and other functions in the separate PlanMan application use the storage needed for the service you request; acceptance of subscription terms is not blanket consent to optional tracking.
Open cookie settings to allow or reject analytics and referral tracking separately, forget a saved colour theme, or unload embedded services. With JavaScript disabled, analytics, referral tracking and embedded services are not loaded; direct provider links remain available.
| Tool | Purpose and duration | Your choice |
|---|---|---|
| planman-privacy-v1 (local storage) | Remembers analytics and referral choices for 180 days on this browser. Expired choices are ignored. Earlier analytics-only choices do not permit referral tracking; we ask for the new choice separately. | Necessary to remember your privacy settings. Change them at any time. |
| Aff (cookie) | Stores the referral code from an Aff or aff link parameter for up to 60 days. Shared across planman.app and its subdomains so the application can attribute a signup. A later consented referral link can replace it. | Only after referral consent. Turning it off removes the accessible cookie; this does not undo attribution already recorded in an account. Do Not Track and Global Privacy Control also block setting it. |
| planman-theme (local storage) | Remembers the light, dark or automatic theme you select. No automatic expiry; retained until you forget it or clear browser storage. | Used when you request a saved appearance. “Forget saved theme” restores your device preference. |
| Matomo _pk_ cookies | Analytics identifiers and visit/referral information. This website configures visitor cookies for up to 180 days, referral cookies for 30 days and session cookies for 30 minutes. | Only after analytics consent. Rejecting stops tracking and removes Matomo cookies accessible to this website. We also respect Do Not Track and Global Privacy Control signals. |
| Turnstile and hosting security | Browser checks and request information to protect forms and service availability; any necessary security storage follows the provider’s applicable security lifecycle. | Used to secure the form/service you request. You can contact us by email or telephone instead of using a protected form. |
| Newsletter admin authentication | __Host-planman-google-state: up to 10 minutes; __Host-planman-newsletter: up to 8 hours. Only for our administrator’s sign-in and session. | Necessary for requested administrator authentication; not public visitor analytics. |
| YouTube and TidyCal | Provider-controlled player/booking storage and technical processing after you load the service. Duration depends on the provider’s current settings and policy. | Each service waits for its own load action. Reload to unload; use provider settings or browser controls to remove its existing storage. |
Rejecting optional cookies does not stop you browsing, contacting us or subscribing. Without referral consent, automatic cookie-based attribution may not be available. Optional tracking is not a condition of using PlanMan. Browser settings can also remove storage; clearing our preference means we ask again.
11. Changes to this notice
We update this notice when processing or legal requirements change and show the review date above. We give further notice where required for a material change. This notice does not replace the customer’s own privacy information or vary a signed contract by itself.