BLACMEX
Back

GDPR & Data Protection

Last updated: June 2026

1. Our Commitment

BLACMEX CIC is committed to protecting the personal data of everyone who uses the BLACMEX Platform. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

2. Data Controller

BLACMEX CIC is the Data Controller for all personal data processed through the platform.

3. Lawful Bases for Processing

We rely on the following lawful bases under Article 6 UK GDPR:

  • Consent (Art. 6(1)(a)) — where you have opted in to receive communications or submit your data
  • Legitimate Interests (Art. 6(1)(f)) — to operate, secure, and improve the platform and produce sector intelligence
  • Legal Obligation (Art. 6(1)(c)) — where required by applicable law

Where we process special category data (such as ethnicity), we rely on explicit consent under Article 9(2)(a) or the substantial public interest condition under Article 9(2)(g).

4. Special Category Data

The platform collects certain special category data including ethnicity and disability information to produce sector diversity reports. This data is processed only with your explicit consent, is stored securely, and is never published in a form that identifies individuals.

5. International Transfers

We use third-party cloud services which may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or reliance on adequacy decisions.

6. Security Measures

We implement appropriate technical and organisational security measures, including:

  • Encrypted data transmission (TLS)
  • Access controls and role-based permissions
  • Secure authentication (magic link / session tokens)
  • Regular review of data handling practices

7. Data Retention

Personal data is retained only for as long as necessary for the purpose it was collected. Submission data used for reporting is retained for up to 7 years. You may request deletion at any time (subject to any legal retention obligations).

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right of Access — obtain a copy of your data (Subject Access Request)
  • Right to Rectification — correct inaccurate data
  • Right to Erasure — request deletion of your data
  • Right to Restriction — limit how your data is used
  • Right to Data Portability — receive your data in a structured format
  • Right to Object — object to processing based on legitimate interests
  • Rights related to automated decision-making

To exercise any right, contact us at admin@blacmex.uk. We will respond within 30 days. You also have the right to complain to the ICO at ico.org.uk.

9. Data Protection Complaints

If you are unhappy with how we have handled your personal data, you can make a data protection complaint by emailing admin@blacmex.uk. Please describe what happened, the personal data or service involved, the outcome you are seeking, and include any information that will help us investigate.

When we receive a data protection complaint, we will:

  • Acknowledge receipt within 30 days
  • Take appropriate steps to investigate without undue delay
  • Keep you informed about the progress of our investigation
  • Tell you the outcome without undue delay once our investigation is complete

Making a complaint is separate from exercising the data protection rights listed above. You may make a complaint, exercise one or more of your rights, or do both. You also retain the right to complain to the ICO at ico.org.uk.

10. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and will inform affected individuals without undue delay where required by law.