Bill Gosling (“Bill Gosling”, “we”, “us”) has handled information on behalf of regulated clients for seven decades. We apply the same care to the personal information we hold about our own customers, partners, vendors, candidates and website visitors. This policy explains what we collect, why, how we protect it and how you can exercise your rights.
1Overview
This policy sets out the principles Bill Gosling follows when it collects, uses, discloses, transfers, stores and disposes of personal information. Personal information means any information that identifies, or could reasonably be used to identify, a living individual. It includes names, contact details, identifiers, business contact data, application and employment records and information collected through the billgosling.ai website.
We follow the requirements of India’s Digital Personal Data Protection Act 2023 and the rules made under it. Where we process personal information from another jurisdiction, and the local law is stricter, we follow the stricter rule. Nothing in this policy is legal advice, and it does not reduce any right you have under applicable law.
2Scope
This policy applies to personal information processed by Bill Gosling in the course of operating its business, including the e-commerce practice, and to information collected through billgosling.ai. It applies to all Bill Gosling personnel, and to contractors and service providers who process personal information on our behalf.
It does not cover personal information we process purely as a processor under instructions from a client. That processing is governed by the contract with the client and by the client’s own privacy notice.
3Statement
Bill Gosling collects only the personal information it needs for a stated purpose, uses it only for that purpose or a compatible one, protects it with controls appropriate to its sensitivity, keeps it no longer than needed and gives the people it belongs to a straightforward way to see it, correct it and object to its use. Where our automated systems touch personal information, a named person remains accountable for the outcome, and the processing is written to an auditable record.
4Details
4.1Privacy principles
Our handling of personal information is organised around seven principles:
- Notice. We tell you what we collect, why and who we share it with, at or before the point of collection.
- Choice. We give you a way to opt out of uses that go beyond the original purpose, and we obtain consent where the law requires it.
- Accountability for onward transfer. When we pass personal information to a third party, we remain responsible for it and bind the recipient to equivalent protections.
- Security. We protect personal information against loss, misuse, unauthorised access, disclosure, alteration and destruction.
- Data integrity and purpose limitation. We keep personal information accurate, complete and current for its purpose, and we do not use it in ways incompatible with that purpose.
- Access. You can ask what personal information we hold about you and have it corrected, updated or deleted, subject to lawful exceptions.
- Recourse and enforcement. We provide a way to raise a complaint, we investigate it and we correct problems we find.
4.2Notice
When we collect personal information directly from you, we explain the purpose of collection, the categories of third parties with whom it may be shared, how to contact us with questions and the choices you have. Where we receive personal information from a third party, such as a business partner or a recruitment platform, we provide notice as soon as practicable and before using it for a purpose other than the one it was collected for.
4.3Choice
You may choose whether your personal information is disclosed to a third party outside our service providers, or used for a purpose materially different from the one for which it was collected. For sensitive personal information, we obtain your explicit consent before such disclosure or use. You may withdraw consent at any time by writing to hello@billgosling.ai. Withdrawal does not affect processing carried out before it.
4.4Accountability for onward transfer
We share personal information with service providers, professional advisers and business partners only where needed for a legitimate purpose. Before and during such sharing we commit to the following:
- We transfer only the personal information required for the stated purpose.
- We enter into a written agreement that requires the recipient to protect the information to at least the standard in this policy and to use it only for the agreed purpose.
- We take reasonable steps to confirm that the recipient processes the information consistently with its obligations.
- Where a recipient can no longer meet those obligations, we require it to notify us and we act to stop or remedy the processing.
- We remain liable for the recipient’s processing unless we can show we were not responsible for the event giving rise to the harm.
Where personal information crosses a national border, we follow the transfer requirements of the law that applies to it.
4.5Security
We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information and the risk of the processing. These include access controls based on role, encryption in transit and at rest for sensitive categories, logging of access and change, secure development practice and staff training. Our operational platform records who accessed or changed personal information and when, in a tamper-evident audit trail.
4.6Data integrity and purpose limitation
We collect personal information that is relevant and proportionate to the purpose for which it is processed, and we take reasonable steps to keep it accurate, complete and current. We do not process personal information in a way that is incompatible with the purpose for which it was collected or later authorised by you.
4.7Access
You may ask us to confirm whether we hold personal information about you, to give you a copy of it and to correct, update or erase it. We respond within the time the applicable law allows. We may decline a request where the burden or cost of access would be disproportionate to the risk to your privacy, or where another person’s rights would be violated, and we will explain why.
4.8Recourse, enforcement and liability
If you believe we have not handled your personal information in line with this policy, write to hello@billgosling.ai. We will acknowledge your complaint, investigate it and tell you the outcome. If you are not satisfied, you may raise the matter with the data protection authority that has jurisdiction, including the Data Protection Board of India where the Digital Personal Data Protection Act 2023 applies. We conduct periodic reviews to verify that this policy is accurate and that our practices follow it.
4.9Data retention
We keep personal information only as long as it is needed for the purpose for which it was collected. We may keep it longer where a legal, regulatory, tax or accounting obligation requires it, or where it is needed to establish, exercise or defend a legal claim. When it is no longer needed, we delete it or render it anonymous in a secure manner. Retention periods for each category of information are set out in our internal retention schedule.
4.10Children’s privacy
Our services and our website are directed to businesses and to adults. They are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided personal information to us, contact us and we will delete it.
5Purpose of collecting and using personal information
We collect and use personal information for the following purposes:
- Customers. To respond to enquiries, prepare proposals, enter into and perform contracts, provide and support our services and invoice and collect payment. Also to keep you informed about services you use or have asked about.
- Partners and vendors. To assess, onboard and manage relationships, perform contracts, process payments and meet due-diligence and compliance obligations.
- Candidates. To receive and assess applications, conduct interviews and background checks where lawful, communicate about the process and make and record hiring decisions.
- Website visitors. To operate and secure billgosling.ai, respond to messages sent through it and understand how it is used, as described in our cookie policy.
HR data. Personal information about employees and contractors is processed to administer employment or engagement, payroll and benefits, performance and training and health and safety, as well as to meet legal and regulatory obligations. It is held under access controls limited to the people who need it for those purposes, and it is covered by internal HR privacy notices that add to this policy.
6Administration
6.1Roles
Bill Gosling designates a privacy lead who is accountable for this policy, for responding to requests and complaints and for reporting to management on compliance. Business and practice leaders are responsible for applying the policy within their teams. Every employee and contractor is responsible for handling personal information in line with it.
6.2Implementation
The policy is implemented through internal procedures, training, contractual terms with service providers, technical controls in our platform and periodic review. Material changes to how we process personal information are assessed for privacy impact before they are made.
6.3Interpretation
Where this policy and an applicable law differ, the law prevails. Where this policy and a client contract differ in respect of the client’s data, the contract prevails. Questions of interpretation are decided by the privacy lead, with legal advice where needed.
7Enforcement
Breaches of this policy by personnel may lead to disciplinary action up to and including termination. Breaches by service providers may lead to termination of the agreement and other remedies. We notify affected individuals and the relevant authority of a personal data breach where and when the applicable law requires it.
8Contact
Questions, requests and complaints about this policy or about your personal information should be sent to hello@billgosling.ai. Please include enough detail for us to identify you and understand your request.
This document is a draft prepared for legal review. It will be updated when the effective date and any jurisdiction-specific terms are confirmed. Related: cookie policy.
