Privacy Policy

B2XPRO (trading name of BBX Affinity Ltd)  |  Last updated: May 2026  |  Version 1.0

This privacy policy explains how B2XPRO collects, uses, and protects your personal data when you visit b2xprotect.com or contact us. Please read it carefully. If you have questions, contact us at henry@b2xprotect.com.

1. Who we are

B2XPRO is a trading name of BBX Affinity Ltd, a company registered in England and Wales (company number 17065759). Our registered office is at 6th Floor, 37 Lombard Street, London EC3V 9BQ.

For the purposes of UK data protection law, BBX Affinity Ltd is the data controller in respect of personal data collected through this website and in the course of our advisory engagements.

You can contact us about data protection matters at: henry@b2xprotect.com

2. What personal data we collect

We collect personal data in the following ways:

2.1 When you contact us through the website

When you complete the contact form on b2xprotect.com, we collect:

  • Your name

  • Your email address

  • Your organisation and role (if provided)

  • The sector and situation description you provide in the form

  • Any other information you choose to include in your message

2.2 When you correspond with us by email

When you email us directly, we collect your email address, name, and the content of your correspondence. We may also collect contact details and professional information you include in your email signature.

2.3 When you visit our website

Our website is hosted by Squarespace. Squarespace automatically collects certain technical data when you visit the site, including your IP address, browser type, operating system, referring URLs, and pages visited. This data is collected by Squarespace and used to maintain and improve the website. Please refer to the Squarespace Privacy Policy at squarespace.com/privacy for more information.

We may also use cookies on this website. Please see Section 8 (Cookies) below.

2.4 When you sign up for news and updates

If you opt in to receive news and updates through our contact form, we collect your name and email address for this purpose. You can unsubscribe at any time.

3. How we use your personal data

We use the personal data we collect for the following purposes:

3.1 To respond to your enquiry

When you contact us through the website or by email, we use your personal data to respond to your enquiry, understand your situation, and discuss how B2XPRO might be able to help. This processing is necessary for our legitimate interests in responding to business enquiries and developing our advisory practice.

3.2 To manage our client and prospect relationships

We maintain records of our contacts, engagements, and communications to manage our advisory practice effectively. This includes recording notes from conversations, tracking the progress of potential and active engagements, and maintaining contact records. This processing is necessary for our legitimate interests in operating and developing our business.

3.3 To send you news and updates

If you have opted in to receive news and updates, we use your name and email address to send you B2XPRO insights, framework publications, and relevant market commentary. This processing is based on your consent. You can withdraw your consent and unsubscribe at any time by emailing henry@b2xprotect.com or using the unsubscribe link in any communication we send.

3.4 To comply with our legal obligations

We may process your personal data where necessary to comply with our legal obligations, including maintaining accurate business records and responding to lawful requests from regulatory or law enforcement authorities.

4. Legal bases for processing

Under UK GDPR, we rely on the following legal bases for processing your personal data:

  • Legitimate interests — for responding to enquiries, managing client and prospect relationships, and operating our advisory practice. We have assessed that our legitimate interests are not overridden by your interests or fundamental rights in these contexts.

  • Consent — for sending news and updates where you have opted in. You can withdraw your consent at any time.

  • Legal obligation — where processing is required to comply with applicable law.

5. Who we share your data with

We do not sell your personal data. We do not share your personal data with third parties for marketing purposes.

We may share your personal data with the following categories of recipients where necessary:

5.1 Technology service providers

We use the following services to operate our business, each of which may process your personal data on our behalf:

  • Squarespace — website hosting and contact form processing. Squarespace is based in the US and processes data under Standard Contractual Clauses. See squarespace.com/privacy.

  • Google — email (Gmail) and calendar services. Google processes data under Standard Contractual Clauses. See policies.google.com/privacy.

  • Notion — business operations and contact management. Notion processes data under Standard Contractual Clauses. See notion.so/privacy.

5.2 Professional advisers

We may share information with our legal, regulatory, or financial advisers where necessary for the operation of our business. These parties are bound by confidentiality obligations.

5.3 Specialist partners engaged on client work

Where a client engagement requires input from specialist partners (such as legal or actuarial specialists), we may share relevant engagement information with those partners. We will not share your personal data with specialist partners without a legitimate reason to do so in the context of the engagement.

5.4 Legal and regulatory requirements

We may disclose your personal data where required to do so by law, by a court order, or by a regulatory or law enforcement authority.

6. International transfers

Some of our service providers (including Squarespace, Google, and Notion) are based outside the UK. Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place — typically Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) or adequacy decisions made by the UK government.

7. How long we keep your data

We retain personal data for as long as is necessary for the purposes for which it was collected, taking into account our legal obligations and legitimate business interests.

  • Enquiries that do not result in an engagement — we retain contact records for up to two years from last contact, after which we review and delete records that are no longer relevant.

  • Client engagement records — we retain records of completed engagements for six years from the end of the engagement, in line with standard business record-keeping practice and potential legal limitation periods.

  • News and updates subscribers — we retain your details until you unsubscribe, after which we delete your details promptly.

  • Website technical data — retained by Squarespace in accordance with their privacy policy.

8. Cookies

Our website uses cookies — small text files stored on your device when you visit the site. We use the following types of cookies:

  • Essential cookies — necessary for the website to function correctly. These cannot be disabled.

  • Analytics cookies — used by Squarespace to understand how visitors use the website. These help us improve the site. You can opt out of analytics cookies through the cookie banner when you first visit the site.

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the website.

We do not use advertising or tracking cookies, and we do not share cookie data with advertisers.

9. Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

  • Right of access — you have the right to request a copy of the personal data we hold about you.

  • Right to rectification — you have the right to ask us to correct inaccurate or incomplete personal data.

  • Right to erasure — you have the right to ask us to delete your personal data in certain circumstances.

  • Right to restriction — you have the right to ask us to restrict the processing of your personal data in certain circumstances.

  • Right to data portability — you have the right to receive your personal data in a structured, commonly used format in certain circumstances.

  • Right to object — you have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

  • Right to withdraw consent — where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at henry@b2xprotect.com. We will respond within one month. We do not charge a fee for handling rights requests unless they are manifestly unfounded or excessive.

10. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

We would, however, appreciate the opportunity to address your concern directly before you contact the ICO. Please contact us first at henry@b2xprotect.com.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our data processing activities or applicable law. We will update the "Last updated" date at the top of this policy when we make changes. We encourage you to review this policy periodically.

Material changes that affect how we process your personal data will be communicated to affected individuals where we have contact details for them.

12. Contact us

If you have any questions about this privacy policy or how we handle your personal data, please contact us:

B2XPRO is a trading name of BBX Affinity Ltd, registered in England and Wales. Company number: 17065759. Registered office: 6th Floor, 37 Lombard Street, London EC3V 9BQ.