About us
BRCGS is the leading globally recognised consumer protection organisation (CPO) providing supply chain assurance through standards, certification, training and industry insight. Used by nearly 40,000 certificated sites across more than 130 countries, BRCGS supports industry in delivering safe food, trusted products and responsible supply chains worldwide.
As part of our business operations and serving you as one of our customers, we will process personal data. The purpose of this Privacy Notice is to give you information about this data processing and your data rights.
1. Introduction
This Privacy Notice explains how BRC Trading Limited (referred to as "BRCGS", "we", "us", “our”) collects and uses personal data. This Privacy Notice applies to BRCGS’s customers. Our customers include registered companies and organisations, sole traders, partnerships, and individuals.
For the purpose of the Data Protection Act 2018, the UK General Data Protection Regulation (the “UK GDPR”) and the EU General Data Protection Regulation 2016/679 “EU GDPR”, we are the data controller of the personal data we process about you.
ICO Registration Number: Z1303163
BRCGS Registered Address: The Priestley Centre, 10 Priestley Road, Guildford GU2 7XY
Data Protection Officer: TLT LLP, 20 Gresham Street, London EC2V 7JE
For information on how BRCGS collects and uses personal data via the BRCGS Directory please refer to the BRCGS Directory Privacy Notice, available at: www.brcgs.com/tools-and-services/directory-pro-api/privacy-notice/
2. Categories of personal data we process
We may collect and process the following categories of personal data about you:
Contact and account data, which may include: Name, job title, contact details including email, telephone, and/or address, company name, customer identification data, industry sector, role, professional experience, login credentials, IP addresses, access logs, auditor number, site code, account activity including in respect of your BRCGS Educate account learning activities, access to course materials, achievements, examination results, digital badges earned.
Engagement and marketing data, which may include: Written, communication preferences, consent records, interaction history, engagement data, purchase and order history, downloaded documents, survey responses, interests, customer segments, order values and frequency, product preferences, website visits.
Contract and financial data, which may include: Signature, role in contract, details of purchase, purchase order information, invoice details, shipping and billing details, payment information, credit check results, payment history.
Feedback and complaints data, which may include: Survey responses, satisfaction ratings, feedback comments, complaint details, correspondence, investigation records, resolution details.
Event data, which may include: Registration details, attendance records, participation data, feedback responses.
Website analytics data, which may include: IP addresses, cookie identifiers, browser type and version, originating ISP-domain information, device type, operating system, pages visited, time on pages, traffic data, referral sources, search terms, form submissions, downloads, geolocation (country/region), user journey data.
Special category data (context-dependent), which may include: Certain engagement and marketing data (video-audio call recording and sentiment analysis), dietary requirements (revealing religious beliefs or health) and accessibility requirements (revealing disability) for events, audio and video data (biometric data), and health data when provided.
3. How we collect your personal data
We collect personal data about you in the following ways:
Directly from you through purchases, downloads, web forms, account registration, event registrations, consent forms, communications, survey responses, complaint submissions, feedback forms, webinar registrations, and preference centres.
From your employer or organisation where your company provides your contact details to BRCGS in order to set up an account on the relevant BRCGS platform for you.
From business sources which may include business directories, professional networks including LinkedIn, events and conferences.
From third parties which may include our Approved Training Partners or Approved Training Establishments if you participate in any of their training events, and Certification Bodies in connection with auditing.
Through cookies and tracking technologies (when deployed) when you visit our websites. Please see our Cookies Policy for more information on how we use cookies.
Where we obtain your personal data from third parties (such as your employer, organisation or from business sources), those parties are responsible for providing you with appropriate privacy information about their own processing activities. We recommend that you review their privacy notices to understand how they handle your data before sharing it with us.
4. Purposes of processing and lawful bases
We may process your personal data for the following purposes and on the following lawful bases:
| Purpose | Lawful Basis (Article 6 UK GDPR / Article 6 EU GDPR) | Special Category Basis (Article 9 UK GDPR / Article 9 EU GDPR / DPA 2018) |
|---|---|---|
| Providing products and services to you | Article 6(1)(b) - Performance of contract Article 6(1)(f) - Legitimate interests | N/A |
| Customer relationship management | Article 6(1)(b) - Performance of contract (existing customers) Article 6(1)(f) - Legitimate interests (prospective customers) | N/A |
| Direct marketing | Article 6(1)(a) - Consent Article 6(1)(f) - Legitimate interests | N/A |
| Sales and contract management | Article 6(1)(b) - Performance of contract Article 6(1)(f) - Legitimate interests | N/A |
| Payments and finance | Article 6(1)(b) - Performance of contract Article 6(1)(c) - Legal obligation Article 6(1)(f) - Legitimate interests | N/A |
| Online account access | Article 6(1)(b) - Performance of contract | N/A |
| Administration and management in relation to our products and services | Article 6(1)(a) - Consent Article 6(1)(f) - Legitimate interests | N/A |
| Customer feedback and complaints | Article 6(1)(a) - Consent Article 6(1)(f) - Legitimate interests | Article 9(2)(f) - Necessary for establishment, exercise or defence of legal claims |
| Events, webinars and training | Article 6(1)(a) - Consent Article 6(1)(f) - Legitimate interests | Article 9(2)(a) Explicit consent DPA 2018 Schedule 1, Part 1, para. 1 |
| Customer analytics and business development | Article 6(1)(f) - Legitimate interests | N/A |
| Website analytics (UX improvement, performance tracking, journey insight, fraud/abuse prevention) | Article 6(1)(a) - Consent Article 6(1)(f) - Legitimate interests | N/A |
| Improving sales effectiveness/customer service/business relationships | Article 6(1)(f) - Legitimate interests | Article 9(2)(a) Explicit consent (where biometric voice/video data processed) |
Our legitimate interests include: developing business relationships and providing customer service; providing and promoting products and services; maintaining contract records and protecting legal rights; assessing creditworthiness and debt recovery; fraud prevention; quality improvement and complaint resolution; providing technical and educational content; understanding customer needs to enhance our offerings; supporting business planning; optimising website functionality, security and user experience; improving marketing and sales effectiveness; and employee training and operational efficiency.
5. How we protect and secure your personal data
We have put in place technical and organisational measures, including appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, other third parties who act on our behalf and have a business need to process your data. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
6. Who we share your personal data with
We only share your personal data with third parties (including companies who are part of the same group as BRCGS and service providers in connection with the services they are providing on our behalf) where it is necessary for us to do so to fulfil our obligations to you under our contract, as may be necessary to provide you with or administer and manage our products and services, or where we are required to comply with a regulatory or legal provision.
If you are identified in an audit report (e.g. as a point of contact for a Certification Body or an auditor), your personal data may be disclosed to third parties (such as our customers) who request access to that report. Typically, your personal data is limited (e.g. an email or name).
We will never sell your personal data for direct marketing.
7. Links to other websites
Please note, the BRCGS website (https://www.brcgs.com/) may contain links to other websites that are not controlled by us. These links are provided for your convenience. We are only responsible for our privacy practices and our security. We recommend you check the privacy policies for any other websites that you visit.
8. International transfers
If we need to transfer your personal data outside the UK or European Economic Area, we will take all steps reasonably necessary to ensure that any such transfer is made securely and that there is adequate protection in place to protect your personal data.
9. How long we keep your personal data
We will retain your personal data for as long as necessary and in accordance with BRCGS's retention schedule, which is available on request from the Data Protection Officer.
10. Your rights
Your personal data is protected under data protection laws, and you have several data rights (explained below). Please contact us using the details provided below if you have any queries in relation to your rights.
If you seek to exercise your rights, we will assess whether the right applies to your circumstances.
Right of access: You have a right to access the personal data we hold about you upon request. This is known as a “Data Subject Access Request”. You can exercise this right by making a request in writing, by email or by telephone using the contact details in the contact and complaints section below.
Right of rectification: You can ask us to correct or update your personal data to ensure it is accurate and complete.
Right to erasure and right to restrict processing: You can ask us to stop processing and/or to delete your personal data in certain circumstances (for example, where it is processed with your consent, or it is no longer necessary for us to process it).
Right to data portability: You have a right to ask us to provide you with your personal data in a form that suits you, and/or to provide your information to a third party.
Right to object: You have a right to object to our processing of your personal data.
Profiling and automated decisions: You have a right not to be subject to automated decisions which have a legal effect and to be protected by safeguards in respect of any profiling. We do not undertake any automated decision making or profiling.
Right to object to direct marketing: Where you have consented to receive direct marketing, you can change your mind at any time by contacting us or following the link to “unsubscribe” provided in each email we send to you. Please allow a few days for us to action your request.
11. How to contact us
If you have any questions or wish to exercise your rights, please contact our Data Protection Officer at LGC.DPO@TLT.com.
If you have any queries, concerns, or complaints, we invite you to raise them with us at the above address so that we may discuss them with you for resolution.
You also have the right to lodge a complaint with a supervisory authority, in particular:
In the UK, with the Information Commissioner's Office (“ICO”) by writing to Information Commissioner's Office, Water Lane, Wilmslow, SK9 5AF or calling 0303 123 1113. Further information about how to do this can be found at: www.ico.org.uk.
In the EU Member State of your habitual residence, place of work, or place of the alleged infringement. A full list of EU data protection supervisory authorities and their contact details is available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
12. Changes to this Privacy Notice
We may change this Privacy Notice from time to time. We encourage you to periodically review this Privacy Notice for the latest information on our privacy practices.
Last updated: October 2026