Privacy Policy

1. Who We Are and Who This Policy Covers

BGW Capital, LLC is a limited liability company organised in the United States and operating from a single office at 1944 Centennial Dr, St George - 84770-4791, United States (US). The firm works within computer systems design and related services, part of the professional, scientific and technical services sector. For the purposes of data protection law in various jurisdictions, BGW Capital, LLC acts as the controller of the personal information described in this policy, except where a client agreement expressly makes the firm a processor acting on instructions from the client.

This policy applies to anyone who interacts with the desk. That includes prospective clients who send an inquiry through the website, existing clients who hold an open mandate, vendors who supply a component or a service, visitors who read the website without contacting us, applicants who ask about a role and any person whose details appear inside a document that a client shares during an engagement. It also applies to the website at bgwcapital.hair, including the contact form and every page that links to this policy.

The policy does not apply to a client system that BGW Capital, LLC is engaged to design or review. Data held inside a client system belongs to the client, and the handling of that data is described in the mandate note for that engagement. Where the firm operates a tool on behalf of a client, the client sets the rules and our role is limited to carrying out those instructions with care.

2. The Records We Keep and Why

The desk is organised around records, and every record has a purpose that can be stated in a sentence. A position slip exists so that an assumption is visible before it is tested. A mandate note exists so that scope is agreed in writing rather than remembered. A review letter exists so that a client can see, at any point, what changed and who approved it. A custody round exists so that a key is never lost for long. A year-end sitting exists so that the whole record can be read in order and bound into a volume.

Personal information enters these records because people are involved. A position slip may name the engineer who owns a seam. A mandate note may name the client contact who approved a change. A review letter may name the person who accepted a risk in writing. A custody round may name the custodian and the second reviewer. Those names are not incidental. They are what makes the record accountable, and accountability is the entire reason the desk exists.

We therefore collect and keep personal information to the extent needed to produce an honest record of professional work. We do not collect personal information for its own sake, we do not build profiles of people who have never asked for a mandate, and we do not sell records to anyone.

3. Categories of Information We Collect

The categories below describe what actually reaches the desk. Most mandates involve only a fraction of them.

• Identity and contact details. Name, organisation, role, postal address, email address and telephone number. These appear on position slips, mandate notes and correspondence.
• Correspondence. Messages sent through the contact form, by email or by telephone, along with the reply written by the desk. A call note is written on the same day and kept in the intake tray.
• Engagement records. The documents listed in the previous section, including names of staff on both sides, dates of review, approvals and open items carried forward.
• Technical information from the website. The internet protocol address used to reach the site, the browser type, the page requested and the time of the request, where those details are recorded by the hosting environment.
• Commercial information. Fee arrangements, purchase orders, invoices and payment references. We never store full payment card numbers at the desk.
• Information inside client material. When a client shares a system description, a log excerpt or a configuration file, that material may contain personal details of the client staff or of end users. We handle such material under the mandate note and only for the purpose of the engagement.
• Recruitment information. A curriculum vitae, references and notes from an interview, kept only while a role is open and for a short period afterwards.

We do not ask for special category information such as health data, ethnic origin or religious belief, and we ask clients not to include such information in documents shared with the desk. If it arrives without a request, we treat it as confidential and either return it or remove it from the working file with a note that the removal took place.

4. How Information Reaches the Desk

Information reaches BGW Capital, LLC through a small number of channels, and each channel has a corresponding tray. Messages sent through the contact form on the website are handed to the visitor mail program rather than stored on the server, so the firm receives them as ordinary email. Direct email to dispatch@bgwcapital.hair and calls to +14846428945 arrive at the same intake tray. Documents shared during an engagement are logged in the mandate tray with the date received and the person who logged them.

We also receive information indirectly. A client may forward a message from a colleague, a vendor may introduce an account manager, or a public register may confirm an address. Each indirect arrival is noted with its source so that a person can later be told how the desk came to hold the information. In a firm that keeps records, the origin of a record matters as much as its content.

5. The Position Slip and Personal Data

The position slip is the first document in every engagement, and it deserves its own explanation because it is where most personal information first appears in a mandate. A slip states what we believe about a system, what we assume and what would change our mind. To do that honestly, the slip usually names people: the owner of an integration, the approver of a release, the custodian of a key. Those names are personal information, and they are written down because a belief without a named holder is not a belief that can be tested.

A person named on a slip has a right to know that the slip exists, to ask what it says about them and to ask for a correction if a detail is wrong. The slip is not a secret dossier. It is a working page that a client can read at any time. We keep it because the alternative, a system where nobody can say who believed what, is the condition that produces the incidents this firm is hired to prevent.

6. Legal Bases for Processing

Where the law requires a legal basis for processing personal information, BGW Capital, LLC relies on one or more of the following. Performance of a contract covers everything needed to deliver a mandate, including the records described above. Legitimate interests covers the operation of a professional firm, the defence of legal claims, the security of our own systems and the ordinary running of correspondence, balanced against the rights of the person concerned. Consent covers optional messages such as a request to join a mailing list. Legal obligation covers retention required by tax, accounting or regulatory rules. Vital interests would apply only in an emergency where someone needed urgent help.

When we rely on consent, it can be withdrawn at any time by writing to dispatch@bgwcapital.hair. Withdrawal does not affect processing that already took place, and it does not affect records we are required to keep for another legal basis.

7. How Long Records Remain at the Desk

Records are kept for the period in which they can still do their work. An inquiry that does not lead to a mandate is kept for twelve months and then removed, because a cold inquiry has no further use. A mandate note and its review letters are kept for seven years after the close of the engagement, which matches the ordinary period in which a professional claim could be raised. Financial records are kept for the period required by tax and accounting law. A bound year-end volume is kept for the same seven year period as the mandate it summarises.

Recruitment records are kept for six months after a role closes, unless the applicant asks to be considered for a future role, in which case they are kept for twelve months and then removed. Website server logs, where they exist at all, are kept for thirty days. When a retention period ends, the record is destroyed or irreversibly anonymised, and the destruction is entered in the file so that a later request can be answered with certainty.

8. Sharing With Vendors and Partners

BGW Capital, LLC does not sell personal information and does not trade it. We share information only where a mandate requires it and only to the extent necessary. The recipients fall into a few groups. Hosting and email providers carry the website and the mailbox. Accounting and legal advisers receive the records needed to prepare returns or defend a claim. A client receives the records that belong to the mandate it commissioned. A vendor receives the detail needed to resolve a technical issue inside that client system.

Every provider that handles personal information on our behalf is bound by a written agreement that limits use to our instructions, requires reasonable security and requires deletion when the relationship ends. We do not permit a provider to use client records for its own marketing. Where a provider is located outside the United States, the transfer is described in the international transfers section below.

We may also disclose information where the law compels it, for example in response to a valid court order or a lawful request from an authority with jurisdiction over the firm. Where we are permitted to do so, we tell the client before disclosing so that the client can object or seek protection for the material.

9. Access Inside Our Own Firm

Access to records inside BGW Capital, LLC is limited to the people who need the record to do the work. A partner carries the mandate. A second reviewer countersigns custody rounds. An administrator handles billing. Nobody else opens the file, and access is reviewed at the same monthly round that walks the keys. When a person leaves the firm, access is removed on the final day and the removal is entered in the custody page.

Staff are trained on the desk rules at the start of their work and again at the year-end sitting. The rules are simple: do not move a record out of its tray, do not describe a client system in a public place, do not use client material to demonstrate a technique and do not assume a message is private when it is sent from a shared device. Training records are themselves kept as part of the file.

10. Cookies, Analytics and the Website

The website at bgwcapital.hair is deliberately spare. It does not set advertising cookies, it does not embed social network tracking scripts and it does not run a third party analytics product that profiles visitors across sites. The site may use a small local storage entry to remember whether the mobile menu was left open, and that entry stays on the visitor device and is never transmitted to the desk.

The hosting environment may record ordinary server logs for security and reliability. Those logs contain the internet protocol address, the requested page and the time of the request, and they are used only to diagnose faults and to detect abuse. They are not combined with any other record and they are removed on the schedule described in the retention section.

A visitor can block cookies and local storage in the browser settings without losing access to any meaningful part of the site. The contact form does not depend on a cookie and will still prepare a message for the visitor mail program.

11. Security of the Ledger

Security at the desk follows the same principle as the records themselves: it is written down, it is reviewed and it has a named owner. Records are held in systems protected by strong authentication, with encryption in transit and at rest where the provider supports it. Keys and credentials are walked in monthly custody rounds and countersigned by a second person. A device that holds client records is encrypted, and a device that leaves the office is registered on the custody page.

No arrangement is perfect, and we do not claim otherwise. If a breach occurs that is likely to result in a risk to the rights of any person, we notify the affected clients without undue delay and, where the law requires it, the relevant authority. The notification describes what happened, what records were involved, what we have done and what the client should do. A breach note is placed in the file and is read again at the year-end sitting so that the lesson is not lost when the people involved move on.

12. International Transfers

The desk is in the United States, and records are ordinarily held there. A client may be located in another country, and a provider may process a message in a data centre outside the United States. Where personal information moves across a border, BGW Capital, LLC ensures that a lawful transfer mechanism is in place, such as standard contractual clauses or an equivalent arrangement recognised by the relevant law. Transfers are limited to what the mandate requires.

A client or an individual may ask which countries are involved in a particular engagement and what safeguard applies. The answer is given in writing, on a letter from the desk, so that it can be kept with the other records.

13. Your Rights Over Records We Hold

Depending on where a person lives, the law may grant some or all of the following rights. BGW Capital, LLC honours these rights for everyone it deals with, whatever the location, because a record that a person cannot inspect is not a fair record.

• The right to be told whether the desk holds personal information about you and to receive a copy of it.
• The right to have inaccurate information corrected, with the correction dated and signed.
• The right to have information erased where it is no longer needed and no legal duty requires its retention.
• The right to restrict or object to certain processing, including processing based on legitimate interests.
• The right to receive your information in a portable format where a system can reasonably produce one.
• The right to withdraw consent at any time where consent is the basis for processing.
• The right not to be subject to a decision made solely by automated means that produces a legal or similarly significant effect.
• The right to complain to a supervisory authority in the place where you live or work.

Some requests cannot be met in full, for example a request to erase a mandate note that is needed to defend a professional claim or a request to delete an invoice that tax law requires for seven years. When we decline part of a request, we say which part and why, in writing, so that the decision can be reviewed.

14. How to Make a Request

A request is made by writing to dispatch@bgwcapital.hair or by sending a letter to BGW Capital, LLC at 1944 Centennial Dr, St George - 84770-4791, United States (US). It helps to state the right you wish to exercise and the records you have in mind, but we will help identify the records if you are unsure. We reply within thirty days of receiving the request. If the request is complex, we tell you within that period why an extension is needed and when the answer will arrive.

To protect the records, we may ask for enough information to confirm identity, for example a reply from the email address already on file or a short verification call to +14846428945. We ask only for what is proportionate. Requests are free of charge unless they are manifestly unfounded or repetitive, in which case we explain the reason and any reasonable fee before proceeding.

15. Privacy for Children

The services of BGW Capital, LLC are professional services for organisations. The website and the desk are not directed at children, and we do not knowingly collect information from anyone under the age of sixteen. If a parent or guardian believes that a child has sent information to the desk, they should write to dispatch@bgwcapital.hair and we will remove the information after confirming the request. A removal note is placed in the file.

Where a client system receives information about minors, that handling is governed by the mandate note for the engagement. The desk will not design a data flow involving information about minors without a written description of the safeguarding measures adopted by the client.

16. Marketing and the Mailing Tray

BGW Capital, LLC does not run an advertising programme and does not buy contact lists. Occasionally the desk sends a short note about a change in office hours or a new service line to clients who already hold a mandate, because the note is a fact about the firm that a client may need. Anyone may ask to be removed from that list at any time by writing a single line to dispatch@bgwcapital.hair. Removal is recorded on the same day.

We do not send marketing to a person who has only browsed the website and never contacted the desk. We do not pass an email address to a partner for their own marketing. If a third party advertises a product using the name BGW Capital without written permission, the desk asks them to stop and records the request.

17. Clients in California and Other States

Residents of California have specific rights under state law, including the right to know the categories of personal information collected, the sources of that information, the business purpose for collection and the categories of recipients. The categories are listed in this policy, the sources are described in the section on how information reaches the desk, and the recipients are described in the section on sharing. Residents may also request deletion, correction and a copy of the information held about them.

BGW Capital, LLC does not sell personal information and does not share it for cross context behavioural advertising as those terms are used in California law. Therefore no opt out of sale is needed, although a person may still write to confirm that no sale has occurred. Residents of states with similar consumer privacy laws receive the same treatment under this policy, and the request process above applies without change.

18. Clients in Europe and the United Kingdom

Where the General Data Protection Regulation or the equivalent law of the United Kingdom applies, BGW Capital, LLC acts as a controller for the records described here and as a processor where a client agreement says so. A person in Europe or the United Kingdom may contact the desk directly using the details in this policy, and may also complain to the supervisory authority in the country where they live or work. We cooperate fully with any such authority.

A person may object at any time to processing based on legitimate interests. We will stop the processing unless we can show compelling grounds that override the objection, or unless the processing is needed to establish, exercise or defend a legal claim. The decision is given in writing with reasons, and the person may then complain to an authority.

19. Automated Decisions and Profiling

The desk does not make decisions about people through automated profiling. A mandate is accepted or declined by a partner after reading the request. A record is reviewed by a person, and a letter is signed by a person. No algorithm decides whether a person receives a response, and no score follows a person from one engagement to the next.

Some tools used inside a mandate may sort or highlight log entries automatically, but the output is read by an engineer before it affects a client system. If a tool were ever used in a way that produced a significant decision about a person, this policy would be updated before the tool went live and the section on your rights would explain how to ask for a human review.

20. Third Party Websites We Link To

The website may link to a vendor documentation page or to a public register. Those sites are run by other organisations and have their own privacy notices. BGW Capital, LLC is not responsible for how another organisation handles information, and a link is not an endorsement of their practices. We recommend reading the notice of any site before submitting personal details to it.

Where the desk relies on a vendor during a mandate, the vendor relationship is described in the mandate note, and the client can ask for a summary of the safeguards the vendor applies. We review vendor arrangements at least once a year and record the review on the file.

21. Changes to This Policy

This policy is revised when the desk changes the way it handles information or when the law requires a change. Each revision carries a date at the top of the page. A material change is also noted in the next review letter sent to each client holding an open mandate, so that the change is not buried in a webpage that a client may never revisit.

A previous version of this policy is kept for two years so that a person can see what applied at a given time. A copy of a previous version is available on request through the contact details below. We do not apply a change retroactively in a way that reduces the protection of records already held.

22. How to Contact the Desk

Questions about this policy, requests to exercise a right and complaints are all handled by the same desk. Write to BGW Capital, LLC at 1944 Centennial Dr, St George - 84770-4791, United States (US), send an email to dispatch@bgwcapital.hair or call +14846428945 during office hours, Monday to Friday from eight in the morning until five in the afternoon Mountain Time. A person answers, and the message is written on a slip and placed in the intake tray on the day it arrives.

If a reply does not satisfy a concern, say so and the matter is escalated to a partner who was not involved in the first answer. That partner reads the file, writes a fresh response and records the outcome. The desk would rather hear a complaint early than discover it as a dispute later, and every complaint is read again at the year-end sitting so that a pattern, if one exists, becomes visible before it becomes a problem.