PRIVACY POLICY

1st November 2026

1. About this policy and who we are

Bluechain Consulting Ltd (“Bluechain”, “we”, “us” or “our”) is a UK-based advisory firm working in water, sanitation, climate and development finance. Our work includes economic and financial analysis, investment and blended-finance advice, policy and regulatory reviews, program design, market development, research and evaluation for governments, United Nations agencies, NGOs, foundations and private-sector organisations.

This policy explains how we use personal data when we are responsible for deciding why and how it is processed (“controller”). It covers people who contact us, visit our website, subscribe to updates, work with us, apply for roles or participate in activities we organise. Section 5 explains the different position when we process data on a client’s instructions.

Our legal name is Bluechain Consulting Ltd, registered in England and Wales (company number 11073494). Our registered office is The Old Farm House, Cricklade Street, Poulton, Cirencester, GL7 5HS, United Kingdom. For privacy enquiries, contact us through www.bluechainconsulting.com/contact-us (using “Privacy” in the subject) or write to this address.

2. What personal data we may collect

The information depends on the nature of our relationship. It may include:

Business and professional contacts: names, employers, job titles, work email addresses, telephone numbers, correspondence, meeting records and information relevant to a proposal or engagement.
Consultancy and research activities: stakeholder interview notes; survey responses; institutional or utility staff information; relevant household, customer or beneficiary records; and, where necessary, identifiable information within market, tariff, microfinance or service-delivery datasets.
Recruitment and associates: CVs, employment history, qualifications, professional profiles, country of residence, references and information supplied during selection or contracting.
Website, events and communications: contact-form submissions, newsletter addresses, event or training registrations, and technical website information such as IP address, device/browser data and cookie preferences where collected.

Much of our financial modelling uses institutional, statistical or aggregated information rather than identifiable personal data. Where individual-level data is needed, we seek to minimise it. Information that has only been pseudonymised remains personal data.

3. Where personal data comes from

We receive information directly from you (for example, via enquiries, interviews, surveys, meetings and applications), from client organisations and delivery partners, and from authorised research or fieldwork providers. We may also obtain professional contact information from public institutional websites, professional networks, published reports or other lawful publicly accessible sources. For project datasets supplied by others, the commissioning organisation may be responsible for explaining the collection and disclosure to the individuals concerned.

4. Why we use personal data and our lawful bases

The relevant legal basis depends on the particular activity. Our main purposes and expected bases under UK GDPR are:

Client relationships and enquiries: To respond to enquiries, prepare proposals, maintain professional relationships and coordinate engagements. Normally legitimate interests; contract where dealing with an individual about their contract.
Advisory and research delivery: To conduct analysis, stakeholder engagement, surveys, programme evaluations and reports. Legitimate interests where we are controller and this is appropriate; consent or another applicable basis for specific activities. Client instructions govern work as processor.
Contracts, administration and finance: To deliver contracts, manage suppliers, invoice, maintain records and comply with tax and legal duties. Contract (for individual counterparties), legitimate interests and/or legal obligation.
Recruitment and associate engagement: To assess applications, contact candidates, appoint and manage personnel and associates. Legitimate interests, steps before an individual contract, and/or legal obligation.
Newsletters and professional updates: To send requested updates and permitted business-to-business communications. Consent where required; otherwise legitimate interests, subject to the electronic marketing rules.
Website operation and security: To operate, troubleshoot and protect our website and services. Legitimate interests; consent or an applicable legal exemption for relevant cookies and similar technologies.

Where we rely on legitimate interests, these include running an effective consultancy, responding to professional contacts, delivering evidence-based advisory work, protecting our systems and maintaining appropriate business records. We assess whether these interests are outweighed by individuals’ rights. We do not treat consent as the default basis for every activity.

5. Personal data in client assignments

Assignments can include utility financial assessments, household or customer research, willingness-to-pay studies, market and supply-chain mapping, results-based financing, microfinance analysis, policy reviews and programme evaluations. Relevant project data may include stakeholder views, socioeconomic indicators, customer records or interviews. We use personal data only to the extent appropriate to the agreed work and seek aggregated or de-identified outputs wherever practicable.

For each assignment, our role depends on who determines the purposes and essential means of processing. When a client determines these and Bluechain acts only under its documented instructions, the client is usually the controller and Bluechain a processor. Appropriate contractual data-processing terms apply. For activities where Bluechain independently determines purposes and means, we act as a controller and provide any further project-specific privacy information required, including about sources, lawful bases and data-subject rights.

We recognise that sanitation, poverty, health, accessibility and financial inclusion research can involve vulnerable people or sensitive information. Where special category data, children’s data or other higher-risk information is genuinely necessary, we require an applicable legal condition, proportionate safeguards and any appropriate impact assessment. Projects conducted outside the UK may also be subject to local data protection requirements.

6. Who we share personal data with

We may disclose information on a need-to-know basis to authorised Bluechain personnel and associate consultants; relevant clients and project partners; contracted survey or research teams; website, communications, document-storage and IT suppliers; and accountants, legal advisers or other professional service providers. We may disclose information where required by law or a lawful regulatory request. We require appropriate confidentiality, security and data-processing arrangements where applicable. We do not sell personal data.

7. International work and data transfers

Bluechain works with organisations and individuals in the UK and internationally, including across Africa and Asia. Access to or disclosure of personal data abroad may occur where needed for a project, an approved associate, a client or a technology supplier. Where UK law treats a disclosure as a restricted international transfer, we use an available UK adequacy regulation, an appropriate safeguard (such as the UK International Data Transfer Agreement or UK Addendum, with any required risk assessment), or a lawful exception. Client-led transfers are handled in line with the parties’ agreed responsibilities and applicable local laws.

8. Security and retention

We take appropriate technical and organisational measures proportionate to the personal data and risks involved. These may include restricting access to authorised users, confidentiality obligations, secure sharing and storage arrangements, supplier controls and procedures for identifying and responding to incidents. No method of electronic transmission or storage is completely risk-free.

We keep personal data only for as long as needed for the relevant purpose. The period depends on the nature of the information, the duration of an engagement, contractual and donor requirements, applicable statutory recordkeeping periods, and the need to establish, exercise or defend legal claims. For example, records relating to an assignment may be retained after project closure for audit or contractual purposes; unsuccessful recruitment information and inactive contact records should be reviewed and deleted or anonymised when no longer needed. Specific project retention and return/deletion obligations may be set in the client contract. Data is securely deleted or anonymised when retention is no longer justified.

9. Website, newsletters and marketing

Our website provides a contact form, a newsletter sign-up and information about opportunities to work with us. We use the details submitted to handle the relevant request, subscription or application. Our newsletters and professional updates may include Bluechain projects, sector research and water-finance developments. Recipients can unsubscribe through the communication or ask us to stop by contacting us; we honour marketing objections.

Our website may use cookies or similar technologies for essential operations, preferences, statistical analysis or other functions. We provide information and obtain consent when required by the Privacy and Electronic Communications Regulations; some technologies may qualify for a statutory exemption. Our website should give visitors clear information about the cookies in active use, their purposes and lifetimes, and how to manage relevant preferences. You can also contact us with questions about website tracking. Third-party sites linked from ours have their own privacy notices.

10. Your data protection rights

Subject to the conditions and exemptions in applicable law, you may request access to your personal data; correction of inaccurate data; erasure; restriction of processing; transfer of certain data; and objection to processing, including direct marketing. You may withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing. Additional protections apply to certain solely automated decisions with significant effects. We may ask for proportionate information to confirm identity and will respond within the statutory timescale.

If your information is held for a client-controlled project, please contact the commissioning organisation where practical. You may also contact Bluechain, and we will help route the request to the appropriate organisation.

11. Questions and complaints

Please raise questions, rights requests or data protection complaints via www.bluechainconsulting.com/contact-us, using “Privacy” in the subject, or by writing to our registered office above. We acknowledge data protection complaints within 30 days and, without undue delay, investigate as appropriate, keep you informed and explain the outcome. You may also complain to the UK Information Commissioner’s Office (ICO): www.ico.org.uk/make-a-complaint.

12. Changes to this policy

We review this policy as our services, data uses, or legal requirements change. The latest version and its effective date will be available on our website. If a change materially affects how we use personal data, we will take appropriate steps to bring it to the attention of those affected.