Privacy
This page covers stsbpo.co.uk only. Our products each have their own policy, linked from the product itself.
Last updated: 21 September 2026
What we collect
Three things. If you send the contact form: your name, work email, company, message, and the IP address you sent it from, which we keep only to deal with abuse of the form. If you apply for a role: your name, email, your phone number if you give one, anything you write in the message, the CV file you upload, and the IP address you applied from. If you simply visit: this site runs no analytics and sets no tracking cookies. It sets two cookies of its own: a session cookie and a CSRF token, which are together what keep the forms working. The contact page shows a Google map of our office, and that map loads with the page: Google receives your IP address and the address of the page you came from whether or not you accepted the banner. It is the one thing on this site that reaches a third party, and it is there because showing you where the office is is the point of that page. There is no advertising pixel and no session recording anywhere on this site.
Why
The form data exists so we can reply to you and keep a record of the conversation. An application and its CV exist so we can assess you for the role you applied to, and for nothing else: we do not keep a general candidate pool and we do not pass your CV to anyone outside the company. None of it is used for anything else, and none of it is sold, rented or shared with anyone for their own purposes.
Where it lives
On our own servers, which we operate ourselves. Contact submissions and applications are stored in our database, and nowhere else. A CV is stored outside the part of the server the web can reach, under a random filename that has nothing to do with your name or your email, and it is readable only by us through a login. It is never published and it never has a public address.
How long we keep it
Contact submissions for 24 months from your last message to us, then deleted. Applications and their CVs for 24 months from the day you applied, then deleted; deleting an application deletes its CV with it.
Your rights
Under UK GDPR you can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. Write to hello@stsbpo.co.uk and we will act within one month. You do not have to give a reason. If you are not satisfied with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.
Who to contact
STS Ltd, company number 12417165, 382 Kenton Road, Harrow, Middlesex HA3 8DP, United Kingdom. hello@stsbpo.co.uk, +44 20 4634 4449.
Start with the problem.
A short conversation is usually enough to tell whether this is something we should be doing for you.