Privacy

Updated 16 September 2026 · Version 1.0

Blue Peak Privacy Policy

Version 1.0

Effective date: 16 September 2026

Blue Peak Consulting Group Ltd (“Blue Peak”, “we”, “us” or “our”) provides an international product compliance and regulatory platform and related managed services.

This Privacy Policy explains how we collect, use, disclose and protect personal information when you use our website, platform or services, communicate with us, or otherwise interact with Blue Peak.

1. Who We Are

Blue Peak Consulting Group Ltd is responsible for the personal information described in this Privacy Policy where we determine why and how that information is processed.

Blue Peak Consulting Group Ltd

7a Eastgate Street

Winchester

England

SO23 8EB

United Kingdom

Privacy enquiries: info@bluepeakconsulting.co.uk

Where another organisation independently determines how and why it processes personal information, such as a regulatory provider performing its own professional or statutory functions, that organisation may be a separate controller of that information.

2. Who This Privacy Policy Applies To

This Privacy Policy may apply to personal information relating to:

* customers and prospective customers;

* users of the Blue Peak platform;

* employees, officers and representatives of customers;

* manufacturers and their personnel;

* suppliers and business partners;

* regulatory and professional contacts;

* individuals identified within product, technical, regulatory or compliance documentation; and

* other individuals who communicate or interact with Blue Peak.

Our services are intended primarily for businesses and professional users and are not directed at children.

3. Personal Information We Collect

Depending on how you interact with Blue Peak, we may collect and process the following categories of personal information.

Account and identity information

This may include your name, job title, employer or organisation, business contact details, account credentials, user role and other information associated with your Blue Peak account.

Customer and manufacturer information

This may include information about the customer or manufacturer you represent, your relationship with that organisation and information required to establish that you are authorised to act on its behalf.

Service and transaction information

This may include services purchased, Service Orders, regulatory appointments, subscription or membership information, invoices, payment status, service history and related transaction records.

We do not need to receive or store full payment-card details where payments are processed directly by our payment service provider.

Product and regulatory information

When you use our regulatory services, you may provide product files, technical documentation, declarations, certificates, labels, packaging, test reports, safety information, correspondence and other regulatory documentation.

These materials may contain personal information, including names, signatures, business contact details and information relating to individuals involved in manufacturing, testing, quality, regulatory compliance or supply-chain activities.

Communications

We may process emails, platform messages, meeting information, support requests, feedback and other communications between you and Blue Peak.

Platform and technical information

When you use our website or platform, we may collect technical and usage information such as IP address, device or browser information, login activity, timestamps, system activity and security or diagnostic information.

Where we use cookies or similar technologies requiring consent, we will provide appropriate information and choices when you use the relevant service.

Information from other sources

We may receive personal information from the organisation you work for or represent, manufacturers, regulatory providers, professional advisers, business partners or other parties involved in delivering the services.

Where appropriate, we may also receive information from publicly available professional or business sources.

4. How We Use Personal Information and Our Lawful Bases

We process personal information only where we have an appropriate lawful basis.

Providing and administering our services

We use personal information to:

* create and administer accounts;

* provide access to the Blue Peak platform;

* process Service Orders and subscriptions;

* administer regulatory and compliance services;

* manage regulatory appointments;

* communicate about services;

* provide customer support; and

* maintain service records.

Depending on the circumstances, we process this information because it is necessary to perform a contract with you or take steps at your request before entering into a contract, or because it is necessary for our legitimate interests in providing and administering our services to business customers.

Regulatory and compliance services

We use information contained in product and regulatory documentation to facilitate and manage regulatory assessments, compliance reviews, representation services, remediation activities, regulatory records and related services.

Our lawful bases may include performance of a contract and our legitimate interests in delivering, managing and maintaining our regulatory services and supporting our customers' compliance activities.

Where processing is necessary to comply with a legal obligation applicable to Blue Peak, we may also process information on that basis.

Working with regulatory providers and specialists

We may provide relevant information to regulatory providers, representatives, laboratories, technical specialists, professional advisers or other specialists where necessary to provide the service requested.

Our lawful bases may include performance of a contract and our legitimate interests in obtaining specialist support and delivering the relevant regulatory or compliance service.

Where a regulatory provider or representative has its own legal or statutory obligations, it may process relevant personal information independently in accordance with those obligations and its own privacy responsibilities.

Payments, billing and financial administration

We use relevant information to process payments, issue invoices, maintain financial records, manage subscriptions and prevent or investigate payment-related fraud or misuse.

Our lawful bases may include performance of a contract, compliance with legal obligations and our legitimate interests in administering and protecting our business.

Customer relationship management and communications

We use business contact information and service history to manage customer relationships, respond to enquiries, follow up on services and maintain appropriate records of our interactions.

We generally rely on our legitimate interests in managing customer and prospective-customer relationships and operating our business.

Marketing

We may use business contact information to provide information about Blue Peak services, regulatory developments or other information we believe may be relevant to professional contacts.

We will do this only where permitted by applicable law. Where consent is required, we will rely on consent.

You can opt out of direct marketing at any time by using the unsubscribe mechanism provided or contacting us.

Security, fraud prevention and platform administration

We may process account, technical and usage information to authenticate users, maintain platform security, investigate suspected misuse, diagnose technical problems, protect our systems and maintain appropriate records of platform activity.

We rely primarily on our legitimate interests in operating, securing and improving our services and protecting Blue Peak, our customers and platform users.

Improving our services

We may analyse service usage, feedback and operational information to understand how our services are used and improve our platform, processes and customer experience.

Where personal information is involved, we rely on our legitimate interests in improving and developing our business and services, subject to appropriate safeguards.

Establishing and protecting legal rights

We may retain and use information where reasonably necessary to establish, exercise or defend legal claims, resolve disputes, enforce agreements, investigate misconduct or protect the rights and interests of Blue Peak or others.

We rely on our legitimate interests and, where applicable, legal obligations.

5. Artificial Intelligence and Automated Processing

Blue Peak may use artificial intelligence and other automated technologies to support aspects of our platform and regulatory workflows.

These technologies may assist with activities such as extracting information from documents, organising or classifying information, identifying potential regulatory issues, analysing documentation, summarising information and preparing draft outputs for professional review.

Where personal information is processed using these technologies, we use it for the purposes of providing, administering, securing or improving the relevant service.

Artificial intelligence may support regulatory professionals, but Blue Peak does not rely solely on AI to make material regulatory decisions concerning whether a product is accepted or rejected for regulatory representation or whether a statutory regulatory appointment becomes active.

Where we use third-party AI service providers to process personal information on our behalf, they are subject to appropriate data-protection arrangements.

6. Who We Share Personal Information With

We may disclose personal information where reasonably necessary to provide our services, operate our business or comply with applicable law.

Recipients may include:

Regulatory providers and representatives

Where your service involves specialist regulatory review or regulatory representation, relevant information may be provided to the regulatory provider or representative identified for that service.

This may include AF Pharma and the relevant AF Pharma group entity where AF Pharma performs regulatory services or acts as the applicable regulatory representative.

Laboratories and technical specialists

Where testing, technical assessment or specialist professional input is required, relevant information may be provided to laboratories, testing organisations, regulatory specialists or other professional service providers involved in the work.

Technology and infrastructure providers

We use third-party providers to operate, host, secure, support and maintain our website, platform and business systems.

These may include cloud infrastructure, hosting, database, authentication, communications, document-management, monitoring and security providers.

Payment providers

Payments may be processed through Stripe or another payment provider identified at checkout.

Payment providers process payment and transaction information in accordance with their own contractual and privacy arrangements.

Customer relationship and communications providers

We use systems to manage customer relationships, email and business communications, which may include HubSpot and other communications or productivity providers.

Artificial intelligence providers

Where AI functionality is used within our services, relevant information may be processed by third-party AI or technology providers acting on our behalf or otherwise in accordance with the applicable data-processing arrangements.

Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers and other professional advisers where reasonably necessary.

Authorities and other legally required recipients

We may disclose information to regulators, market-surveillance authorities, courts, law-enforcement bodies, government agencies or other parties where required by law or reasonably necessary in connection with regulatory or legal obligations.

A regulatory representative may also communicate information directly to competent authorities where required in performing its regulatory duties.

Business transactions

If Blue Peak undergoes a merger, acquisition, financing, restructuring, sale of assets or similar transaction, relevant personal information may be disclosed to advisers, potential counterparties and their representatives subject to appropriate confidentiality and data-protection safeguards.

7. International Transfers

Blue Peak is based in the United Kingdom, but some organisations involved in providing our services may operate or process information in other countries.

This may include regulatory providers, technology providers, infrastructure providers, communications providers, payment providers and AI providers.

Where personal information protected by UK data-protection law is transferred outside the United Kingdom, we will take steps required by applicable law to ensure that an appropriate transfer mechanism or safeguard is in place.

Depending on the destination and recipient, this may include reliance on applicable adequacy regulations or recognised contractual safeguards and, where required, an assessment of the protections applying to the transfer.

You may contact us using the details in this Privacy Policy if you would like further information about the safeguards applying to international transfers of your personal information.

8. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate regulatory and business records, meeting legal or regulatory requirements and establishing or defending legal claims.

Different categories of information may therefore be retained for different periods.

In determining the appropriate retention period, we consider:

* the nature and sensitivity of the information;

* the purpose for which it is processed;

* the duration of our customer or business relationship;

* applicable contractual requirements;

* regulatory and product-safety record-keeping requirements;

* statutory accounting and tax requirements;

* applicable limitation periods;

* potential disputes or legal claims; and

* whether the information can appropriately be deleted or anonymised.

Regulatory records may need to be retained after a customer relationship or regulatory appointment ends where applicable product-safety or regulatory requirements require continued record keeping.

9. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal information is restricted according to business and regulatory requirements, and we expect service providers processing personal information on our behalf to implement appropriate security and confidentiality measures.

No online service or method of electronic storage can be guaranteed to be completely secure.

10. Your Data Protection Rights

Depending on the circumstances and applicable law, you may have the right to:

* request access to personal information we hold about you;

* request correction of inaccurate or incomplete personal information;

* request deletion of your personal information;

* request restriction of processing;

* receive certain personal information in a portable format;

* object to certain processing;

* withdraw consent where processing is based on consent; and

* raise concerns about how your personal information is processed.

These rights are not absolute and may depend on the circumstances and lawful basis on which we process the information.

Your right to object

Where we process your personal information on the basis of legitimate interests, you may have the right to object to that processing.

You also have the right to object at any time to the use of your personal information for direct marketing.

To exercise a data-protection right, contact us at info@bluepeakconsulting.co.uk.

We may need to verify your identity before acting on a request.

11. Complaints

If you have concerns about how we process your personal information, please contact us first so that we can investigate.

You also have the right to complain to the UK Information Commissioner's Office (ICO), the UK's data-protection regulator.

Information about making a complaint is available from the ICO at www.ico.org.uk.

If you are located in another jurisdiction, you may also have the right to contact the data-protection authority applicable to you.

12. Information You Provide About Other People

Product, technical and regulatory documentation uploaded to the platform may contain personal information relating to other individuals.

Where you provide personal information about another person, you are responsible for ensuring that you are authorised or otherwise permitted to provide that information for the relevant purpose and, where required, that the individual has been provided with appropriate information about the processing.

Please avoid providing personal information that is not reasonably necessary for the relevant service.

13. Required Information

Certain information is necessary for us to create an account, enter into or administer a contract, process a regulatory appointment or provide a requested service.

If required information is not provided, we may be unable to provide the relevant service or complete the applicable regulatory process.

Where information is optional, this will be indicated where appropriate.

14. Third-Party Websites and Services

Our website or platform may contain links to third-party websites or services.

Blue Peak is not responsible for the privacy practices of independent third parties. You should review the privacy information provided by the relevant third party where you interact directly with its service.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, regulatory requirements or the way we process personal information.

The current version will be made available through our website or platform and will show its effective date.

Where a change materially affects how we use personal information, we will provide additional notice where required by applicable law.

16. Contact Us