AF-IMS32 – Privacy Statement
At Ashton Fire, we are committed to protecting personal data. This privacy statement describes why and how we collect and use personal data and provides information about individuals’ rights. It applies to personal data provided to us, both by individuals themselves and by others. We may use personal data provided to us for any of the purposes described in this privacy statement or as otherwise stated at the point of collection.
Personal data is any information relating to an identified or identifiable living person. We process personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose may differ.
What data do we collect?
We require basic personal data from individuals working for or with client companies. This is limited to name, title, address, contact number, contact email, company name. In circumstances whereupon invoice, financial details are provided by you to us, we will also store these details.
We will use any data associated with your record, for example, the type of service you received, any reasons for wanting that service, the value of the service and the success of that service, for internal processing (business analysis) and improvement of our service offers.
How we protect your data
We take the security of all the data we hold very seriously. We adhere to internationally recognised documentary control standards within the wider framework of ISO 9001:2015 and hold Cyber Essentials Plus accreditation. We have a framework of policies, procedures and training in place covering data protection, confidentiality and security and we regularly review the appropriateness of the measures we have in place to keep the data we hold secure.
Our central server database is securely stored with encrypted and password-protected access. We perform regular monitoring of our security system as well as undertaking training of our team in data protection.
The legal basis
To operate our business model, we need to collect and store data of employees and affiliates of our business partners and clients. The legal basis for collecting and processing this data is as follows:
- Consent: Under certain circumstances, we may collect and process your data with your consent. Consent options will be made clear and for what purpose we are collecting and processing that data. For example, when opting-in for an email newsletter.
- Contractual obligations: Due to the nature and importance of our work in life safety, we require personal data from individuals and companies to achieve contractual obligations and regulatory compliance. For example, we require a formal contact name and address to provide work quotations, communication, invoices and reports.
- Legal compliance: If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity affecting us to law enforcement.
- Legitimate interest: we will often require your basic data to enable operations critical to our business, in following our quality management system, and to allow us to send limited communications relevant to your interests with us. Personal data processed under the legal basis of legitimate business interests will not materially impact your rights, freedoms or interests.
Why we process personal data
As a responsible business, we require certain limited personal data from employees of our client businesses to enable us to:
- Perform our services
- Meet our accredited service requirements
- Effectively control QMS documentation
- Meet relevant statutory requirements relating to our services
- Request feedback that enables us to better improve our services
When and how we process personal data
We may collect personal data when:
- You visit any of our websites
- You contact anyone within Ashton Fire Limited
- You engage with us on social media
- You freely provide your information to us at events, exhibitions, training, networking or any other event type
- You provide feedback, complete forms or any other document request for the purposes of improvement of our services
- You have given third party permission to share personal data about you
- You allow publicly available sources to share your data, and where your data is made publicly accessible by law
- When you visit our sites where CCTV recordings will store visuals of you. Such imagery is not stored with any other identifying data
We will only share personal data with selected parties when we are legally permitted to do so, for example with partner firms requiring such information during construction projects. When we share data with others, we put contractual arrangements and security mechanisms in place to protect the data and to comply with our data protection, confidentiality and security standards.
Locations of processing
We have international operations, and in common with other professional service providers, we use third parties located in other countries to help us run our business. As a result, personal data may be transferred outside the countries where we and our clients are located. This includes countries in the European Union (“EU”) governed by the EU GDPR, and to countries that do not have laws that provide specific protection for personal data. We have taken steps to ensure all personal data is provided with adequate protection and that all transfers of personal data outside the UK are done lawfully.
Where we transfer personal data outside of the UK to a country not determined by the UK or European Commission as providing an adequate level of protection for personal data, the transfers will be under an agreement which covers the UK requirements for the transfer of personal data outside the UK, such as the European Commission approved standard contractual clauses. The European Commission approved standard contractual clauses are available via their website.
Personal data held by us may be temporarily accessed by the following under controlled conditions:
- Third party organisations that provide business critical applications/functionality, data processing or IT services to us. We employ third parties to support us in providing standard business operations and in support of our services, including the provision of managing our internal IT systems. For example, providers of information technology infrastructure, server-based software service providers, website hosting and management, security and storage services. The servers powering and facilitating that infrastructure are securely located, and any third parties requiring access to our infrastructure where personal data is located are bound by GDPR and Data Protection Agreements.
- Third party organisations that otherwise assist us in providing goods, services or information.
- Professional advisers (such as Accountants, HR consultants and Auditors)
- Law enforcement or other government and regulatory agencies or to other third parties as required by, and in accordance with, applicable law or regulation.
Changes to this privacy statement
We recognise that transparency is an ongoing responsibility so we will keep this privacy statement under regular review.
This privacy statement was updated on 2 September 2021.
Data controller and contact information
Ashton Fire Limited is a data controller, registered as a limited company in England under the company registration number 12044770 and registration address at 30-32 Gildredge Road, Eastbourne, East Sussex BN21 4SH, United Kingdom.
If you have any questions about this privacy statement or how and why we process personal data, please contact:
The Managing Director
Postal address: Ashton Fire Limited, Chipko, Parslows Hillock, Princes Risborough, Buckinghamshire, HP27 0RJ, United Kingdom.
Phone: 0203 9956 600
Individuals’ rights and how to exercise them
Individuals have certain rights over their personal data and data controllers are responsible for fulfilling these rights.
- Access to personal data. You have a right of access to personal data held by us as a data controller. This right may be exercised by emailing us at firstname.lastname@example.org. We will aim to respond to any requests for information promptly, and in any event within the legally required time limits (currently 40 days).
- Amendment of personal data. To update personal data submitted to us, you may email us at email@example.com or, where appropriate, contact us via the relevant website registration page or by amending the personal details held on relevant applications with which you registered. When practically possible, once we are informed that any personal data processed by us is no longer accurate, we will make corrections (where appropriate) based on your updated information.
- Withdrawal of consent. Where we process personal data based on consent, individuals have a right to withdraw consent at any time. To withdraw consent to our processing of your personal data please email us at firstname.lastname@example.org
- Other data subject rights. This privacy statement is intended to provide information about what personal data we collect about you and how it is used. As well as rights of access and amendment referred to above, individuals may have other rights in relation to the personal data we hold, such as a right to erasure/deletion, to restrict or object to our processing of personal data and the right to data portability.
If you wish to exercise any of these rights, please send an email to email@example.com
In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data – for example, to allow us to deliver our services compliantly with legislation.
We hope that you won’t ever need to, but if you want to complain about our use of personal data, please send an email with the details of your complaint to our Managing Director at firstname.lastname@example.org. As a responsible company we will look into and respond to any complaints we receive.
You also have the right to lodge a complaint with the Information Commissioners Office (ICO), the UK’s data protection regulator. For further information on your rights and how to complain, please refer to the ICO website, call 0303 123 1113, email https://ico.org.uk/global/contact-us/email/ or in person at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.