Privacy Policy

Your privacy and data protection is very important to us. 

This policy will continue to be regularly reviewed and updated where necessary to take account of legislative or regulatory change or where we change any aspect of how we operate. 

Purpose Of The Privacy Notice 

The Privacy Notice is designed to let you know how we handle your personal data. This includes what you tell us about yourself and your choices about what marketing you want to receive from us. This Privacy Notice explains our approach, your privacy rights and how the law protects you. 

In accordance with the GDPR regulations, your personal data is defined as any information relating to you from which you can be identified. 

In this notice we set out: 

· How we will process any personal data that we collect from you 

· What it will be used for

· The information you are entitled to receive from us when we collect personal data 

· Your rights under the GDPR in respect of how we handle personal data. 

This Privacy Notice applies to any personal data which you may provide to us in person, over the telephone, by email, on our website (when available) and/or by post. Where you provide personal data about another person, this Privacy Notice will also apply to that data. 

Data Processing

Wherever we refer to “processing” of personal data in this Privacy Notice this includes any combination of the following activities: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. 

Website Data

This Privacy Notice applies to personal data collected by or on behalf of RACS through our website or by any other means. Our website may from time to time contain links to and from other websites. If you follow a link to any external website or alternatively reach our website from a third party website, these websites will have their own privacy policies and we do not accept any responsibility or liability for these policies. Please check their policies before you submit any personal data to these websites. 

Data Controller 

The data controller for your data is RACS. 

Data Protection Officer

We have a nominated Data Protection Officer (DPO) who has responsibility for setting the GDPR and data protection strategy, ensuring communications through the company of all aspects of our data protection and privacy commitments and acting as the liaison with the public in relation to data protection matters. 

Our DPO is our managing director John Gibb. You can contact our offices at RACS Ltd, Benson Way, Swansea Enterprise Park, Swansea, SA6 8RD, 01792 795222 / john@racs-ltd.co.uk 

Legitimate Basis For Processing Your Personal Data 

We require a proper reason under GDPR whenever we process your personal data. These reasons are: 

· To fulfil a contract we have with you or to take steps at your request prior to entering into a contract with you;

· To fulfil our employee support and records obligations;

· To fulfil our obligations in respect of recording subcontractor and supplier data such as qualifications and safety certifications;

· When it is our legal duty;

· When you consent to it.

A legitimate interest is when we have a business or commercial reason to process your personal data, but this must not unfairly go against your rights. 

Unless we have your explicit consent to do so, we will not process special categories of personal data revealing any of the following information about you: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation. 

You can choose not to give personal data. We may need to collect personal data by law, or under the terms of a contract and/or relationship that we have with you. If you choose not to give us this personal data, it may delay or prevent us from meeting our obligations. It may also mean that we cannot perform services, therefore we may need to cancel a product or service you have with us. 

Our Commitments 

We will: 

· Keep your personal data safe and only process it on a valid legal basis; 

· Keep our records up-to-date, deleting or correcting inaccurate personal data; 

· Delete your personal data after it is no longer needed for the purpose it was collected; 

· Not sell your personal data;

· Give you ways to manage and review your marketing choices at any time. 

Information We Collect And How We Collect It

We may collect personal data from you in the following ways: 

· When you make an enquiry about or use our services; 

· When you contact us in person, over the telephone, by email, by post or social media;

· When you apply or start employment with us, either directly or as a sub-contractor;

· In customer surveys;

· From payment and transaction data. 

We may collect your personal data from third parties including:

· Companies that introduce you to us; 

· Suppliers of materials and equipment; 

· Trade contractors; 

· Trade references;

· Public information sources such as Companies House; 

· Market researchers.
 

Our website uses ‘cookies’ - a small file of letters and numbers that are stored on your computer by the websites you visit. We use cookies to improve your user experience by enabling the website to ‘remember’ you, either for the duration of your visit (using a ‘session cookie’) or for repeat visits (using a ‘persistent cookie’), this enables us to show content relevant to you on your next visit. We also use cookies to track usage, analyse trends and gather information on how customers use our website so we can continue to improve it. Cookies are not linked to other personally identifiable information.
 

Protecting Your Information 

In accordance with the compliance requirements, we keep information only for as long as necessary for each purpose, eg customers, sub-contractors and suppliers and to meet statutory requirements in terms of employee and tax records. 

We will seek to keep your personal data secure by taking appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage.  Only authorised personnel will have access to your personal data.  All personal data is stored on secure servers and password protected desktop or laptop devices. Access is authorised and controlled by our Data Protection Officer. 

We will retain your personal data for no longer than the period of time needed for the purposes that we collected the data and for as long as we have legal grounds or obligations to retain it. 

There is no fixed period after which all record of your personal data will be deleted as this will depend on the circumstances and the purposes of the processing but we will take steps and maintain policies to keep retention under proper review. 

Your Right Of Access To The Data We Hold About You 

Under the GDPR data protection regulations, if we hold any information about you, you can request a copy of this. Should you wish to obtain a copy of the personal data that we hold on you, please contact our DPO by post or email as described earlier. If we do hold information, we will give you a description of this which could be over the phone or we can mail you a notification if requested . (Please note that we may need to verify your identity before providing this information). 

You have the following rights in relation to this data: 

· A right to request that we correct inaccurate or incomplete data (“Right to rectification”); 

· A right to request that we delete any of your personal data. (“Right to erasure” or “Right to be forgotten”) 

· A right to request that we stop or restrict any aspect of the processing of your personal data. (“Right to restriction of processing”).
 

Complaints 

Our objective is to work to the highest standards of security and confidentiality when collecting and using personal information. If you have any complaint regarding anything that may constitute a breach of this privacy policy, please contact us at the address listed above.

If we receive any complaint, we will acknowledge it within two days and will investigate it fully and contact you as quickly as possible with our findings. We aim to resolve any complaint within 10 working days, but we will communicate with you throughout our investigation to let you know progress and any queries. 

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) which is the UK supervisory authority for the processing of personal data. Further details are available on the ICO’s website www.ico.org.uk 

Changes To This Privacy Notice 

Any changes we may make to this Privacy Notice in the future will be emailed to our staff and specialist sub-contractors and will be posted publicly.

This Policy was last reviewed in January 2023.