Privacy notice.

This is the Privacy Notice for Keltbray Group Limited and its subsidiaries (together ‘Keltbray’ or ‘Keltbray Group’) issued in accordance with the General Data Protection Regulation (GDPR) – please read it carefully.

Introduction

This Privacy Notice is to let you know how we handle your personal data. This includes what you tell us about yourself and your choices about what marketing you want to receive from us. This Privacy Notice explains our approach, your privacy rights and how the law protects you.

Your personal data is any information relating to you from which you can be identified. This notice sets out:

how we will process any personal data that we collect from you and what it will be used for.
Whether there are third-party recipients of your personal information
Whether we do automated decision-making or profiling
the information that you are entitled to receive from us when we collect your personal data; and
your rights under the General Data Protection Regulation (GDPR) in connection with the way we handle your personal data.

Wherever we refer to “processing” of personal data in this Privacy Notice, this includes any combination of the following activities: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

This Privacy Notice only applies to personal data collected by or on behalf of Keltbray via the company’s website or by any other means. The Keltbray website may, from time to time, contain links to and from other websites (partner networks, advertisers, and affiliates). If you follow a link to any external website or alternatively reach our website from a third-party website, please be aware that these websites will have their own privacy policies, separate from ours, and we, therefore, do not accept any responsibility or liability for these policies. Please check their policies before you submit any personal data to these websites.

Our commitment

We commit to:

keeping your personal data safe and only processing it on a valid legal basis.
keeping our records up-to-date and correcting inaccurate personal data where required.
deleting your personal data after it is no longer needed for the purpose you collected it for.
assisting you with obtaining access to your personal data.
not selling your personal data, and
giving you ways to manage and review your marketing choices at any time

Who We Are

Keltbray Group Limited, the company responsible for your personal data, is the Data Controller. If different from Keltbray Group Limited, we will let you know which company in the Keltbray Group you have a relationship with when you take out a product or service with us.

You can contact our Data Protection Officer (DPO) at:

Data Protection Officer
Keltbray
Ferry Works,
Summer Road,
Thame Ditton,
Surrey, England.
KT7 0QJ
Email: dataprotection [at] keltbray.com

Lawful basis for processing your personal data

In compliance with the GDPR, we must have a legitimate reason to process your personal data or share it with others outside the Keltbray Group.

These reasons are:

to fulfil a contract we have with you or to take steps at your request prior to entering into a contract with you;
when it is our legal duty.
when it is in our legitimate interest or the legitimate interest of a third party, except where such interests are overridden by your interests or your fundamental rights or freedoms; or
when you consent to it.

A ‘legitimate interest’ in this context is when we have a business or commercial reason to process your personal data, but this must not unfairly go against your rights. If we rely on our legitimate interest, we will tell you what that is.

The section below lists all the ways that we may process your personal data, and which of the lawful bases we rely on to do so.

Unless we have your explicit consent to do so, we will not process special categories of personal data revealing any of the following information about you: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation.

Information we collect and how we collect it

We may collect personal data from you in the following ways:

when you make an enquiry, register on our website and consent to our use of cookies, sign up for alerts on our website, or sign up for another service such as webcasts on our website.
when you contact us in person, over the telephone, by email, by post or via social media.
when you apply for our products and services.
when you apply for a job
when you are contracted by us to provide a service.
in customer surveys.
when you use our services
payment and transaction data.

We may collect your personal data from third parties we work with, including:

companies that introduce you to us.
suppliers of materials and equipment.
trade contractors.
social networks.
payroll service providers.
analytics providers.
public information sources such as Companies House.
agents working on our behalf.
market researchers; and
government and law enforcement agencies.

Where you provide personal data about another person, this Privacy Notice will also apply to that data, so please share it with that person. You can choose not to give personal data. We may need to collect personal data by law or under the terms of a contract and/ or relationship that we have with you. If you choose not to give us this personal data, it may delay or prevent us from meeting our obligations. It may also mean that we cannot perform services, so we may cancel a product or service you have with us.

Our website uses ‘cookies’ - a small file of letters and numbers that are stored on your computer by the websites you visit. We use cookies to improve your user experience by enabling the website to ‘remember’ you, either for the duration of your visit (using a ‘session cookie’) or for repeat visits (using a ‘persistent cookie’), this enables us to show content relevant to you on your next visit. We also use cookies to track usage, analyse trends and gather information on how customers use our website, which allows us to improve our website. Cookies are not linked to other personally identifiable information. Detailed information about our cookies policy is on our website.

The type of information we may ask you to provide about yourself, and therefore collect and process, is dependent upon the relationship that we have with you as a client, customer and/or supplier. This includes, but is not limited to:

contact details such as your name, address, contact telephone number (mobile and landline) and email address.

the nature of your enquiry.
contractual details about the products or services we provide to you.
locational data we get about where you are, such as data that may come from your mobile phone or the address where you connect a computer to the internet.
behavioural details about how you use our products and services.
technical details on the devices and technology you use.
communications: what we learn about you from letters, emails, and conversations between us.
social relationships: your family, friends, and other relationships.
open data and public record: details about you that are in public records, such as the electoral register, and information about you that is openly available on the internet.
usage data: other data about how you use our products and services.
documentary data: details about you that are stored in documents in different formats, or copies of them. This could include things like your passport, driver’s licence, or birth certificate; and
health information which may help us safeguard our employees, contractors and the wider public where appropriate.

We will only collect personal data which is needed to perform our services to you, and will not knowingly process your data outside of the reason that it was originally collected for.

Please note that we may require this information to be able to respond to your enquiry or to provide our services or marketing information to you. You can, however, at any time tell us to change or remove any personal data or to stop or restrict the processing of your personal data.

How we use your personal data

We may use the personal data collected/provided by you to:

ensure that content from our website is displayed in the most effective way for you and for your computer/device.
respond to your enquiry.
send you information about similar products and services.
notify you about changes to our services.
carry out analysis to make improvements to our website and/or services.
measure or understand the effectiveness of advertising we deliver to you and others.
monitor customer service, including processing customer satisfaction surveys.
keep our records up to date.
develop and manage products and services, and what we charge for them.
define types of customers for new products or services.
test new products.
develop and carry out marketing activities.
study how our customers use our products and services.
develop and manage our brands.
manage how we work with other companies that provide services to our customers and us.
make and manage customer payments.
collect and recover money that is owed to us.
comply with laws and regulations that apply to us.
detect, investigate, report, and seek to prevent financial crime and fraud.
manage risk for our customers and us.
respond to complaints and seek to resolve them; and to
run our business in an efficient and proper way. This includes managing our financial position, business capability, planning, communications, corporate governance, and audit.
ensure the physical and mental well-being of our employees and contracted third parties.

Our lawful basis under the GDPR for each of these purposes are as follows:

Lawful basis	Statement number (see above)
Legal Obligation	8, 18, 19
Legitimate interest	1 – 22
Consent	2, 12, 18, 21, 23

Where we have stated above that our grounds are that we have your consent, we will understand your consent to have been given when you expressly accept these terms. You can withhold or withdraw your consent at any time using the contact details for the DPO provided in this notice.

Where we don’t have your express consent, we may base our processing of your personal data on any other basis that applies.

If we intend to use your personal data for any purpose not stated above, we will first notify you of the intended use and the legal grounds.

You can choose which channel you’d like us to contact you on, for marketing purposes and with information regarding our products and services at the point this information is collected – this can be done by checking or unchecking the relevant boxes as directed. If you no longer wish for us to communicate with you, you can follow the instructions on how to unsubscribe from emails, letters or texts by following the details within those communications to you. Alternatively, you can contact us by post or email at the address in Section 3 above.

How long we keep your data

We will retain your personal data for no longer than the period of time needed for the purposes for which we collected the data and for as long as we have legal grounds to retain it. There is no fixed period after which all records of your personal data will be deleted, as this will depend on the circumstances and the purposes of the processing, but we will take steps and maintain policies to keep retention under proper review.

For further information on how long we keep your data, you can contact our Data Protection Officer (DPO) at:

Data Protection Officer
Keltbray
Ferry Works,
Summer Road,
Thame Ditton,
Surrey, England.
KT7 0QJ
Email: dataprotection [at] keltbray.com

Sharing your personal data

We may disclose your personal data to third parties in certain circumstances, but we will not sell, rent, or trade your personal data.

We may transfer your data outside the UK and the European Economic Area (EEA); however, we will not do this without your permission. Some countries have adequate protection of personal data under their laws but where this is not the case, we will be responsible for ensuring that appropriate security and privacy safeguards are in place, either by requiring the recipient to have signed up to a recognised international framework of data protection or by contractual obligations.

Where relevant, we may give third-party providers who supply services to us, or who process personal data on our behalf, access to your personal data in order to help us to process it for the purposes set out above. When doing so, we will ask them to confirm that their security measures are adequate to protect your personal data.

Within the purposes set out above, we may share your personal data with the following third parties:

With your consent, we will also pass your personal data on to third parties, for example, if you ask us to put you in contact with professional advisors.
We may disclose your personal data to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our contracts with you or protect our rights, property, or our safety and/or the safety of our customers, or others.
We may need to confirm your identity before we provide products or services to you or your business.
We may also share your personal information as needed to help detect fraud and money-laundering risks. We may use solicitors and other advisers for these purposes. We may allow law enforcement agencies to access your personal data. This is to support their duty to detect, investigate, prevent, and prosecute crime.
We may disclose your personal data to third parties in the event that we sell any part of our business, in which case we may disclose your personal data to the prospective buyer of such business or assets. If any part of our business is acquired by a third party, personal data held by us may be transferred.

Automated decisions

We do not carry out automated decision-making or profiling.

Protecting your Information

We will seek to keep your personal data secure by taking appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

Only authorised personnel and third parties will have access to your personal data.

If provided with the ability to log on to one of our websites, it is your responsibility to protect your login details. You must treat these as confidential and must not share or disclose your login details to any other party.

Changes to this Privacy Notice

Any changes we may make to this Privacy Notice in the future will be posted on this website and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to this Privacy Notice.

Your Data Protection Rights

You have the following rights under the GDPR. The rights available to you depend on our reason for processing your data.

Your right of access

You have the right to access your personal data, including us providing to you, without charge, a copy (which may be in electronic form) of any of your personal data that we are processing or that third parties are processing on our behalf.

We will also provide you, if you request it, the following information:

the purposes of the processing.
the categories of personal data concerned.
the recipients or categories of recipients to whom the personal data have been or will be disclosed, including recipients in countries outside the UK or international organisation;
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
if the personal data was not collected from you, any information that is available to us and the source of it;
whether the personal data has been subject to automated decision-making, including profiling, and, if so, information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Requests for this information or a copy of your personal data should be in writing, enclosing proof of identification such as a copy of your passport, driving licence or other documentation confirming your name and address (for example, a utility bill) to be addressed to:

Data Protection Officer
Keltbray
Ferry Works,
Summer Road,
Thame Ditton,
Surrey, England.
KT7 0QJ
Email: dataprotection [at] keltbray.com

Your right to rectification

You have the right to request that we correct any inaccurate or incomplete data.

Your right to erasure

You have the right to request that we delete any of your personal data. In certain circumstances, we may wish to retain data, and if GDPR allows us to do so, we will inform you of our grounds.

Your right to restriction of processing

You have the right to request that we stop or restrict any aspect of the processing of your personal data. In certain circumstances, we may wish to continue, and if GDPR allows us to do so, we will inform you of our grounds.

In each case, we will tell you what action we are taking, and we will also notify any third party to whom the data has been disclosed. Your request should be made to the address above

Automated processing and profiling

You have the following rights under GDPR over automated decisions and profiling.

You can ask that we do not make our decision based on the automated score alone.
You can object to an automated decision and ask that a person review it.
You can object to the use of your personal data in profiling or direct marketing.
Your request should be made to the address above.

Your right to data portability

You have the right to receive from us the personal data that you have given us in a structured, commonly used, and machine-readable format (“Right to data portability”) and/or to have the data sent by us directly to another party. Please note that this right only applies in certain circumstances, which are when we hold the data on grounds of your consent or to perform a contract with you or for steps preparatory to such a contract, and we were processing that data by automated means.

Your request should be made to the address above.

Complaints

Please let us know if you are unhappy with how we have processed your personal data. You can contact us by contacting our Data Protection Officer.

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), which is the UK Supervisory Authority for the processing of personal data. Further details are available on the ICO’s website https://ico.org.uk/

Alternatively, you can write to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113

Enquiries and to exercise your rights

If you have any questions or want more details about how we process your personal data, or if you wish to exercise any of your rights, you can contact us by writing to the Data Protection Officer at the address given above.