We are committed to safeguarding the privacy of our website visitors; this policy sets out how we will treat your personal information.
Facilities Fire Protection Ltd and all its associated companies are compliant with the data protection regulations and Data Protection Act, continually monitor and update policies and processes to ensure continued compliance with Data Protection Legislation and Regulations including the General Data Protection Regulations (GDPR) and Data Protection Act 1998/2018. As part of the various services and products we offer our customers, and this includes system maintenance, we may hold or have access to data that can identify individuals in order to be able to provide our customers with the services, products and support that is agreed through our contracts. In all instances, access to such data is controlled and limited to specific individuals.
Personal data is held for the purposes of fire protection systems and related products. The personal data held is obtained in support of contractual arrangements and is necessary under the ‘legitimate interests’ pursued by the controller (Facilities Fire Protection) as defined in article 6.1 of the GDPR. The facility to opt out of marketing communications remains, but excludes operational or pricing communications.
Nature of processing
Facilities Fire Protection does not undertake any automated decision making as defined by article 22 of the GDPR. Data will be processed internally for the purposes of objective and permission based marketing.
Duration of processing and retention
Facilities Fire Protection will maintain personal data for the duration of contracts during the provision of fire protection services and products. Thereafter, the data will be held for a ‘reasonable’ period, depending on the nature of the relationship with the customer. The data will be deleted when the retention of that data can no longer be justified under the provisions of the Data Protection Act and is not overruled by competing legislation or regulations. The terms against which data are held vary and are dependent on the business cycle, regulations and legislation.
Requests for information
Persons whose data are held by Facilities Fire Protection and its associated companies may request their own data. These are called subject access requests. These should be submitted in writing to our postal address or via email to firstname.lastname@example.org. We will need to verify the identity of the requestor and in the unlikely event there is substantial cost to Facilities Fire Protection in terms of retrieving the data, we may charge a maximum of £10. The regulations require us to respond within 28 days of the request.
Deletion of information
Persons whose data are held by Facilities Fire Protection and its associated companies may request that their data be permanently deleted as stated in Data Protection Regulations and Data Protection Legislation, and such requests will be complied with as soon as practicable where a customer no longer has a relationship with Facilities Fire Protection or its associated companies. Where a requestor continues to have a business relationship with Facilities Fire Protection or its associated companies, we may need to ensure that the requestor’s details are replaced with those of an alternative contact to enable the continued effective management of our relationship with our customers and partners. Any such requests should be submitted in writing to our postal address or via email to email@example.com. We will need to verify the identity of the requestor in all circumstances.
Types of Personal Data
The personal data held will include: Name, Position, Telephone Number(s), email address. No ‘sensitive data’ (as defined by the Data Protection Act) or ‘special categories of personal data’ (as defined by the GDPR) are held against any current, former or prospective (wholesale only) customers.
Categories of Data Subject
The data subjects whose data may be held by Facilities Fire Protection is restricted to that of existing, former or prospective customers and associated contacts. These data fall under the category of ‘personal data’ and do not include any ‘sensitive data’ (as defined by the Data Protection Act) or ‘special categories of personal data’ (as defined by the GDPR).
There is no routine data sharing of person identifiable data. Where exceptions exist, these concern the management of systems where providers require sample data for the purposes of de-bugging systems or processes. In these circumstances we would implement a formal data sharing agreement to ensure the transaction is handled for the purposes of the ‘system fix’ and to obtain a legal platform to ensure that access, security and disposal of the data adheres to our requirements in terms of current and future Data Protection legislation.
In terms of transactional data (non person identifiable data), for example direct debit data, there is a robust data sharing agreement and corresponding process for exchanging data with all suppliers. No person identifiable data is exchanged or transferred routinely.
The majority of our data is hosted in secure cloud/data centre environments accessible only through VPN. Our data is held within the EU, and where practicable these data will be held in a UK based environment. Some data is held in secure local servers with the relevant backup and security protocols. Access to all systems is managed through robust permission structures based on the requirement of the individual’s role, and these are regularly reviewed.
Out of hours access
There are specific roles within our organisation that require that ‘specified individuals’ have access to data outside of operational hours. For example, when there is a system fault. In these circumstances, access is either on our premises or is governed by the same security measures outlined in data hosting.
Access to customer’s data for the provision of maintenance and support services
Where Facilities Fire Protection has installed a fire system or products, we will retain a copy of the installation records and this will include the Compliance Certification Document that contains the user’s information for the system being installed. The data we hold as part of the installation records will not be updated where the data in the customer’s fire system is changed and updated.