POLICY STATEMENT
Cheshire Mouldings & Woodturnings Ltd (“the Company”) is committed to protecting the privacy and personal data of its customers, suppliers, employees, contractors and other stakeholders.
The Company recognises its obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other applicable data protection legislation.
This policy establishes the principles and procedures for the lawful collection, use, storage, retention and disposal of personal data processed by the Company in the course of its business activities.
SCOPE
This policy applies to:
- All employees, directors, agency workers and contractors.
- All personal data processed by the Company.
- All Company systems, equipment, software and records containing personal data.
- Personal data held in electronic or paper format.
DEFINITIONS
Personal Data
Any information relating to an identified or identifiable natural person.
Examples include:
- Name
- Address
- Telephone number
- Email address
- Job title
- IP address
- Online identifiers
- Customer account information
Processing
Any operation performed on personal data including:
- Collection
- Recording
- Storage
- Use
- Disclosure
- Transfer
- Deletion
- Destruction
Data Subject
The individual whose personal data is being processed.
DATA PROTECTION PRINCIPLES
The Company shall ensure that personal data is:
- Processed Lawfully, Fairly and Transparently
Individuals shall be informed how their personal data is used through privacy notices and other communications.
- Collected for Specified Purposes
Data will only be collected for legitimate business purposes and will not be used for incompatible purposes.
- Adequate, Relevant and Limited
Only the personal data necessary for the intended purpose will be collected.
- Accurate and Up to Date
Reasonable steps will be taken to ensure information is accurate and corrected when necessary.
- Kept No Longer Than Necessary
Personal data will be retained only for as long as required for legal, contractual or operational purposes.
- Processed Securely
Appropriate technical and organisational measures will be implemented to protect personal data.
- Accountable
The Company will be able to demonstrate compliance with data protection legislation.
PERSONAL DATA COLLECTED
The Company may collect personal data through:
Company Website
Including:
- Contact forms
- Account registrations
- Product enquiries
- Newsletter subscriptions
- Website analytics and cookies
Customer Orders
Including:
- Contact names
- Business addresses
- Telephone numbers
- Email addresses
- Delivery information
Invoicing and Accounts
Including:
- Customer contact details
- Financial and payment information
- Credit account information
Email Communications
Including:
- Customer enquiries
- Supplier communications
- Sales and technical support correspondence
Supplier Relationships
Including:
- Contact names
- Business contact details
- Contractual information
LEGAL BASIS FOR PROCESSING
The Company processes personal data under one or more of the following lawful bases:
Contract
Where processing is necessary to:
- Supply products
- Fulfil customer orders
- Manage supplier relationships
- Administer accounts
Legitimate Interests
Where processing is necessary for:
- Customer service
- Business administration
- Fraud prevention
- Website operation
- Business development
Legal Obligation
Where processing is required to comply with:
- Tax legislation
- Financial reporting requirements
- Employment legislation
- Regulatory obligations
Consent
Where required, such as:
- Marketing communications
- Certain website cookies
Consent may be withdrawn at any time.
USE OF PERSONAL DATA
Personal data may be used to:
- Process and fulfil customer orders.
- Arrange deliveries.
- Provide quotations.
- Manage customer accounts.
- Process payments and invoices.
- Respond to enquiries.
- Improve products and services.
- Maintain website functionality.
- Comply with legal and regulatory requirements.
- Conduct marketing activities where lawful.
The Company will not sell personal data to third parties.
SHARING PERSONAL DATA
Personal data may be shared with:
Service Providers
Including:
- IT support providers
- Cloud hosting providers
- Website providers
- Software providers
Delivery and Logistics Providers
For the fulfilment of customer orders.
Professional Advisers
Including:
- Accountants
- Auditors
- Legal advisers
- Insurance providers
Government Authorities
Where disclosure is required by law.
All third parties processing personal data on behalf of the Company shall be required to implement appropriate security measures and comply with applicable data protection legislation.
INTERNATIONAL DATA TRANSFERS
The Company will not transfer personal data outside the United Kingdom unless appropriate safeguards are in place, including:
- Adequacy regulations;
- Standard Contractual Clauses; or
- Other lawful transfer mechanisms permitted by UK GDPR.
DATA SECURITY
The Company shall implement appropriate technical and organisational measures including:
- Password-protected systems.
- Access controls.
- User permissions.
- Anti-virus and malware protection.
- Firewalls and network security.
- Secure backups.
- Secure disposal of records.
- Staff awareness and training.
Access to personal data shall be restricted to authorised personnel who require it for legitimate business purposes.
DATA RETENTION
Personal data shall be retained only for as long as necessary.
Typical retention periods include:
| Record Type | Retention Period |
| Customer orders and invoices | 7 years |
| Financial records | 7 years |
| Supplier records | 7 years after relationship ends |
| Marketing consent records | Duration of consent plus 2 years |
| Website enquiry records | 2 years |
| Employee records | In accordance with HR retention schedules |
Records will be securely destroyed when no longer required.
DATA SUBJECT RIGHTS
Individuals have the right to:
- Be informed about how their data is used.
- Access their personal data.
- Request correction of inaccurate data.
- Request erasure of data where applicable.
- Restrict processing.
- Object to processing.
- Data portability where applicable.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with the Information Commissioner’s Office (ICO).
Requests should be submitted to the Company using the contact details provided below.
DATA BREACH MANAGEMENT
Any actual or suspected personal data breach must be reported immediately to management.
The Company shall:
- Investigate the breach.
- Assess risks to individuals.
- Take steps to contain and recover data.
- Notify the ICO where legally required.
- Notify affected individuals where required.
- Record all breaches and corrective actions.
CONTACT DETAILS
Data Protection Contact:
Cheshire Mouldings & Woodturnings Ltd
Unit 4
Abbotsfield Road
Sutton
St Helens
WA9 4HU
Tel: +44 (0) 1744 811 475
Email: GDPR@cheshiremouldings.co.uk
Individuals wishing to exercise their data protection rights should contact the Company using the details above.