If you have any questions about this notice or how we use your information, please contact us:

Post: 44 Winifred Street, Fulwell, Sunderland, Tyne & Wear, SR6 9HD

Telephone: 07872 972204

Email: support@cornerstone-safetyltd.co.uk

Provide and improve products and services for clients

We collect or use the following information to provide and improve our health and safety consultancy services (including RAMS, risk assessments, training, toolbox talks, audits and competency work):

• Names and contact details

• Addresses (usually business addresses)

• Occupation / job title

• Third party information (for example site personnel or emergency contacts provided by clients)

• Transaction data (details of services purchased)

• Usage data (how you interact with our website and services)

• Information relating to compliments or complaints

• Records of meetings and decisions

• Website user information

• Training attendance records, competency information and site contact lists needed for RAMS or training delivery

Where relevant to an incident investigation or specific occupational health advice, we may also process limited health information. This is special category data and is handled with additional care.

Operation of client or customer accounts

We collect or use the following personal information to operate client accounts:

• Names and contact details

• Addresses

• Purchase or service history

• Account information, including registration details

• Information used for security purposes

• Marketing preferences

• Technical data, including information about browser and operating systems

Information updates or marketing purposes

We collect or use the following personal information for information updates or marketing (for example newsletters and service updates):

• Names and contact details

• Addresses (where relevant)

• Profile information (job title / company)

• Marketing preferences

• Purchase or account history

• Website user journey information

• IP addresses

• Newsletter subscription status

Comply with legal requirements

We collect or use the following personal information to comply with legal requirements:

• Name and contact information

• Identification documents (where required)

• Client account information

• Health and safety information (including incident investigation details, reports and accident book records)

• Any other personal information required to comply with legal obligations

We may also process health information as special category data where this is necessary for health and safety legal obligations (for example RIDDOR reporting or accident records).

Recruitment purposes

When we recruit staff or contractors we may collect:

• Contact details (name, address, telephone number, personal email address)

• Date of birth

• National Insurance number

• Copies of passports or other photo ID

• Employment history and references

• Education history and qualifications

• Right to work information

• Details of any criminal convictions where the role requires it (for example DBS checks)

• Security clearance details where required

Dealing with queries, complaints or claims

We collect or use the following personal information when dealing with queries, complaints or claims:

• Names and contact details

• Addresses

• Account information and service history

• Call recordings (if calls are recorded)

• Witness statements and contact details (where relevant)

• Photographs (where relevant to an investigation)

• Information relating to health and safety (including incident investigation details and reports)

• Correspondence, meeting notes and relevant project documents

Where a complaint or claim involves an injury or health-related matter, limited health information may be processed as special category data.

Internal quality improvement and service development

We collect or use limited personal information for internal administration, quality monitoring and service improvement:

• Names and contact details

• Occupation / job title

• Client accounts and records

• Records of meetings and decisions

• Website usage data and service feedback (anonymised or aggregated where possible)

Under UK data protection law we must have a lawful basis for collecting and using your personal information. The basis we rely on may affect the rights available to you.

Your data protection rights

You have the following rights:

• Right of access – you can ask for copies of your personal information

• Right to rectification – you can ask us to correct inaccurate or incomplete information

• Right to erasure – you can ask us to delete your personal information in certain circumstances

• Right to restriction of processing – you can ask us to limit how we use your information

• Right to object to processing – you can object to certain types of processing

• Right to data portability – you can ask us to transfer the information you gave us to another organisation or to you

• Right to withdraw consent – where we rely on consent, you can withdraw it at any time

If you make a request, we will respond without undue delay and within one month. To exercise any of these rights, please contact us using the details in section 1.

Our lawful bases

Provide and improve products and services for clients

Contract – we need to collect or use the information so we can enter into or carry out a contract with you.

Operation of client or customer accounts

Contract – we need to collect or use the information so we can enter into or carry out a contract with you.

Information updates or marketing purposes

Consent – we have your permission after giving you the relevant information. You can withdraw your consent at any time.

Comply with legal requirements

Legal obligation – we need to collect or use your information so we can comply with the law.

Recruitment purposes

Legitimate interests – we collect or use your information because it benefits you, our organisation or someone else, without causing an undue risk of harm.

Our legitimate interest is to assess applications and recruit suitable people to work with or for the business.

Dealing with queries, complaints or claims

Legitimate interests – we collect or use your information because it benefits you, our organisation or someone else, without causing an undue risk of harm.

Our legitimate interest is to respond properly to queries, investigate and resolve complaints, and defend or establish legal claims where necessary.

Legal obligation – where the matter involves regulatory or legal requirements.

Internal quality improvement and service development

Legitimate interests – we collect or use your information because it benefits you, our organisation or someone else, without causing an undue risk of harm.

Our legitimate interest is to administer the business effectively, monitor and improve the quality of our services, and support continuous improvement of our health and safety consultancy work.

• Directly from you (contact forms, emails, phone calls, meetings and LinkedIn messages)

• Publicly available sources (company websites, LinkedIn, Companies House and similar)

• Suppliers and service providers (who process data on our behalf)

• Third parties – for example clients providing site contact lists or personnel details for RAMS and training delivery, and professional referrals

• Legal bodies or professionals (such as solicitors) where relevant to a claim or legal matter

We keep personal information only for as long as necessary for the purposes set out in this notice.

Typical retention periods are:

• Website enquiries and contact form data: 12–24 months after the last contact

• Client project records (including site contacts and training records): duration of the contract plus 6 years

• Marketing and newsletter data: until you unsubscribe or withdraw consent

• Website analytics and technical data: 12–26 months

• Incident, accident and health & safety investigation records: as required by law (typically 3–6 years, or longer for serious incidents)

• Recruitment records: usually 6–12 months after the end of the recruitment process (or longer if required)

We may keep information longer if needed for legal claims, regulatory investigations, or where the law requires it. When we no longer need the information we delete or anonymise it securely.

Data processors

We use the following organisations to process personal information on our behalf:

Squarespace

Website hosting and form processing provider (United States). They process website visitor data, contact form submissions, IP addresses, analytics and cookie data.

Microsoft

Microsoft 365 (Outlook, OneDrive, Teams and related services). They process emails, contacts, calendar entries, documents and collaboration data. Data location depends on configuration; UK/EU residency is preferred where available.

Regus / IWG

Virtual office services including telephone answering and mail handling (United Kingdom). They process caller details, messages and mail content on our behalf.

Others we share personal information with

Professional or legal advisors (solicitors, insurers and accountants) in the United Kingdom, where necessary

• Regulatory authorities such as the Health and Safety Executive (HSE) and the Information Commissioner’s Office (ICO) when we are legally required to share information

• Clients or principal contractors in the United Kingdom where sharing site contact or training attendance details is necessary to deliver our contracted services

Where necessary, personal information may be transferred outside the UK. When this happens we ensure appropriate safeguards are in place in accordance with the UK GDPR.

Squarespace

Category: Website hosting and form processing provider

Country: United States

Transfer mechanism: The UK Extension to the EU-US Data Privacy Framework (adequacy arrangement).

Microsoft

Category: Cloud-based productivity and email services (Microsoft 365)

Country: United States (and other locations depending on configuration)

Transfer mechanism: The UK Extension to the EU-US Data Privacy Framework and/or the Addendum to the EU Standard Contractual Clauses.

For further information about these safeguards, or to request a copy, please contact us using the details in section 1.

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

‍Email: support@cornerstone-safetyltd.co.uk

Telephone: 07872 972204

Post: 44 Winifred Street, Fulwell, Sunderland, Tyne & Wear, SR6 9HD

If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the Information Commissioner’s Office (ICO):

‍Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

‍ ‍

Our website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit the site.

We use the following types of cookies:

 •  Essential cookies – required for the website to function properly (for example security and basic site features). These are always active.

•  Analytics / performance cookies – help us understand how visitors use the website (for example Squarespace Analytics). These are only set if you give consent.

•  Marketing cookies – only used if we run specific marketing campaigns (most of the time these are not used on this site).

Our cookie banner allows you to accept all cookies, reject non-essential cookies, or manage your preferences. You can change your mind at any time by clearing your browser cookies or using the cookie settings link on the website (where available).

You can also control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking essential cookies may affect how the website works.