Privacy Policy

1. Purpose and Scope

This Privacy Policy describes how Sustainable Facilities Management Ltd (“we”, “us”, “our”) collects, processes, stores, shares and protects personal data during routine business operations. It applies to all personal data processed through our websites, enquiries, quotations, customer and supplier relationships, marketing communications, and operational interactions unless a more specific privacy notice applies.

This document forms part of our ISO‑aligned management system and supports compliance with:

• ISO 45001:2018 – OH&S documented information, worker participation, legal compliance
• ISO 9001:2015 – customer, supplier and stakeholder information management
• ISO 27001:2022 – information security, confidentiality, integrity and availability
• UK GDPR & Data Protection Act 2018

2. Data Controller

Sustainable Facilities Management Ltd is the data controller responsible for your personal data.

A designated privacy lead may be appointed; current details are available in the latest controlled version of this notice.

3. Personal Data We Collect

We collect and process the following categories of personal data:

• Identity Data: first name, last name, title
• Contact Data: email, telephone, postal address, next‑of‑kin details
• Financial Data: bank name, address, sort code, account number
• Transactional Data: purchases, payments, refunds
• Technical Data: IP address, device identifiers, website usage
• Marketing Data: communication preferences, subscription preferences
• Qualification Data: job titles, industry certifications, accreditations

4. How We Collect Personal Data

• Direct interactions: forms, emails, calls, applications, subscription requests
• Automated interactions: cookies, website analytics, technical logs
• Supplier/contractor onboarding: qualification and competency information
• Operational service delivery: customer and supplier communications

5. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Performance of a Contract
• Legitimate Interests (balanced against your rights)
• Legal or Regulatory Obligations
• Consent (only for third‑party marketing communications)

6. Purposes for Processing

All purposes are explicitly linked to ISO requirements for documented information, operational control, and legal compliance.

7. Data Sharing and Third Parties

We share personal data only with authorised parties who must process it securely and in accordance with our instructions:

• Employees with a legitimate business need
• UK‑based IT, HR, payroll and administrative service providers
• Professional advisers (legal, banking, insurance, audit)
• HMRC, regulators and authorities
• Approved subcontractors and suppliers
• Business transferees in the event of sale or merger

International transfers are safeguarded using legally required mechanisms.

8. Data Security (ISO 27001‑Aligned)

We implement organisational and technical controls proportionate to risk, including:

• Access control and role‑based permissions
• Secure storage and encryption where appropriate
• Incident response and breach management procedures
• Regular audits, reviews and continual improvement
• Confidentiality obligations for all personnel and contractors

9. Data Retention

We retain personal data only as long as necessary for the purpose collected and in line with legal, tax and operational requirements.

Data may be anonymised for statistical use.

10. Your Rights

You have the right to:

• Access your personal data
• Request correction or deletion
• Withdraw consent
• Request restriction or objection
• Request data portability
• Lodge a complaint with the ICO

Identity verification may be required.

11. Changes to This Notice

This notice may be updated following:

• Changes in processing activities
• Complaints or breaches
• Audit findings
• Website or system changes

12. Complaints and Queries

Contact us first using the details above.

If unresolved, you may contact the Information Commissioner’s Office.

13. Continual Improvement

The policy shall be reviewed:

• Annually
• After significant organisational or legal changes

Corrective actions shall be implemented and verified.

Approved changes will be communicated to workers and supervisors.