1. Data Controller and Data Processor Information

Data Controller: Milne Safety
9 Philip Ford Way, Silfield Road, Wymondham, NR18 9AQ

Email: sales@milnesafety.co.uk

Phone: 01603 607093

Data Protection Officer (DPO): David Field

We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions or concerns about this policy or how we handle your data, please contact our DPO using the contact details above.

 

2. What Information We Collect

We may collect, use, store, and transfer different kinds of personal data about you. This includes, but is not limited to:

Personal Identification Information:

• First name, last name, username or similar identifier
• Postal address, email address, and telephone numbers
• Payment details, including card information (stored securely by third-party processors) and transaction history

Technical Data:

• Internet Protocol (IP) address
• Login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Site

Usage Data:

• Information about how you use our website, services, and online training and booking training places
• Referrals and URLs that brought you to our Site

Marketing and Communication Data:

• Your preferences in receiving marketing communications from us and your communication preferences
• Surveys, promotions, or feedback data

 

3. How We Collect Your Data

We use different methods to collect data from and about you, including:

Direct Interactions:

• You may provide us with your personal details, subscribe to our newsletter, or communicate with us through the Site or by phone and email.

Automated Technologies or Interactions:

• As you interact with our Site, we may automatically collect technical data about your equipment, browsing actions, and usage patterns. This data is collected via cookies, server logs, and other similar technologies.

Third Parties:

• We may receive data about you from third-party booking platforms, analytics providers, and payment processors when you engage their services through our Site.

 

4. How We Use Your Data

We will only use your personal data when the law allows us to. Most commonly, we will use your data in the following ways:

4.1. To Fulfill a Contractual Obligation

• To process and manage your online booking of courses and online training
• To manage payments, fees, and charges, including fraud prevention

4.2. To Comply with a Legal Obligation

• To maintain accurate financial records for tax, legal, and compliance purposes
• To respond to regulatory or legal inquiries
• To cooperate with law enforcement authorities

4.3. For Legitimate Interests

We process your personal data where necessary for our legitimate interests and where your rights do not override those interests. This includes:

• Managing and enhancing our services, such as website maintenance and testing
• Marketing to current customers and analyzing feedback to improve our services
• Security and fraud prevention

4.4. With Your Consent

We may also process your data with your explicit consent for:

• Sending marketing communications about our services, new products, or offers

 

5. Legal Basis for Processing

Our legal basis for collecting and using the personal data described in this privacy policy will depend on the data in question and the specific context in which we collect it. However, we will normally collect personal data from you only:

• Where we have your consent to do so,
• Where we need the personal data to perform a contract with you, or
• Where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms.

 

6. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Booking and transaction data will be retained for 7 years in accordance with financial and tax reporting laws.
• Marketing data will be retained until you opt out of receiving further communications.
• Technical data is generally retained for a maximum of 26 months unless anonymized.

Once the retention period expires, we will securely delete or anonymize your data.

 

7. Your GDPR Rights

Under GDPR, you have several rights concerning your personal data. These include:

7.1. Right to Access

You have the right to request access to the personal data we hold about you. This is known as a Subject Access Request (SAR). To make a SAR, please contact us at sales@milnesafety.co.uk with the subject line “Subject Access Request.”

7.2. Right to Rectification

You have the right to request corrections of any inaccurate or incomplete personal data we hold about you.

7.3. Right to Erasure (Right to be Forgotten)

You have the right to request the deletion of your personal data where there is no legitimate reason for us to continue processing it.

7.4. Right to Restriction of Processing

You have the right to request the restriction of processing your personal data in specific circumstances, such as when you contest its accuracy or when the processing is unlawful.

7.5. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transfer it to another data controller.

7.6. Right to Object

You have the right to object to the processing of your data where we rely on legitimate interests or when we process it for direct marketing purposes.

7.7. Right to Withdraw Consent

If we process your data based on your consent, you have the right to withdraw that consent at any time.

To exercise any of your rights under GDPR, please contact us at sales@milnesafety.co.uk. We will respond to your request within 30 days.

 

8. Data Security

We are committed to ensuring the security of your personal data. To prevent unauthorized access or disclosure, we have implemented appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect.

These measures include:

• Encryption of sensitive data
• Secure storage on protected servers
• Regular software updates and vulnerability testing
• Access controls and authentication procedures for personnel accessing personal data

In the event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by law.

 

9. Sharing and Transfer of Data

We may share your personal data with third parties under the following circumstances:

• Service Providers: We may share your data with trusted service providers that assist us in delivering our services, including payment processors, hosting services, and customer support platforms.
• Legal Obligations: We may disclose your data where required by law or to protect our legal rights.
• Business Transfers: If we are involved in a merger, acquisition, or asset sale, your data may be transferred as part of the business assets.

We ensure that all third parties that process your personal data comply with GDPR standards, including appropriate contractual agreements.

 

10. Cookies and Tracking Technologies

Our Site uses cookies and similar tracking technologies to enhance your browsing experience. Cookies are small text files stored on your device when you visit our Site, which enable us to recognize your browser and capture certain information.

 

11. Marketing and Communications

We will only send you marketing communications if you have explicitly consented to receive such messages. You may opt out of receiving marketing messages at any time by following the unsubscribe link in the emails we send or by contacting us directly at sales@milnesafety.co.uk

 

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal obligations. The updated policy will be posted on this page, and where appropriate. We encourage you to review this policy periodically to stay informed about how we are protecting your information.

 

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise any of your GDPR rights, please contact us:

Email: sale@milnesafety.co.uk

Postal Address: 9 Philip Ford Way, Silfield Road, Wymondham, NR18 9AQ

Phone: 01953 607093

 

14. How to Make a Subject Access Request (SAR)

Under the General Data Protection Regulation (GDPR), you have the right to request access to the personal data we hold about you. This is known as a Subject Access Request (SAR). We are committed to responding to any legitimate requests for access to your data in a timely manner.

How to Submit a Subject Access Request

To submit a SAR, you can contact us using the following methods:

• Email: sale@milnesafety.co.uk
• Postal Address: 9 Philip Ford Way, Silfield Road, Wymondham, NR18 9AQ

When submitting a SAR, please provide the following information to help us identify the personal data you’re requesting:

1. Your Full Name
2. Your Contact Details (email or postal address for correspondence)
3. Details of the Specific Information You Are Requesting (e.g., categories of data, specific transactions, communications, or dates if applicable)
4. Proof of Identity: To ensure the security of your data, we may require proof of identity before processing your request. Acceptable forms of ID include a photocopy or scanned copy of your passport, driving license, or a recent utility bill.

What Happens Next?

Once we receive your request and confirm your identity, we will:

• Acknowledge receipt of your request within 7 days.
• Respond to your SAR within 30 calendar days from the date of your request, unless the request is complex or involves numerous records, in which case we may extend the deadline by a further 60 days. If this is the case, we will inform you within the initial 30-day period.
• Provide you with a copy of the personal data we hold, and information about how it is being used, including:
• The categories of personal data
• The purposes for which the data is being processed
• The recipients to whom the data has been disclosed (if any)
• How long we intend to retain the data
• Information about your rights regarding your data

Fees

We will not charge a fee for processing a SAR unless the request is manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or refuse to comply with the request. If a fee applies, we will notify you and request payment before fulfilling your request.

Exemptions

There are certain situations where we may be unable to fully comply with your request, such as when your data involves personal data about another individual, or if disclosing the information would compromise the rights of another person. In these cases, we will explain the reasons for our inability to fulfill the request.