GDPR Data Protection Policy
GDPR Data Protection Policy
Scope
Tom Blackwell Contractors & Plant Hire Ltd ("the Company", "we", "us") processes personal data relating to employees, customers, suppliers, and website visitors. This allows the Company to deliver plant hire services, monitor operational performance, maintain workplace health and safety, and comply with equipment manufacturer warranties.
This policy applies to all personal data handled by the Company in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
Data Protection Principles
The Company complies fully with the Data Protection Principles established under UK GDPR. All personal data handled by the Company is:
1. Processed fairly, lawfully, and transparently.
2. Collected for specified, explicit, and legitimate business purposes.
3. Adequate, relevant, and limited to what is necessary.
4. Accurate and kept up to date.
5. Held for no longer than necessary for the purposes for which it is processed.
6. Processed securely to protect against unauthorised access, loss, or damage.
7. Handled with full accountability across the organisation.
All employees, contractors, and staff working for or with the Company share responsibility for ensuring data is collected, stored, and handled in a safe and appropriate manner.
Lawful Bases for Processing
The Company processes personal data under the following legal grounds (UK GDPR Article 6):
· Contractual Necessity: Fulfilling plant hire agreements, trading terms, and processing customer or supplier orders.
· Legal Obligation: Meeting tax regulations, employment laws, and statutory health and safety requirements.
· Legitimate Interests: Managing business operations efficiently, maintaining site security, and tracking equipment warranties.
· Consent: Where required for non-essential website tracking or direct marketing communications.
Data Storage & Security
The Company takes all reasonable technical and organisational precautions to protect electronic and physical data repositories from unauthorised access, accidental loss, disclosure, or cyber threats. Electronic records are safeguarded using access controls, firewalls, and encryption. Physical documents are stored securely with restricted access.
Data Accuracy
The Company takes all reasonable steps to ensure personal data remains accurate and up to date. Staff are required to verify and update records regularly, particularly where data accuracy directly impacts operational safety or legal reporting.
Data Subject Rights & Subject Access Requests (SARs)
Individuals whose data is held by the Company have legal rights under UK GDPR, including the right to request access, correction, or deletion of their personal data, or to restrict or object to its processing.
· Submitting a Request: Email info@tomblackwell.co.uk (addressed to the Data Governance Team).
· Timeframe: The Company will respond to all valid requests without undue delay and at the latest within one calendar month of receipt.
· Identity Verification: To protect individual privacy, the Company may request proof of identity before releasing records. The response window begins once identity is confirmed.
· Fees: Requests are processed free of charge. However, the Company reserves the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive.
Disclosure & Sharing of Data
The Company will not sell, rent, share, or trade personal data for commercial purposes. Personal data is only disclosed to third parties to:
1. Support Business Activities: Vetted third-party service providers (e.g., IT support, cloud hosting, payroll, health and safety advisors).
2. Comply with Law & Legal Proceedings: Disclose records to government bodies or law enforcement agencies (e.g., HMRC, HSE, Police) without consent where permitted or required by law.
3. Protect Safety & Property: Prevent fraud or protect the legal rights, safety, and property of the Company, its clients, suppliers, or the public.
4. Facilitate Business Transfers: Assist in a potential sale, merger, acquisition, or restructuring of the Company.
Where data is processed outside the UK, the Company ensures standard contractual safeguards are in place to preserve data privacy.
Data Retention Summary
Personal data is retained only for as long as necessary:
· Trading & Customer Contracts: Retained for the duration of the agreement plus 6 years post-contract (to comply with UK tax law and legal claims).
· Employee Records: Retained for the duration of employment plus 6 years.
· Health & Safety Logs: Retained for up to 40 years where long-term safety regulations dictate.
· CCTV Footage: Overwritten automatically after 30 days unless required for an active investigation.
Website Data & Cookies
When visiting the Company website, technical, non-identifiable usage information may be collected via cookies (e.g., IP address, browser type, visit duration) to improve site performance and user experience. Visitors can manage or reject non-essential cookies via the website consent banner.
CCTV Systems
The Company operates CCTV cameras across its depots, premises, and fleet vehicles for crime prevention, asset protection, and safeguarding personnel. Clear signage is displayed in all monitored areas.
Right to Complain
If an individual has concerns about how their data is handled, they are encouraged to contact the Data Governance Team first. Individuals also have the right to lodge a complaint with the UK data protection regulator:
Information Commissioner’s Office (ICO)
· Website: www.ico.org.uk
· Helpline: 0303 123 1113
Policy Review
This policy is reviewed regularly by Senior Management to ensure ongoing compliance with UK GDPR and operational changes.
Effective Date: August 2026
