Privacy Policy

Who are we?

Eryri Consulting Limited, registered in England and Wales under company number 10395213, is the controller responsible for personal information described in this policy. References to “we”, “us”, “our” and “the Company” mean Eryri Consulting Limited.

We provide professional consultancy specialising in health and safety, ISO standards and compliance with the Construction (Design and Management) Regulations. We recognise the importance of privacy and may revise our practices and this notice as our services evolve.

Personal data means information relating to a person who is identified or can be identified, whether directly or indirectly, including through identifiers such as names, identification numbers, online identifiers or location information.

For questions about how we handle your personal information, please contact us. The source policy describes using the website and services as consent to processing; however, processing is also explained below in terms of contracts, legitimate interests and legal obligations.

Definitions

Personal data

Information relating to an identified or identifiable individual.

Processing

Any action or series of actions carried out on personal data.

Data subject

An individual whose personal information is processed.

Child

For the terminology in the original policy, an individual younger than 16.

We / us

Eryri Consulting Limited.

Data protection principles

Our stated approach to processing personal information is based on these principles:

• Lawfulness, fairness and transparency: we identify a lawful basis and consider individuals' rights.
• Purpose limitation: information is used for the purposes for which it was collected.
• Data minimisation: we seek to collect only information needed for the relevant purpose.
• Storage limitation: we do not intend to retain personal information longer than necessary.
• Accuracy: we take steps to keep personal data correct.
• Integrity and confidentiality: we aim to protect information against inappropriate access or use.

Your personal data rights

The original policy describes the following rights, which may be subject to legal conditions and exceptions:

1. Information: understand whether and why information about you is processed and where it comes from.
2. Access: request access to and a copy of information held about you.
3. Rectification: ask us to correct incomplete or inaccurate data.
4. Erasure: request deletion where the relevant legal requirements are met.
5. Restriction: ask for processing to be limited in qualifying circumstances.
6. Objection: object to particular processing activities, including direct marketing.
7. Automated decisions: exercise rights relating to solely automated decisions, including certain forms of profiling.
8. Portability: request eligible information in a machine-readable form or transfer it to another controller where feasible.
9. Explanation of refused requests: receive an explanation if an access request is declined.
10. Regulatory complaint and remedies: seek help from a supervisory authority and pursue available legal remedies.
11. Withdrawal of consent: withdraw consent where consent is the basis for processing.

To ask whether we process your data or to exercise your rights, email info@eryriconsulting.co.uk.

What information do we collect?

Information you give us

This can include business contact names, email addresses, telephone numbers, billing or business addresses and other information needed to supply services or respond to enquiries. The original policy says client contact details and account identifiers are recorded in a client database and are not disclosed to third parties without consent, subject to the disclosures explained elsewhere in the policy.

It also states that client marketing or information emails use blind carbon copy (BCC) to avoid revealing recipients' addresses to one another. We may invite clients or individuals to take part in voluntary surveys. Information entered in our online contact form may be combined with information received through other channels, including post.

Information collected automatically

Cookies, session technologies and website activity logs may record information about how visitors use our website, to support its operation and improve visitors' experience.

Public information

We may also obtain relevant information about you from publicly accessible sources.

How do we use your personal data?

We use personal information to deliver requested services, establish and administer accounts, provide quotations, respond to enquiries, communicate about contracts, provide requested offers, improve the customer experience and meet legal obligations.

Contractual purposes

• Identify clients and prospective clients.
• Prepare quotations and discuss potential contracts.
• Deliver services or products.
• Respond to requests made in connection with entering into a contract.
• Handle contract administration, invoicing and sales communications.

Legitimate interests

• Respond to enquiries and provide relevant customer support.
• Analyse customer history and the client base to improve services.
• Carry out client satisfaction questionnaires.
• Offer services similar to those previously used or considered, where permitted and not objected to.

Consent

Where required, we rely on consent for newsletters, campaigns or other specifically agreed activities.

Legal requirements and retention

We may retain invoicing and other records for accounting and legal purposes. The source policy also allows anonymised information to be used for other purposes. If compatible further processing is considered, we assess its relationship to the original purpose, its effect on individuals and appropriate safeguards, and provide information about the additional use.

Who else can access your data?

Our published policy says we do not disclose personal information to third parties for their own direct marketing. Trusted service providers may process information on our behalf where necessary to deliver services. Such providers are expected to safeguard it and use it only for the agreed purpose. Sensitive information is shared with consent unless a legal requirement permits or requires otherwise.

Other disclosures may occur when you authorise them, when required by law, in emergencies, or to resolve disputes and respond to persons with appropriate legal authority. The original policy also discusses social sharing integrations with Facebook, LinkedIn and Twitter, and recommends reviewing those platforms' own privacy policies.

We seek to work with providers that can protect personal information appropriately and may disclose information to public officials or other third parties where a lawful basis applies.

How do we protect your data?

The published policy describes physical, organisational and technical safeguards, including limiting access to staff who need information to deliver services, staff confidentiality training and testing of security measures.

It also refers to HTTPS, suitable anonymisation or pseudonymisation, vulnerability monitoring and SiteGround security services such as antivirus, firewall and malware scanning. These controls should be confirmed against the current website and hosting configuration.

Although precautions are taken, absolute security cannot be guaranteed. The policy describes notifying relevant authorities about reportable breaches and informing affected people when their rights or interests are at risk. Account holders are responsible for keeping their usernames and passwords confidential.

Children

The original policy states that Eryri Consulting Limited does not knowingly collect personally identifiable information from children under 13. It asks children under 13 not to submit information and says that, if the company becomes aware that such information has been submitted, it will attempt to delete it promptly.

Cookies and similar technologies

Cookies are small text files stored on devices that allow websites to recognise browsers or devices and remember certain preferences or activity. The original policy explains that cookies and similar technologies can support website operation, analytics and a more personalised experience. It says consent will be requested for cookies that are not strictly necessary.

Browser settings can be used to remove or block cookies, although some features may then work differently. See All About Cookies for more information.

The original policy says Google Analytics collects standard web-log and usage-pattern information for aggregated website statistics without attempts to identify individual visitors. For more details, see Google's privacy information or the Google Analytics opt-out tool.

Contact information

The original policy identifies an internal data protection officer as the contact for questions about the company's personal information practices.

The source policy describes the company's headquarters as being in Llanberis, Wales, while giving the correspondence address above in Gaerwen. Both details should be verified before publication.

Complaints

If you are concerned about the handling of your personal information, please contact us first so we can consider and respond to the issue. You may also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Changes and updates to this policy

The published policy states that Eryri Consulting Limited may amend its privacy notice and website conditions by publishing an updated version on its website. It encourages visitors to check for changes, notes that important changes may be communicated to customers and says historic versions can be requested.

It also contains provisions concerning UK law, dispute resolution and related website conditions. These provisions should be reviewed by an appropriately qualified adviser rather than assumed to be legally effective merely because they appear in the previous policy.

Original policy last modified: 10 August 2022.

ICO registration number shown on the source website: ZB360553.