Data protection policy

Purpose and scope

This policy sets out how AGL Construction Services Ltd handles personal information, in line with UK GDPR and the Data Protection Act 2018. It applies to everyone who works for us or on our behalf. Our privacy notice explains how this website uses it.

The principles we follow

UK GDPR sets out seven principles. Personal information must be:

• used lawfully, fairly and openly
• collected for clear purposes, and not used for unrelated ones
• limited to what we need
• accurate and kept up to date
• kept no longer than we need it
• kept secure

The seventh is accountability: we must be able to show that we follow the other six.

What we hold and why

We hold personal information about:

• clients: contact details and property addresses, for quotes and works
• residents: contact and access details shared by landlords for the works, sometimes with health or vulnerability details so we can plan around a household's needs
• employees: what we need to employ, pay and look after people
• job applicants: CVs and application details
• website enquiries: the details people send us, so we can reply

We use it only where we have a lawful basis, most often a contract, a legal obligation or our legitimate interests in running the business. Health and other sensitive details get extra care and are used only where the law allows. We never sell personal information.

Residents' details from a landlord are used only for the works, under the data protection terms of our contract with that landlord.

Keeping it secure

• Access is limited to the people who need it for their work.
• We use secure systems, protect devices and accounts with passwords, and remove access when someone leaves.
• Job sheets and other papers with residents' details are never left unattended on site or on view in vehicles.
• Paper records are kept and disposed of securely.
• Organisations that handle personal information for us, such as our website host, do so under contract and only on our instructions.

How long we keep it

We keep personal information only as long as we need it, then delete or destroy it securely. Unsuccessful job applications are kept for up to 6 months, unless the applicant asks us to delete theirs sooner. Payroll, accident and other records are kept for as long as the law requires.

Your rights

You can ask for a copy of the personal information we hold about you, ask us to correct or delete it, limit or object to how we use it, or ask for it in a format you can take elsewhere. Some rights apply only in certain circumstances.

To make a request, email info@aglcs.co.uk or call 020 8591 7196. We will respond within one month. If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office, the ICO, at ico.org.uk.

If something goes wrong

If personal information is lost, stolen or seen by someone who should not see it, such as through a lost phone or an email sent to the wrong person, tell a director straight away.

We will contain it, assess the risk and record what happened. Where the law requires, we will report it to the ICO within 72 hours of becoming aware of it, and tell the people affected if they are at high risk.

Responsibilities and review

The directors of AGL Construction Services Ltd own this policy and are responsible for data protection. Everyone who works for us must follow it, and ask a director if they are unsure. The directors review it every year, and sooner if the law or the way we work changes.