PRIVACY NOTICE FOR CUSTOMERs

1. Introduction

We appreciate the fact that you are parting with your personal data and that you trust our organisation with your personal data. The security of your personal data is of fundamental importance to us.

2. Our Services

BWC Profiles supplies highly quality aluminium and plastic extrusions across many industries throughout the UK and in order for us to meet our contractual obligations with you we will be processing your personal data.

3. Purpose Of This Privacy Notice

This is Privacy Notice is aimed at ensuring that you are aware of the categories of personal data we intend to process on your behalf; the reasons why we intend to process your personal (including sensitive data) and that we are in compliance with the General Data Protection Regulations (GDPR) as implemented in the UK as the Data Protection Act 2018.

Please read and acknowledge the following Privacy Notice relating to your personal data and your sensitive data. We want to bring this Privacy Notice to your attention at the time we are collecting your personal data from you.

4. Controller

For the purpose of the General Data Protection Regulations (the “Regulations”), the data controller (‘Controller’) is BWC Profiles Limited, a company registered in England and Wales under company number 07921807, whose registered office is, 1 Vincent Avenue, Crownhill, Milton Keynes, England, MK8 0AN.

BWC Profiles Limited has associated companies which include:

B.W.C Group Limited under company number 05771602, which operates the site www.bwcprofiles.co.uk;
B.W.C Aluminium Limited under company number 03753580, which operates the site www.bwcprofiles.co.uk;
B.W.C Plastics Limited under company number 07926686, which operates the site of www.bwcprofiles.co.uk; and
B.W.C Greenhouses Limited (Trading as Norfolk Greenhouses and Evika) under company number 05640029, which operates the sites

www.norfolk-greenhouses.co.uk and www.evika.co.uk

We will refer to BWC Profiles Limited, B.W.C. Group Limited, B.W.C. Aluminium Limited, B.W.C Plastics Limited, B.W.C Greenhouses Limited as “

For the purposes of this policy the contact details of the Controller is:

Mark Barker (mark.barker@bwcprofiles.co.uk)

For the purposes of this Policy, the Appointed Person(s) are:

Sam Miller (sam.miller@bwcprofiles.co.uk); and
Danny Varley (danny.varley@bwcprofiles.co.uk).

5. Your Personal Data That We Process

We process the following personal data. This list is not exhaustive:

Personal Data

Full name

Company position

Home/Mobile Number

NI Number

Bank Details

Invoices

Financial Documents

Email address

Contract

Orders

Complaints

Guarantees & receipts

Addresses (delivery and company address)

Signatures

6. Lawful Reasons for Processing your Personal Data

We will be processing your personal data (including sensitive data) for legitimate purposes. In order to ensure that you can:

fulfil your contractual obligations with BWC Profiles;
for legal obligation reasons;
for legitimate interest reasons;
due to the fact you have provided us with your explicit consent.

7. Lawful Reasons for Processing Special Categories of Personal Data

Sensitive Data – Purpose for Processing

We will be processing your personal data (including sensitive data):

In order that we can meet our obligations in the field of social security protection law;
The processing is necessary for legitimate activities with appropriate safeguards in place;
It is necessary due to substantial public interest reasons;
Processing is for archiving purposes;
We have obtained your explicit consent.

8. Unable to Process Personal Data

In certain circumstances if we do not have your personal or sensitive data we will not be able to fulfil our obligations with you under your contract. Therefore, if you decide not to part with your personal data this may lead to the termination of your contract with our organisation.

9. Disclosure of your Personal Data to Third Parties

In order for us to carry out our services on your behalf we may need to disclose your personal data and sensitive data to third parties. The reasons would be:

in order that we can fulfil our obligations towards you under our contract of services; and /or
for legal or tax compliance reasons; or
any other legal obligation purpose.

The third parties are to be (this list is not exhaustive):

Delivery companies
HMRC
ERP Systems
OneDrive
SharePoint
Microsoft windows
Webroot Endpoint Protection
BackupVault

10. Assurances under the GDPR

BWC Profiles is committed to getting assurances from each third party processor that they are GDPR compliant.

11. Non-liability Your Disclosure to Third Parties

If you have provided your personal data voluntarily to the third party processors then the Controller accepts no responsibility regarding how this personal data will be processed by that third party processor.

12. Our Commitment to Processing your Personal Data in compliance with the GDPR

Principle 1 - Lawful Purpose (Article 5 of the GDPR)

We will be processing your personal data for lawful reasons as outlined in clauses 6 and 7 of this Privacy Notice.

Principle 2 - Specific Purpose & Limited (Articles 5 & 6 of the GDPR)

We will ensure that any personal data (including sensitive data) that we process will be specific, legitimate and limited.

Principle 3 - Adequate, Relevant & Limited

We only want to process your personal data and sensitive data which is adequate, relevant & limited.

Retention

Any personal data we retain from you in the course of carrying out our contractual services with you will be retained by us for a period of time which ensures that we are in compliance with our legal obligations. For further information please contact the Controller and request our Records Management Policy.

Duration – Retention of Your Personal Data

We will keep your personal data as follows:

for the duration of our business relationship with you; and
after any termination of any agreement for a period that does not exceed 6 years. The retention is required for tax and legal compliance reasons; or
in certain circumstances where further retention is required to comply with a legal obligation.

We will delete your personal data after the legal and tax requirement period has been fulfilled.

Please contact the Controllers for a copy of the ‘Records Management Policy’.

Principle 4 & 5 - Accuracy of your Personal Data (Article 5 of the GDPR)

We want to ensure that your personal data is kept up to date.

If any of your personal data changes during the life-time of our business relationship with you, please kindly contact the Controller in order that your personal data can be amended.

We will not be responsible in any way for your failure to notify of us of any changes

to your personal data.

Principle 6 - Ensuring Security

We have received assurances from the third party platform providers that the processing of your personal data on this platform is secure from any damage, accidental loss and if there are any risks the risks are low and that the platform provider will do everything to rectify any security breaches related to the processing of your personal data.

13. Consent

One of the lawful reasons for processing your personal data, is if you provide us with consent. If you do provide us with ‘consent’, this means that you are providing us with permission to process your personal data.

Please also note the following:

we want you to provide your consent explicitly and freely; and
in the event that you do provide consent you have the right to withdraw your consent at any time.

For further information please contact any of our Appointed Person(s) for the ‘Consent Policy & Procedure’.

14. Your Rights

While we keep your personal data you have the following rights:

Right to request access to your personal data, know as a ‘Subject Access Request’ (SAR)
Right to rectification of your personal data
Right to request your personal data to be transferred to another organisation (right to data portability). However we do not have this facility.
Right to object to the processing of your personal data (see right to object notice)
Right to erasure of your personal data
Right to restrict of personal data
Right not to be a subject to automated decision making process (including profiling)
Right to be informed
Right to make a complaint to the ICO in the event you feel your complaint has not be handled by BWC Profiles correctly

15. Subject Access Request requirements

A SAR can be requested verbally by you, however in order for us to ensure that we can verify your ID we will require you to:

complete a SAR Form. This form can be requested from any of the Appointed Person(s);
return the SAR Form with a certified copy of your ID and also your 2 month’s utility bills. You can also attend the offices in order to verify your ID;
We will not be under any obligation to provide you with any personal data unless your ID is verified.

16. Subject Access Requests – Time-scale

We aim to process the SAR within 1 month, however it may take a further 2 months. In which case if there is a delay, we will notify you of such delay in writing.

17. Subject Access Request Details

You can at any time request the following information from our organisation:

The full name(s) and contact details of who has been processing your personal data including name of the controller and any
Appointed Persons(s) responsible for processing the personal data;
A list of personal data & sensitive data which has been processed by the controller
If the personal data was obtained by a third party; details of such third party
Details of any recipients including third country details
The reasons why these forms of personal data have been processed (lawful reasons etc & compliance with key principles)
Sensitive data – consent – if not legitimate reasons for processing
Where the personal data has been located (third party/controller’s platform/computer system) including security
Retention Periods – the length of time your personal data will be processed
Compliance with the key principles which are disclosed in this privacy document
If your personal data has been processed outside the EU, details of any representative(s)
Your rights (object, restrict, erasure etc) which are listed in this privacy document
Your right to make a complaint to the Information Commissioner’s Office

18. Right To Object To The Processing Of Personal Data

You have the right to object to certain types of processing of your personal data such as:

for marketing purposes
for automated processing purposes
for profiling purposes

In the above cases, your explicit consent would be required by our organisation before we can actually process your personal data.

This right to object does not apply if:

Our organisation needs to enter into a contract with you
It is sanctioned by law (tax evasion or fraud)
The agreement does not have a legal or equally important impact
It is based around explicit consent and you have provided us with explicit consent

Please contact a manager of the Controller or any Appointed Person(s).

19. Complaints

In the event that you wish to make a complaint about how your personal data is processed by our organisation (or any third party listed in the privacy notice) then please make your complaint to the following:

Controller(s):

Mark Barker (mark.barker@bwcprofiles.co.uk)

The contact details of the ICO are as follows:

Tel: 0303 123 1113

Please also request the firm’s ‘Complaint’s Policy’ from any member of the firm.

This Document has been revised and approved by:

Controller: Mark Barker

Date: 15/06/23

Data Subject Notice

Find out how we use your data to improve your experience