Your privacy matters to us. This policy explains what personal data Waterside Fabrications Ltd collects, why we collect it, how we use it, and your rights under UK data protection law — including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 1 Please read this policy carefully. If you have any questions, contact us using the details at the bottom of this page. WHO WE ARE The data controller responsible for your personal data is: Waterside Fabrications Ltd Progress Works, Parkwood Street Keighley, West Yorkshire BD21 4NX Email: info@watersidefabrications.co.uk Tel: 0113 440 0200 Waterside Fabrications Ltd is registered in England and Wales. References to "we", "us" or "our" in this policy refer to Waterside Fabrications Ltd, including our trading name Steel Shelters. 2 WHAT PERSONAL DATA WE COLLECT We may collect and process the following categories of personal data: FROM ENQUIRIES AND CONTACT FORMS ▸ Your name and job title ▸ Your company name and address ▸ Your email address and telephone number ▸ Details of your project or requirements, as provided by you FROM CUSTOMERS AND SUPPLIERS ▸ Contact and billing details for the individuals we deal with ▸ Bank account details where required for payment or invoicing ▸ Correspondence and records of our business dealings FROM WEBSITE VISITORS ▸ IP address and browser information collected via cookies and analytics tools ▸ Pages visited, time on site, and referral source (aggregated and anonymised where possible) We do not collect sensitive personal data (such as health information, ethnicity, or financial data beyond what is required for business transactions) and we do not knowingly collect data from anyone under the age of 18. 3 HOW WE USE YOUR DATA We use personal data only for legitimate business purposes. The lawful basis we rely on under UK GDPR is noted for each purpose: RESPONDING TO ENQUIRIES To respond to your messages, provide quotations, and follow up on project discussions. Lawful basis: Legitimate interests / pre-contractual steps. FULFILLING CONTRACTS To manage orders, deliveries, invoicing, and customer service relating to work we carry out for you or your organisation. Lawful basis: Performance of a contract. SUPPLIER AND SUBCONTRACTOR MANAGEMENT To manage relationships with the companies and individuals we work with. Lawful basis: Performance of a contract / legitimate interests. LEGAL AND REGULATORY COMPLIANCE To meet our obligations under tax, health and safety, and other applicable law. Lawful basis: Legal obligation. MARKETING COMMUNICATIONS Where you have given consent or we have a legitimate interest in doing so, we may contact you with information about our products and services. You can opt out at any time. Lawful basis: Consent / legitimate interests. WEBSITE ANALYTICS To understand how visitors use our website so we can improve it. We use anonymised or aggregated data wherever possible. Lawful basis: Legitimate interests / consent (where cookies require it). 4 WHO WE SHARE YOUR DATA WITH We do not sell your personal data. We may share it with: ▸ Our employees and subcontractors — on a need-to-know basis for delivering work ▸ IT and software providers — including email, website hosting, and accounting software (e.g. cloud-based systems) ▸ Professional advisers — such as accountants or solicitors, where necessary ▸ HMRC and other statutory bodies — where required by law All third parties we share data with are required to handle it securely and in accordance with UK data protection law. We do not transfer personal data outside the UK unless we have appropriate safeguards in place. 5 HOW LONG WE KEEP YOUR DATA We retain personal data only for as long as necessary. Our general retention approach is: ▸ Customer and contract records: 7 years from the end of the contract or last transaction (in line with HMRC requirements) ▸ Enquiries that did not result in a contract: Up to 2 years, unless you ask us to delete sooner ▸ Marketing contacts: Until you withdraw consent or we no longer have a legitimate interest in contacting you ▸ Website analytics data: As set by our analytics provider — typically 26 months for aggregated data When data is no longer required, we securely delete or anonymise it. 6 COOKIES Our website uses cookies — small text files placed on your device — to help it function and to understand how it is used. Cookies we may use include: ▸ Strictly necessary cookies: Required for the website to function. These do not require your consent. ▸ Analytics cookies: Used to collect anonymised information about how visitors use the site (e.g. Google Analytics). These are only set with your consent. When you first visit our website, you will be presented with a cookie notice. You can change your cookie preferences at any time by clearing your browser cookies and revisiting the site, or by contacting us. For more information about cookies generally, visit 7 YOUR RIGHTS www.aboutcookies.org. Under UK GDPR, you have the following rights regarding your personal data. You can exercise any of these rights by contacting us using the details in Section 9. RIGHT OF ACCESS RIGHT TO RECTIFICATION You can request a copy of the personal data we hold about you (a "subject access request"). RIGHT TO ERASURE You can ask us to delete your personal data where there is no longer a lawful reason to keep it. RIGHT TO DATA PORTABILITY You can ask for your data in a structured, machine-readable format where processing is based on consent or contract. RIGHT TO WITHDRAW CONSENT Where processing is based on consent, you can withdraw it at any time without affecting prior processing. You can ask us to correct personal data that is inaccurate or incomplete. RIGHT TO RESTRICT PROCESSING You can ask us to pause processing of your data in certain circumstances. RIGHT TO OBJECT You can object to processing based on legitimate interests or for direct marketing at any time. RIGHT TO COMPLAIN You have the right to lodge a complaint with the ICO if you believe we have mishandled your data. We will respond to all rights requests within one month. There is no charge for exercising your rights in most circumstances. 8 HOW WE PROTECT YOUR DATA We take reasonable technical and organisational steps to protect personal data from unauthorised access, loss, or disclosure. These include: ▸ Password-protected systems and devices ▸ Restricted access on a need-to-know basis ▸ Secure email and file storage practices Regular review of our data handling procedures ▸ In the event of a personal data breach that is likely to result in risk to individuals, we will notify the Information Commissioner's O ce (ICO) within 72 hours as required by UK GDPR. 9 CONTACT US & HOW TO COMPLAIN To exercise any of your data rights, raise a concern, or ask a question about this policy, please contact us: DATA ENQUIRIES Waterside Fabrications Ltd Progress Works, Parkwood Street Keighley, West Yorkshire, BD21 4NX Email: info@watersidefabrications.co.uk Tel: 0113 440 0200 If you are not satisfied with our response, or you believe we are processing your data unlawfully, you have the right to complain to the Information Commissioner's O ce (ICO): ▸ Website: ico.org.uk ▸ Helpline: 0303 123 1113 ▸ Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF UPDATES TO THIS POLICY 10 We review this privacy policy periodically and will update it when our practices change or when required by law. The "last updated" date at the top of this page reflects the most recent revision. Where changes are material, we will take reasonable steps to bring them to your attention.