Privacy policy
How we collect, use and store personal data, and what rights you have over it.
[Legal text to be supplied by client] — the wording below is an outline of the sections this document needs. It has not been reviewed by a solicitor and must be replaced before this site goes live.
Last updated: [Date to be confirmed]
Who we are
Corestone Facilities Management Ltd is the data controller for personal data collected through this website. Our registered address and company number belong here, along with the contact details for data protection enquiries.
Enquiries about this policy currently go to hello@corestonefm.co.uk. If a Data Protection Officer is appointed, their details should replace this.
What we collect
The enquiry form on this site collects your name, company, email address, telephone number, the services you are interested in, the number of sites you operate and anything you write in the message field.
This section should also cover data collected through the client portal, through job records and site attendance, and through any CCTV or access control systems we operate on your behalf — each of which has a different basis and retention period.
Why we use it, and our lawful basis
Enquiry data is used to respond to your enquiry and to arrange a site survey. The lawful basis should be stated explicitly for each purpose — typically legitimate interests for responding to a business enquiry, and contract performance for work carried out for clients.
State clearly whether enquiry details are used for any marketing, and if so how consent is obtained and withdrawn.
How long we keep it
Set a retention period against each category of data: website enquiries, client contract records, employee and applicant records, CCTV footage and access logs. Retention periods should be justifiable, not indefinite.
Who we share it with
List the processors used — email delivery, hosting, the client portal platform, and any subcontractors who receive personal data in order to attend a site — together with the safeguards in place and whether any transfer data outside the UK.
Your rights
Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. This section should explain how to exercise them and how quickly we will respond.
It should also state your right to complain to the Information Commissioner's Office, with a link to ico.org.uk.
Cookies
This website sets no analytics or marketing cookies as built. If analytics, tag management or embedded media are added later, a cookie notice and consent mechanism will be required, and this section must be updated to match.