Where we rely on legitimate interests, we have considered that our use of your information is proportionate and does not unfairly override your own interests, rights and freedoms. Where we rely on consent, you can withdraw it at any time — see Section 12. 
 
5  Cookies and Similar Technologies 

A cookie is a small text file placed on your device when you visit a website. We use cookies and similar technologies in the following categories: 
 

• Strictly necessary cookies — required for the Website to function and cannot be switched off. These do not require consent under PECR. 

• Analytics cookies — help us understand how visitors use the Website (for example, using Google Analytics), so we can improve it. These are only set with your consent. 

When you first visit the Website, you will be asked to accept or decline non-essential cookies. You can change your preference at any time, and you can also manage or delete cookies through your browser settings — most browsers let you refuse all cookies, accept only certain types, or be notified when a cookie is set. Blocking some cookies may affect how parts of the Website work. 

6  Social Media Features 

The Website includes links to our social media profiles, such as LinkedIn and Facebook. These features are hosted by the relevant platform and may set their own cookies or collect information about your visit. Your interaction with these features is governed by the privacy policy of the platform concerned, not by this policy. 

7  How We Share Your Information 

We do not sell your personal information. We may share it with: 
 

• Service providers who support our business, such as website hosting, IT support, email, and analytics providers, who are only permitted to use your information to provide their service to us 

• Professional advisers, such as our accountants, insurers or solicitors, where necessary 

• Our certification and accreditation bodies (such as BAFE and our Certification Body), where required to demonstrate compliance 

• Regulators, law enforcement or other authorities, where we are required to do so by law or to protect the safety of others 

8  International Data Transfers 

Some of our service providers, such as cloud hosting or analytics providers, may process personal information outside the UK, including in the United States. Where this happens, we ensure appropriate safeguards are in place, such as reliance on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or standard contractual clauses approved for use in the UK, so that your information continues to receive a comparable level of protection. 

9  Data Retention 

We keep personal information only for as long as necessary for the purposes it was collected, or as required by law. As a guide: 

• Enquiry and quote data that does not lead to a client relationship is typically retained for up to 24 months 

• Client and contract records, including fire safety compliance documentation, are retained for the periods required by law and by our certification bodies, commonly at least 6 years after our relationship with you ends 

• Website analytics data is retained in line with our analytics provider's default settings unless we configure a shorter period 
   

10  Data Security 

We use appropriate technical and organisational measures to protect your personal information, including access controls, encryption of data in transit, and staff awareness of data protection obligations. While we take reasonable steps to protect your information, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security. 

11  Data Breach 

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will assess the breach and, where required, report it to the ICO within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we will also notify you directly without undue delay, explaining what has happened and what steps you can take. 

12  Your Rights Under UK GDPR 
 
You have a number of rights in relation to your personal information. These are not absolute and may not apply in every circumstance, but where they do, we will honour them.