Thermatic Group Privacy Notice

Introduction

‍
Thermatic Limited (“we”, “us”, “our”) is a Technical FM company headquartered in Salford, England
(Company registration number 10650952, Unit 3, Sovereign Enterprise Park, King William Street,
Salford, M50 3UP). Our Data Protection Office (DPO) is Jen Buckley, who can be contacted at
gdpr@thermatic.co.uk.

‍
In order for us to operate our business we need to collect personal data from those who access our
websites or premises, obtain products or services from us, provide products or services to us, are
engaged by us, or who we otherwise have dealings with in the course of our day to day activities.
We are committed to ensuring that the personal data we collect and use is appropriate for this
purpose and does not constitute and invasion of an individual’s privacy. We comply with all
applicable Data Protection Laws, including the UK General Data Protection Regulation (GDPR).

Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Consent: where you have given clear consent for us to process your personal data for a
    specific purpose.
  • Contract: where processing is necessary for the performance of a contract with you or to
    take steps at your request before entering into a contract.
  • Legal Obligation: where processing is necessary for us to comply with the law (not including
    contractual obligations).
  • Legitimate Interests: where processing is necessary for our legitimate interests or those of a
    third party, provided your interests and fundamental rights do not override those interests.

What Data We Collect

This Privacy Notice describes how and why we collect, store and use personal data and provides
information about individuals’ rights. Please read the following carefully to understand our views
and practices regarding your personal data and how we will treat it.
‍
We may collect information you provide directly (e.g. when contacting us via our website,
telephone, post, email, or social media) and information collected automatically using a combination
of analytics and tracking technologies to understand how visitors use our website. These include:

  • Google Analytics 4 (via Google Tag Manager) to analyse website usage.
  • Google Tag Manager (GTM) to manage and deploy tracking technologies on our website.
  • GTM itself does not collect personal data, but enables the controlled deployment of other
    tracking tools.
  • Fathom Analytics, which is a privacy-focused, cookieless analytics tool that does not use
    cookies or collect personal data.

These tools may collect information about your device, browsing behaviour, and interactions with
our website.

How We Use Your Data

We may use your data for the following purposes:

  • To respond to your enquiries and provide services;
  • To improve our website and services;
  • For marketing purposes (with your consent); or
  • To comply with legal obligations.

Cookies and Tracking

We use a cookie consent management platform (CookieScript) to allow you to manage your cookie
preferences.
When you first visit our website, you will be asked to consent to the use of non-essential cookies and
tracking technologies. You can accept or reject specific categories of cookies and update your
preferences at any time.
Non-essential tracking technologies (such as analytics and marketing tags) will only be deployed
where you have provided consent, except where they are strictly necessary for the operation of the
website.

Links to other websites

Our website may link to third-party websites. We are not responsible for their content or privacy
practices. Please review their privacy notices separately.

Data Security Measures

We take the security of your personal data seriously and implement a range of technical and
organisational measures to protect it from unauthorised access, loss, misuse, or disclosure. Our data
security measures include (but are not limited to):

  • Access Controls: Personal data is only accessible to individuals who require it for specific
    processing purposes and who have the relevant rights of access.
  • Data Encryption: Where appropriate, we use encryption technologies to protect data during
    transmission and storage.
  • Secure Storage: All personal data is stored securely, using systems and protocols designed to
    prevent unauthorised access.
  • Network Security: Our IT infrastructure is protected by firewalls, anti-malware software, and
    regular security monitoring.
  • Incident Management: We have procedures in place to detect, report, and investigate any
    suspected data breach. If you suspect any misuse, loss, or unauthorised access to your data,
    please contact us immediately at gdpr@thermatic.co.uk.
  • International Transfers: Some of our third-party service providers may transfer data outside
    the UK or EEA.
  • Staff Training: All staff handling personal data receive regular training on data protection
    and information security best practices.
  • Regular Review: Our security measures are reviewed and updated regularly to reflect
    changes in technology, legal requirements, and business operations.

How Long We Keep Your Data

We retain your data only as long as necessary for the purposes outlined in this notice or as required
by law. Data deleted in relation to website requests will be permanently erased, with no backup
retained.

Your Rights

Under data protection law, you have the following rights:

  • To be informed about how your data is used.
  • To access your personal data.
  • To have inaccurate data corrected.
  • To request erasure (“right to be forgotten”), in certain circumstances.
  • To restrict or object to processing.
  • To data portability.
  • To withdraw consent at any time.
  • To lodge a complaint with the Information Commissioner’s Office (ICO). If you are
    dissatisfied with how we have handled your personal data or wish to lodge a complaint with
    the ICO, you can contact them online at https://ico.org.uk/make-a-complaint/ or by calling
    0303 123 1113.

‍
How to Exercise Your Rights

If you wish to exercise any of the rights under the terms of GDPR, as set out above, please contact us
by email at gdpr@thermatic.co.uk, stating clearly which right(s) you wish to exercise. We will
acknowledge your email and will try to respond to all legitimate requests within one month.
Occasionally, it may take us longer than a month if your request is particularly complex or you have
made a number of requests. In this case, we will notify you and keep you updated.
We may need to request specific information from you to help us confirm your identity and ensure
your right to access your personal data (or to exercise any of your other rights). This is a security
measure to ensure that personal data is not disclosed to any person who has no right to receive it.
We may also contact you to ask you for further information in relation to your request to speed up
our response.

You do not have to pay a fee to access your personal data (or to exercise any of the other rights).
However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or
excessive. Alternatively, we may refuse to comply with your request in these circumstances.
If you are unhappy with our response to any requests you have made to us regarding the use of your
personal data, you have the right to lodge a complaint with the ICO, by contacting them online at
https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.

Changes To This Privacy Notice And Your Duty To Inform Us Of Changes
We may make changes to this Privacy Notice from time to time. We will post any changes to our
website, and notify you of any material changes by email.

It is important that the personal data we hold about you is accurate and current. Please keep us
informed if your personal data changes during your relationship with us by updating your profile
account information or contacting us via gdpr@thermatic.co.uk.