This privacy policy explains how we use personal data when you visit our website, enquire, open an account, buy or receive our services, complain, speak up, subscribe to a newsletter, apply to join us through a public form, or verify an engineer via a staff ID QR code. It is the public notice for anyone outside our workforce. It is not the staff privacy policy.

1. Who we are (the controller)

For UK data protection law, the controller is:

Keiron Cheesbrough Ltd Company number: 11885860 Registered office: 97c Alexandra Road, Tipton, West Midlands, DY4 8TD, United Kingdom VAT: GB 318 9406 84
ICO registration: ZB888956 Telephone: 0121 295 1925 Website: www.keironcheesbrough.com

Managing Director / owner: Keiron Cheesbrough

Data Protection Manager Post: Data Protection Manager, Keiron Cheesbrough Ltd, 97c Alexandra Road, Tipton, West Midlands, DY4 8TD, United Kingdom Email: info@keironcheesbrough.com

We design, install, commission and maintain professional telecoms and security systems (including CCTV, alarms, lighting and networking) for customers across the UK.

2. Whose data this notice covers

This notice applies to personal data about:

• customers and people who enquire about work
• account holders on our website
• people who contact us by phone, email or form
• complainants using our complaints process
• whistleblowers / people who use Speak up (named or anonymous)
• newsletter subscribers
• job and apprenticeship applicants who use public careers / join-team forms
• people who scan or open a public engineer ID verify page (/id/…)

It does not replace our internal staff privacy policy , which covers employees, workers and contractors engaged as workforce.

3. What we collect and where it comes from

3.1 Information you give us

You may provide information by filling in website forms or by corresponding with us. Forms and channels include:

We do not add customer or staff email addresses to the newsletter unless that person has subscribed and confirmed (double opt-in).

On the join-the-team form we do not ask for date of birth, National Insurance number or health information. If you choose to tick that you already hold vetting (for example DBS, NPPV3 or SC), we treat that as information you volunteered about qualifications you hold — we use it only to contact you about suitable work, not to run a check at that stage.

3.2 Information we create or receive in the course of work

• Job and account records (quotes accepted, appointments, invoices, engineer notes)
• Photos or files you upload so we can quote or do the job
• Service messages and logs linked to your account or job
• Aggregated website analytics (see cookies section)

3.3 CCTV and security installs (important)

When we survey, quote, install or maintain CCTV or other security systems at a customer site, we process site contact and job data (names, phones, emails, addresses, access instructions, photos of the installation) so we can do the work safely and keep a proper job record.

Camera footage recorded on equipment we install at a customer site is typically processed on the customer’s system. Unless we have expressly agreed in writing to host, store or monitor footage for you, that footage is the customer’s responsibility as controller of their own CCTV. We may view live or recorded images on site only as needed to install, commission, fault-find or demonstrate the system. If we ever host or monitor footage under a separate agreement, we will explain that processing at the time.

3.4 Extra-support information on complaints (special category)

Our official complaints form lets you optionally tell us about extra support needs at the address (for example disability or limited mobility, hearing or sight, mental health or anxiety, older person, young children, language needs, or living alone). That information can be special category personal data.

We only use it to acknowledge the complaint, investigate safely, visit safely if needed, and reply with the outcome. We do not use it for marketing. Access is limited to people who need it to handle that complaint. The additional condition we rely on under UK GDPR Article 9 / the Data Protection Act 2018 is typically that processing is necessary for the establishment, exercise or defence of legal claims, or another Schedule 1 condition that fits the support need you told us about. Extra-support details are optional. Prefer-not-to-say is available.

3.5 Public engineer ID cards (digital ID via QR)

Our engineers may carry a physical ID card. The back of the card has a QR code that opens a unique digital ID page on our website (/id/…). Scanning it lets a customer or site verify the person in front of them.

That page shows limited ID details only: name, role or job title, whether the card is valid, and a photo when the card is valid. It does not show email, phone, home address, National Insurance number, certificate files, or a full training / clearance profile.

Training is separate. Training and clearance details are not published on the digital ID page and are not encoded in the card QR. We do not put training share links on the physical card.

Where appropriate, the verify page may let someone request access to that person’s training profile. The request goes to the staff member and their manager; either may approve. If approved, we send a signed, time-limited training share link (same mechanism as today’s admin training share — it expires). Until then, training stays private.

Each card has its own durable link (not a browsable staff directory). Those pages are kept out of search engines (noindex / robots rules). We use this so customers and sites can verify the engineer.

4. Purposes and lawful bases

We only use personal data when we have a lawful basis under UK GDPR. Typical purposes and bases:

Marketing vs service messages: These are different.

• Service messages about an enquiry, account or job (appointments, engineer arrival, invoices, payment follow-ups) are not marketing. Automated or recorded calls for those purposes are covered in the Website use policy.
• Newsletters and promotional emails/texts only go out with consent and double opt-in for email. You can turn marketing texts off in your account and unsubscribe from emails using the link in each message, or contact us.
• Existing-customer offers for similar products or services (for example calling or emailing a past alarm-install customer about a maintenance / service contract) may rely on legitimate interests, and only where PECR allows. Limited to people who already had a relevant relationship with us, similar products/services, and an easy way to say no. Opt out anytime via info@keironcheesbrough.com, 0121 295 1925, or when we contact you.

You can withdraw newsletter/promotional consent at any time by using the unsubscribe link, turning texts off in your account, emailing info@keironcheesbrough.com, or phoning 0121 295 1925. Withdrawal does not affect processing already carried out lawfully.

5. Cookies and first-party analytics

We use first-party analytics on this website so we can see which browsers and pages are used, and so we can warn people on browsers that are no longer supported.

We record:

• browser family and version
• operating system
• device type
• page path

We do not store IP addresses, advertising IDs, or a raw user-agent string for this analytics.

If you dismiss the outdated-browser / unsupported-browser notice, we set a first-party cookie named kc_browser_ok with Max-Age of 2,592,000 seconds (30 days) so we do not show that notice again on this browser. It is only for that banner — not a general consent cookie.

The website also uses strictly necessary cookies so the site works securely — typically a session cookie and a CSRF protection token (for example laravel_session and XSRF-TOKEN). These are not used for advertising. If you use Remember me on login, your signed-in session may last longer (about 90 days) so you do not have to sign in every visit.

The website may register a service worker (/sw) so static assets load faster and so we can show optional notifications if your browser allows them. It caches technical assets on your device; it is not used for advertising.

This section is the cookie notice for our website. There is no separate cookie policy page. The Website use policy points here for cookies and personal data.

6. Sharing and processors

We do not sell your personal data. We share it only where needed to deliver a service, run the business lawfully, or where the law requires it.

Typical categories of recipients:

We use trusted service providers under contract. They may only process personal data on our instructions and with appropriate security. We do not invent or list every SaaS product name here; categories above describe the roles.

Address suggestions on the site go through our own geo endpoints to the map provider set in Settings (Google or Nominatim). Separately, we may use postcodes.io on our servers to enrich site postcodes. “Open in Maps” links are ordinary outbound links.

Manufacturer apps and cloud products we link to (for example Hik-Connect, ProControl+, Ring) have their own privacy terms. We do not control those products.

7. International transfers

Personal data is processed primarily in the United Kingdom and, where relevant, the EEA.

Some trusted providers may process data outside the UK. Where that happens, we use appropriate safeguards required by UK data protection law (for example the UK International Data Transfer Agreement / Addendum, or an adequacy decision) so that your data remains protected.

If you need more detail about a specific transfer, contact the Data Protection Manager.

8. Retention

We keep personal data only as long as needed for the purpose, including legal and claim periods. Typical periods:

Shorter or longer periods may apply if the law requires it or if we need data for an active dispute or investigation.

9. Security

We take security seriously. Measures include password-protected and encrypted systems where appropriate, role-based access so staff only see what they need, and contracts with processors that require them to protect data. No method of transmission or storage is completely secure; we work to reduce risk to an appropriate level for the data we hold.

10. Your rights

Under UK data protection law you can ask us to:

• Access your personal data (a subject access request)
• Rectify incomplete or inaccurate data
• Erase data where there is no good reason for us to keep processing it
• Restrict processing in certain cases (for example while we check accuracy)
• Object to processing based on legitimate interests
• Port data you provided to us, where processing is based on consent or contract and is automated
• Withdraw consent where we rely on consent

We usually respond within one month. We may extend that by up to two further months for complex or numerous requests; if so we will tell you. We do not charge a fee in most cases, but we may charge a reasonable fee or refuse a request that is clearly unfounded, repetitive or excessive.

How to exercise your rights: email info@keironcheesbrough.com, call 0121 295 1925, or write to the Data Protection Manager at the registered office. We may need to verify your identity.

Marketing opt-out: unsubscribe link in emails; account settings for marketing texts; or contact us as above.

11. Children

You must be 18 or over to create an account or to request work through our website (see Website use policy). Someone 18 or over must be on site when we attend. We do not knowingly offer accounts to children.

12. Automated calling for service

If you enquire, hold an account, accept a quote or have a job with us, we may contact you about that work by email, text or phone. Some calls may be automated or recorded. They are used for reminders and scheduling — not for marketing. Full detail is in the Website use policy. You can ask us to stop automated calls at any time (email, phone or contact page).

13. Complaints

If you have a concern about how we use your data, please contact the Data Protection Manager first (details in section 1). We hope we can sort it out.

We are registered with the ICO (registration ZB888956).

You can also complain to the UK Information Commissioner’s Office (ICO):

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: https://ico.org.uk

14. Changes to this policy

We may update this notice. The version and dates shown with this page are the ones that apply. Material changes will be shown by updating the version and review dates. Check this page for the current text. A change here does not rewrite a quote you have already accepted.

15. Contact

Questions about this privacy notice: Email: info@keironcheesbrough.com Telephone: 0121 295 1925 Post: Data Protection Manager, Keiron Cheesbrough Ltd, 97c Alexandra Road, Tipton, West Midlands, DY4 8TD, United Kingdom