Our commitment
Blacksmiths is committed to protecting your personal data and respecting your privacy. We collect, use, store, and share your data responsibly and transparently, in accordance with applicable data protection laws. Our goal is to ensure that your personal data remains secure and is handled with the highest standards of confidentiality and integrity. We continuously review and improve our privacy practices to maintain your trust and provide you with clear choices about how your data is used.
Purpose
This notice is to inform you how Blacksmiths processes your personal data when you register to work as a supplier or contractor with Blacksmiths Group or one of its subsidiaries, whether you do any work with us, or not. It provides information about who we are, what data we collect about you, why we collect it, and what rights you have with regards to your data. It also provides our contact details, how to make a subject access request (SAR) and how to make a complaint.
Scope
This Privacy Notice applies to all personal data collected, used, stored, or shared by us when you interact with our products, services, websites, mobile applications, and any other digital or offline channels we operate (collectively, the “Services”) or enter into a contract with us. It covers:
- Information you provide directly when entering into a contract with us, creating an account, contacting us, completing forms, or using our Services.
- Information collected automatically through cookies, analytics tools, and similar technologies when you access or use our Services.
- Information received from third parties, such as service providers, partners, or publicly available sources, where permitted by law.
- All users of our Services, regardless of location, unless a particular regulation requires region-specific practices.
This policy does not apply to third-party websites, services, or applications that may be linked from our Services. We encourage you to review the privacy policies of any third party before sharing your personal information with them.
Contact details
Blacksmiths’ Data Protection Manager is Zoe Lay. You can contact Zoe using the following contact details:
Name: Blacksmiths Group Limited
Address: Formal House, St. Georges Place, Cheltenham, GL50 3PN
Company Number: 16584743
VAT Number: 506442903
Email: info@blacksmithsgroup.com
Website: www.blacksmithsgroup.com
Definitions
- Personal data – any data that can be used directly or indirectly to identify an individual. Examples of this are: name, telephone number, email address, home address, location data, online identifier (username) etc.
- Data subject – the individual who the data relates to.
- Data controller – the organisation/person who determines the reason for collection of data and how it is collected.
- Data processor – the organisation/person who processes the data on behalf of the Data Controller.
- Processing – any operation performed on personal data, including (but not limited to) collection, storing, manipulating, transmitting, using, altering or deleting. If an organisation is using personal data in some way, then it is highly likely this will fall under processing. This can be a manual or automated process.
UK GDPR and The Data Protection Act 2018
The Data Protection Act 2018 (DPA) is the UK’s implementation of the General Data Protection Regulation (GDPR). It controls how your personal data is used by organisations, businesses or the government.
DPA 2018 sets out the key principles, rights and obligations for most processing of personal data in the UK. Everyone responsible for using and processing personal data must follow strict data protection principles.
Types of personal data we collect and why
We process the following information about you when you provide services to us as a supplier or contractor. This may include some or all of the following:
- your name and contact details;
- your work experience, education history or CV;
- references from your previous employers;
- evidence of your educational attainments;
- evidence of any disclosed existing National Security Vetting clearance you hold; and
- other information gathered to seek assurance that your appointment will not bring discredit upon or otherwise adversely affect our professional integrity, information which may include but is not limited to any examples of: spent or unspent criminal convictions.
- date of birth;
- national insurance number;
- bank account details;
- passport details;
- emergency contact details; and
- next of kin details.
If you work for a Private Limited company, we may collect the following data:
- company registered address;
- company number;
- company bank details; and
- shareholder information.
Where we collect your personal data from
We obtain most of the personal data we process directly from you when you engage in a contract or work with us. We may obtain additional personal data from the following sources:
- your previous employers and education providers, whom we may ask to provide a reference;
- sources of information used for Baseline Personal Security Standard (BPSS) checks, including records of criminal offences and intelligence databases; and
- UK Security Vetting.
Lawful basis for processing your personal data
The lawful basis we rely on for most of the processing set out in this privacy notice is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract with you, or to take steps at your request to enter into a contract with you.
We also rely on article 6(1)(c), which relates to processing we are required to conduct to comply with our legal obligations. For some processing, we rely on article 6(1)(f), which relates to processing necessary for us to fulfil our legitimate interests where those interests are not overridden by your interests or fundamental rights and freedoms as a data subject.
As part of any pre-engagement and vetting checks, we process information about applicant criminal convictions and offences. We rely on the following conditions under Schedule 1, Part 1 of the Data Protection Act 2018 in order to process this data: Employment and social security.
Who we share your personal data with
If you enter a contract with us, we may share some of your personal data with:
- Xero our group wide accounting system;
- our appointed accountants, who may store information on HMRC compliant software;
- other government departments, as per any reporting requirements; and
- information used to create your supplier record will be uploaded to our internal HR & Finance systems.
For pre-engagement checks (Baseline Personnel Security Standard (BPSS) and BS7858 checks) we ask you to share your personal data with Procius Ltd – their privacy notice can be found here.
We will also share your personal data when there is a legal requirement to do so, for example with the Police or similar organisations for the prevention and detection of crime or security purposes.
For further information about our use of Artificial Intelligence (AI) and your personal data can be found in our AI policy.
How we store your personal data
We will process your data securely both at rest and in transit. We may use third party or cloud solutions to do this, but where this is done it will be encrypted and access only permitted via multi factor authentication.
The following cloud services will be used in the processing of data:
- Microsoft Office 365 – https://www.microsoft.com/en-us/TrustCenter/Security/office365-security
- AWS (Amazon Web Services) https://aws.amazon.com/compliance/
Blacksmiths has appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees who have a business need to have such access. All such people are subject to a contractual duty of confidentiality.
We have procedures in place to deal with any actual or suspected personal data breach. In the event of any such breach, we have systems in place to work with the relevant regulators. In addition, in certain circumstances (e.g. where we are legally required to do so) we may notify you of breaches affecting your personal data.
Blacksmiths is Cyber Essentials Certified.
How long we store your personal data for
Personal data captured during our pre-engagement checks and as part of our onboarding processes, including financial information, invoices and payments etc. will be retained for as long as we have a “clear business need” for them, or for six years, plus one additional full accounting year. This is in line with UK GDPR and HMRC regulations.
Data subjects may exercise their right to erasure of their personal data held by Blacksmiths Group; however this right is not absolute and only applies under specific circumstances.
| Document type | Retention period | Legal basis |
|---|---|---|
| Finance and Tax records (invoice, VAT receipts) | 6 years from the end of the tax year | HMRC requirements and tax laws |
| Supplier Contracts and Purchase Orders | 6 years from the end of the tax year after the contract ends or the business relationship terminates | HMRC requirements and tax laws |
| Supplier contact information | 3 years or delete promptly when the business contact is no longer relevant | UK GDPR storage limitation |
Your rights as a data subject
Under data protection law, you have rights with regards to your data including:
- Right of access – you have the right to ask us for copies of your personal information.
- Right to rectification – you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Right to erasure – you have the right to ask us to erase your personal information in certain circumstances.
- Right to restriction of processing – you have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Right to object to processing – you have the right to object to the processing of your personal information in certain circumstances.
- Right to data portability – you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You have the right to withhold or request we remove your data; however, this may impact our ability to meet our contractual obligations.
You are not required to pay any charge for exercising your rights. If you make a request, we have one calendar month to respond to you.
To exercise any of your data subject rights, please email info@blacksmithsgroup.com.
Please note that some of the rights listed above are situational and may be restricted in accordance with data protection law.
Making a complaint
If you have any concerns about our use of your personal data, you can make a complaint to us at info@blacksmithsgroup.com.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection. More information about your rights and how to lodge a complaint with the ICO can be found on their website.