About Us.

Cook Fabrications Ltd is a well-established highly regarded construction company specialising primarily in
manufacturing and erecting metallic structures for the building and civil engineering industries. Many of
our clients are limited companies, therefore the personal information processed relating to individuals is
limited to a few clients who are sole traders, private customers, staff, suppliers, and contractors. We
employ up to 50 people at any one time, most of our workforce are involved in physical engineering work
requiring very limited access to personal data.

Cook Fabrication Ltd is registered as a Data Controller, with the Information Commissioners Office
registration number ZA322811.

Our company address is:

Broomfield Works Fernfield Lane
Hawkinge
Folkestone
Kent
CT18 7AW

Email info@cookfabrications.co.uk
Telephone no 01303 893011.

Our Commitment to Data Security.

Our Managing Director oversees all matters relating to data protection on behalf of the company. We are
also supported by an independent data protection specialist company who provide advice and support
when necessary.

The company providing this service is:
Ferguson West Ltd
6 Harvest Way
Hawkinge
Kent
CT 18 7PE.

Telephone No 07920 840782
www.fergusonwest.co.uk
Email fergusonwestltd@sky.com

The type of data we collect

• Full name
• Postal address
• Age
• Date of Birth
• Mobile phone number
• Telephone number
• Next of kin information
• IP address
• Email addresses
• NI Number
• Professional accreditation
• CCTV images & geolocation
• Reports of workplace incidents and HR Procedures

Why we collect and use this data.

• To operate and manage our business and to support customers, suppliers, employees, and
  contractors.
• To meet our statutory obligations as contained in various pieces of legislation affecting
  employment, such as and without limitation, employment law, equality, road traffic legislation and
  health and safety in the workplace.
• To enable us to manage logistics, staff deployment and availability, staff development and to assist
  manage staff performance, and conduct.
• To safeguard our staff against potential harm.
• To provide welfare support.
• To promote the company.

Our Lawful Grounds

When providing you with information about us and our products

Lawful Basis

We provide updates on the work we perform and the products we manufacture using our website, SMS, by
email and by post. We only provide you with this type of information on request. You can withdraw your
consent at any time. (Article 6(1)(a)

Who its shared with

We do not share personal information derived from this source unless we are under a legally obligation to
do so.

When establishing or managing a contractual agreement with you

Lawful Basis

It is necessary to collect and process your personal information to provide a quote, to establish an account
with you and to provide you with services or products as part of a contractual agreement (Article 6(1)(b).

Who its shared with

Our staff, management team, contractors and suppliers when required.

When it’s necessary for the management of our business

Lawful Basis

It is both necessary and within our legitimate interests to process your personal information to enable our
business to function; examples include providing quotes, methods of works, plans and designs, invoicing,
workforce planning and maintaining business relationships with the other companies such as suppliers,
and accounting. We take great care to maintain a balance our own processing needs by ensuring they do
not compromise the interests, rights, and freedoms of the data subjects whose personal information we
use. (Article 6(1)(f)

Who its shared with

Our staff, management team, contractors and suppliers when required.

If you are an employee, contractor, or visitor to our workshops.

Lawful Basis

We need to collect adequate and relevant personal information as part of recruiting and hiring staff who.
This process is called entering into a contract. Once offered employment you will be issued with a contract
setting out in detail the terms and conditions for your employment. Article 6(1)(b)

We use CCTV at our business premises to assist prevent crime and to safeguard the health and safety of
staff and others using the building. We also use vehicle tracking systems on our commercial vehicle fleet
which is necessary for safety, compliance with road traffic legislation and for logistical planning purposes.
We take all reasonable steps to balance your own legitimate interest in terms of your rights, freedoms, and
privacy with those of our own. Article 6(1)(f)

In certain circumstances it will be necessary for us to collect and process what is called special category
data, or criminal data. Examples might include specifics about your health where that is relative to your
work, your ethnicity or religion, previous criminal convictions, or motoring convictions. Our purpose for
doing so is to fulfil our obligations in the field of employment, social security, and social protection law.
Article 9(2)(b)

In rare and exceptional circumstances should you be taken ill or are injured at work; we may need to share
your personal information with the emergency services or health care professionals if it is in your vital
interests for us to do so. Article 9(2)(c)

Who its shared with

Managers, supervisors, staff with administrative responsibilities, legal firms and specialist consultants and
public authorities.

When we are required to process information following a legal request

Lawful Basis

In certain circumstances we may be required to share personal information with law enforcement
authorities or regulatory bodies, such as HMRC, the police, HSE etc. This might be carried out without your
knowledge or consent. (Article 6(1)© & Article 9(1)(g)

Who its shared with

A court, government body or law enforcement agency.

Using Our Website

We have published a separate cookie policy specifically setting out how we use your data when accessing
our website.

How we keep your information safe

We fully understand the importance and duty we have to protect your privacy. We take appropriate
organisational and technical steps to safeguard it whilst it’s in our care. This includes:

• Restricting access to only those persons who require it to perform their work;
• Using encrypted computers;
• Ensuring our staff are trained relative to their role so they fully understand potential risks;
• By using adequate and proportionate technical and physical security solutions;
• When transferring data to a third party, sending it securely with the appropriate measures in place,
  which might include using encryption or password protection, or a reliable secure courier;
• When taking files and records off site for business purposes;
• When deleting or destroying records or dispensing with IT equipment

International transfers

The data that we collect from you is stored and hosted in the European Economic Area (“EEA”). Following
Brexit in June 21, the UK has been deemed adequate in terms of EU data protection legislation, therefore
many of the GDPR rules are contained in the Data Protection Act 2018 and are still applied. We do not
knowingly share or outsource the processing of data beyond the EEA.

How long do we keep your data

We do not retain personal data for longer than is necessary for us to fulfil our intended processing
purpose. In most circumstances this will never exceed 6 years unless we are required to do so for legal or
regulatory reasons, such as health and safety or taxation.

Your rights

You have the right to access your personal data, and any such requests made to us shall be dealt within the
legal time limits set.

Your rights include:

• The right to be informed about the collection and use of your personal data. This is a key transparency
  requirement of the legislation;
• The right to access information held about you;
• The right to have inaccurate personal data rectified or completed if incomplete;
• The right to have personal data erased;
• The right to request the restriction or suppression of the processing of your personal data;
• The right to data portability;
• The right to object to the processing of their personal data in certain circumstances;
• Rights in relation to automated decision making and profiling.

Changes to this privacy notice

Our privacy notice is reviewed every 12 months and was last updated on 25-May-2023.

If you wish to complain

Please contact our office using the details published earlier in this notice. You also have the right to
complain to the regulatory body for the UK, the Information Commissioners Office, www.ico.org.uk if you
believe we have breached the data protection act.