This Privacy Policy explains how Britannia NYC collects, uses, stores and protects your personal data when you visit our website, make an enquiry, apply for a job, or engage with us as a client, supplier or subcontractor. We take your privacy seriously and are committed to handling your information fairly and transparently in line with UK data protection law. Please read this policy carefully. If you have any questions, you can contact us using the details at the bottom of this page.

Who We Are

Britannia NYC is the data controller responsible for your personal data. As data controller, we determine the purposes and means by which your personal data is processed. For data protection queries, Subject Access Requests, or any concerns about how we handle your information, please contact our Data Protection Lead:

• Email: info@britannianyc.com
• Postal address: Britannia NYC

Under The Electronic Commerce (EC Directive) Regulations 2002 and the Companies Act 2006, we are required to make certain company details available on our website. If you need our company registration details, please contact us directly.

What Personal Data We Collect

We collect personal data in a number of ways — some you give us directly, some is collected automatically when you use our website, and some may come from third parties such as recruitment agencies or public registers.

Data you provide directly

• Contact details: your name, email address, telephone number and postal address
• Company details where you contact us as a business client or subcontractor
• Project information included in enquiry or quotation requests
• CVs, cover letters, references and right-to-work documents submitted as part of a job application
• Payment information where a deposit or advance payment is taken (we do not store full card numbers)

Data collected automatically

• Your IP address and device identifiers when you visit our website
• Analytics and usage data — pages visited, time spent, referring website
• Cookies and tracking identifiers (see our Cookie Policy and the cookies section below)

Data from other sources

• Information received from recruitment agencies or job boards when you apply for a role
• Subcontractor or supplier details passed to us by clients or project partners
• Publicly available information from companies registers where relevant to a business relationship

Site photographs and CCTV

We may take photographs of completed projects and active construction sites. Where images include identifiable individuals — such as clients, subcontractors or members of the public — those images constitute personal data. We explain below how we handle consent and lawful basis for publishing such images. Where CCTV is operated on construction sites, footage is recorded and retained as described in the CCTV section of this policy.

Lawful Basis for Processing

UK GDPR requires that every time we process personal data, we have a lawful basis for doing so. The six lawful bases are: consent, performance of a contract, legal obligation, vital interests, public task, and legitimate interests. Below we explain which basis we rely on for each type of processing we carry out.

Enquiries and quotation requests

We process your contact details and project information on the basis of legitimate interests — it is reasonable to expect that if you send us an enquiry, we will use that information to respond. Where consent is more appropriate (for example where you opt into further contact beyond your enquiry), we will ask for it explicitly.

Contracts and project delivery

Once a contract is in place, we process your personal data on the basis of performance of a contract and, where relevant, legal obligation — for example retaining invoices and financial records in line with HMRC requirements.

Job applications and recruitment

We process recruitment data on the basis of legitimate interests (assessing your suitability for a role) or, where required, legal obligation (such as right-to-work checks). Where we need to process special category data — for example health information to consider reasonable adjustments — we will only do so where necessary and will apply appropriate safeguards. Explicit consent or a specific statutory basis will be relied on where required.

Marketing and newsletters

We rely on consent for electronic marketing (emails, SMS). Under the Privacy and Electronic Communications Regulations (PECR), we must have your prior consent before sending marketing emails — unless you are an existing customer and we are promoting similar services (the “soft opt-in” exception). Even then, we will always give you a clear opportunity to opt out. You can withdraw consent at any time using the unsubscribe link in any email or by contacting us directly.

Analytics and site monitoring

We use analytics tools (such as Google Analytics) to understand how visitors use our website. Where this relies on cookies placed on your device, your consent is required before non-essential cookies are set. See the cookies section below.

CCTV

Where we operate CCTV on construction sites, we rely on legitimate interests — specifically site security, health and safety, and theft prevention. We carry out a balancing assessment to ensure these interests are not overridden by the rights of individuals whose images are captured.

How We Use Your Data

Responding to enquiries and preparing quotations

When you contact us through the website or by phone or email, we use your name, contact details and project information to respond to your enquiry, prepare quotations and follow up where appropriate. Your IP address may also be processed for website security and fraud prevention. The lawful basis is legitimate interests.

Managing contracts and delivering projects

Once you become a client or we engage you as a subcontractor or supplier, we process contract details, site addresses, health and safety information, scheduling data and invoices. This is necessary for performance of a contract and, in some cases, to comply with legal obligations such as tax and accounting records.

Job applications and HR

We process CVs, application materials, references and supporting documents to assess applications for roles within the business. Where a role requires criminal records checks or involves access to sensitive sites, we may process additional data with appropriate safeguards. Unsuccessful applicants’ data is typically retained for 6 to 12 months. If you are offered and accept a role, your data is transferred to your personnel file and retained in line with employment, payroll and pension obligations.

Marketing communications

If you have consented to receive our newsletter or marketing emails, we will use your name and email address for that purpose. You can opt out at any time. We do not sell your data to third parties for their marketing purposes.

Analytics and website improvement

We use analytics data to understand how visitors find and use our website, which helps us improve content and user experience. Analytics cookies are only placed with your consent. You can manage your preferences through our cookie settings at any time.

Project photography

We may publish photographs of completed projects on our website, social media and marketing materials. Where photographs include identifiable individuals, we will seek consent where practicable or carry out a legitimate interests assessment where consent is not feasible. If you appear in a published photograph and would like it removed or altered, please contact us.

Cookies and Tracking Technologies

Cookies are small text files stored on your device when you visit a website. Some cookies are essential for the website to function; others help us understand how you use the site or support marketing activity. Under ICO guidance on cookies and similar technologies, non-essential cookies — including analytics and advertising cookies — require your prior consent before being placed on your device. We will not set non-essential cookies until you have actively accepted them through our cookie banner.

Cookie categories we use

• Strictly necessary: Essential for the website to function (for example, session cookies). These do not require consent.
• Preference cookies: Remember your settings and choices on the site.
• Analytics cookies: Tools such as Google Analytics that help us understand visitor behaviour. These are only placed with your consent.
• Marketing and advertising cookies: Third-party pixels or tracking tools used to measure or serve advertising. These are only placed with your consent.
• Social media plugins: Embedded content or share buttons from platforms such as LinkedIn or Instagram may set their own cookies if you interact with them.

You can withdraw or change your cookie consent at any time using the cookie settings link on our website, or by adjusting your browser settings. Please note that blocking certain cookies may affect how the website works. Full details of the specific cookies we use — including provider, purpose, retention period and any data transfers outside the UK — are set out in our separate Cookie information.

Third Parties, Processors and Subcontractors

We share personal data with third parties only where necessary and only in the circumstances described below. Where third parties process data on our behalf, they act as data processors and are bound by written Data Processing Agreements. We remain the data controller and are responsible for ensuring your data is handled lawfully.

Categories of recipients

• Website hosting and content delivery: Our website and its data are hosted by a third-party provider. They process data only on our instructions.
• CRM and project management tools: We may use software platforms to manage client relationships and project administration.
• Analytics providers: Such as Google Analytics, which process usage data to help us understand website performance.
• Payment processors: Where deposits or payments are taken online, a payment gateway provider processes card data securely. We do not store full payment card details.
• Recruitment platforms: Job boards or recruitment agencies where roles are advertised may share applicant data with us under their own terms.
• Insurers and legal advisors: Where a legal claim or insurance matter arises, we may share relevant data with our insurers or solicitors.
• Subcontractors and project partners: Contact details or health and safety information may be shared with subcontractors working on a project where necessary for scheduling, site access or compliance.
• HMRC and regulatory bodies: Where required by law, we may disclose data to HMRC or other regulators.

We do not sell personal data. We do not share it with third parties for their own marketing purposes.

International Transfers

Some of the third-party providers we use — including certain analytics, cloud hosting or software platforms — may process data outside the United Kingdom or the European Economic Area. Where this is the case, we ensure that appropriate safeguards are in place before any transfer occurs. Safeguards may include:

• UK-approved Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs)
• Transfers to countries covered by a UK adequacy decision
• Vendor certification or binding corporate rules where applicable

You can request further information about the safeguards we use for international transfers by contacting our Data Protection Lead using the details at the bottom of this policy. Further information on international transfer rules is available through the ICO’s UK GDPR guidance.

How Long We Keep Your Data

We only keep personal data for as long as it is needed for the purpose for which it was collected, or for as long as we are required to by law. Below are examples of the retention periods we apply. These reflect good practice based on applicable legal limitation periods and regulatory requirements, though exact periods may vary depending on individual circumstances.

• Enquiry and contact form records: Up to 1 year after last contact, unless the enquiry leads to a contract — in which case project records are retained for up to 6 years after the contract ends.
• Contracts, invoices and project records: Up to 6 years after completion. This reflects the standard limitation period for contract claims in England and Wales and accounting obligations.
• Tax and payroll records (employees): Typically up to 6 years, in line with HMRC requirements.
• Unsuccessful job applications: 6 to 12 months after the recruitment process concludes, unless you consent to us retaining your details for future opportunities.
• Employee personnel files: Retained for the duration of employment and for a reasonable period thereafter in line with employment, pension and tax obligations.
• CCTV footage: Typically 30 days, unless footage is required in connection with an incident, investigation, insurance claim or legal proceeding.
• Marketing consent records: Retained until consent is withdrawn and for a period after to maintain an audit trail of when and how consent was given.

Some data must be kept for longer than our standard periods where there is a legal obligation to do so — for example in the event of an ongoing legal dispute or regulatory investigation. When data is no longer needed, we delete or anonymise it securely.

CCTV and Site Photography

CCTV on construction sites

Where CCTV is used on or around construction sites we manage, the purpose is site security, health and safety monitoring, and theft or vandalism prevention. Our lawful basis is legitimate interests, supported by a balancing assessment that takes into account the safety environment of an active construction site. In line with the ICO’s CCTV Code of Practice, we will:

• Display clear and visible signage where CCTV is in operation
• Limit access to footage to authorised personnel only
• Retain footage for no longer than approximately 30 days unless required for an investigation, insurance purpose or legal claim
• Share footage with law enforcement or insurers only where legally justified

If you believe you have been recorded and wish to request access to CCTV footage in which you appear, please contact us. We will handle your request as a Subject Access Request and may need to verify your identity and redact third parties before disclosure.

Project photography

We may photograph completed or ongoing projects for use on our website, in tender documents or on social media. Where photographs include identifiable individuals, we treat those images as personal data. We will seek consent from individuals where this is practical — for example through a client agreement or written consent form. Where consent is not feasible (for example, images of a public street taken incidentally), we carry out a legitimate interests assessment. If you appear in a photograph published by us and would like it removed or for your face to be obscured, please reach out, and we will consider your request promptly.

Job Applicants and HR Data

When you apply for a position with us — whether directly through our website, by email or via a recruitment platform — we collect and process the following types of data:

• Your name, contact details and CV
• Right-to-work documents (as required by law)
• References from previous employers
• DBS or criminal records check results, where applicable to the role
• Health or disability information where provided in connection with a request for reasonable adjustments
• Equality monitoring data where you voluntarily provide it (processed separately and on an anonymised basis)

We process most recruitment data on the basis of legitimate interests (assessing your suitability for the role) or legal obligation (right-to-work verification and tax requirements). Health and disability information is special category data under UK GDPR and is processed only where necessary, with appropriate safeguards in place. If your application is unsuccessful, we will typically retain your details for 6 to 12 months and then delete them securely, unless you consent to us keeping your CV for future opportunities. If you are offered a role and accept it, your data will be transferred to your personnel file and retained in line with employment law, payroll obligations and pension requirements. Where we advertise roles through third-party job boards or recruitment agencies, those platforms act as separate controllers or processors and have their own privacy policies.

Your Data Protection Rights

Under UK GDPR, you have a number of rights in relation to your personal data. These are not absolute rights — some are subject to exceptions — but we will always consider your request carefully and respond within the required timeframe.

Your rights include

• Right of access: You can request a copy of the personal data we hold about you (a Subject Access Request or SAR).
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your data in certain circumstances — for example where it is no longer needed for the purpose it was collected, or where you withdraw consent.
• Right to restrict processing: You can ask us to pause processing your data in certain situations.
• Right to object: You can object to processing based on legitimate interests, and you have an absolute right to object to direct marketing at any time.
• Right to data portability: Where processing is based on consent or contract and carried out automatically, you may request your data in a structured, commonly used format.
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

How to make a request

To exercise any of these rights, please contact our Data Protection Lead by email or post using the details at the bottom of this policy. We aim to respond within one calendar month of receiving your request, as required by ICO guidance on Subject Access Requests. In some cases — for example where a request is complex or we receive multiple requests — we may extend this by a further two months. We will let you know if that is the case. We may need to verify your identity before processing a request, to prevent unauthorised disclosure of someone else’s data. We will not charge a fee for most requests, though we may charge a reasonable fee for manifestly unfounded or excessive requests.

Security Measures and Data Breaches

We take the security of your personal data seriously and have put technical and organisational measures in place to protect it against accidental loss, unauthorised access, disclosure or destruction.

What we do to protect your data

• Our website uses HTTPS encryption (TLS) for data in transit
• Access to personal data is restricted to those who need it for their role
• We use role-based access controls on our internal systems
• Data stored digitally is protected with appropriate technical measures including secure backups
• Staff receive training on data protection obligations
• We carry out due diligence on third-party vendors before sharing data with them

If a data breach occurs

Despite our best efforts, no system is entirely immune to security incidents. In the event of a personal data breach, we will investigate and contain the incident promptly. If the breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware, as required by UK GDPR. Where a breach is likely to result in a high risk to individuals, we will also notify those individuals directly. If you suspect that your personal data has been compromised or you believe there has been a breach involving our systems, please contact us immediately using the details below.

Automated Decision-Making and Profiling

We do not currently make decisions about individuals using solely automated processing that produce legal or similarly significant effects. This means no automated system will make a final decision about your job application, contract eligibility or any other matter that significantly affects you without human review. We may use basic analytics tools that segment website visitors by behaviour — for example, understanding which pages are most visited by different groups. This is low-impact and does not result in decisions about individuals. You can manage your preferences for analytics cookies through our cookie settings. If we introduce automated decision-making or profiling that has a more significant impact, we will update this policy and ensure appropriate safeguards and rights are in place, in line with ICO guidance on UK GDPR.

Complaints and the ICO

If you have a concern about how we have handled your personal data, we encourage you to contact us in the first instance. We will investigate your concern and aim to respond within one month. To raise a concern with us: Email: info@britannianyc.com Or write to: Britannia NYC, [Registered Office Address] If you are not satisfied with our response, or you feel we have not dealt with your concern properly, you have the right to complain to the Information Commissioner’s Office (ICO) — the UK’s independent supervisory authority for data protection.

• ICO website: ico.org.uk
• ICO helpline: 0303 123 1113
• ICO postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You also have the right to seek a judicial remedy if you believe we have infringed your rights under UK GDPR.

Changes to This Policy

We review this Privacy Policy at least annually, and also whenever there is a change to how we process personal data or when the law requires it. Any material changes will be published on this page with an updated review date at the top. If a change significantly affects how we use your data — for example a new processing purpose — we will make reasonable efforts to notify you directly where we hold your contact details, in addition to updating this page. We encourage you to check this page periodically so you are always aware of our current practices.

Contact Us and Further Information

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or want to make a Subject Access Request, please get in touch with our Data Protection Lead:

• Email: info@britannianyc.com
• Postal address: Britannia NYC, [Registered Office Address]

To withdraw consent for marketing, you can use the unsubscribe link in any marketing email we send, or contact us directly and we will remove you promptly. To make a Subject Access Request, please email us with your name, contact details and a description of the data you would like to access. We may ask for proof of identity before proceeding. We will acknowledge your request and aim to respond within one calendar month.

Related Policies and Legal Notices

This Privacy Policy should be read alongside our other website legal notices:

• Cookie Policy: Full details of the cookies and tracking technologies we use, including provider names, purposes, retention periods and any international data transfers involved. Please refer to our Cookie Policy for the complete cookie table.
• Terms and Conditions: The terms governing use of our website and any services engaged through it.
• Accessibility: We aim to make our website accessible to all users. Our approach to accessibility follows UK accessibility requirements and WCAG best practice guidelines under the Equality Act 2010.

If you have difficulty accessing any part of this policy or our website, please contact us and we will do our best to assist.