Privacy Policy

Banyard Consultants Limited (the Company) has its registered office at 28-30, Worship Street, London, EC2A 2AH.

We are committed to protecting your personal data in line with the relevant legislation (“Data Protection Law”). The relevant legislation includes the General Data Protection Regulation (EU 2016/679) and the UK Data Protection Act 2018, as well as other potentially supporting legislation.

WHAT THIS POLICY IS FOR

This policy is intended to provide information about how we will use (or “process”) personal data about individuals including: our staff (including consultants); our current, past and prospective clients, consultants, suppliers and other third parties as well as visitors to our website.

This information is provided in accordance with the rights of individuals under Data Protection Law to understand how their data is used.

This Privacy Notice applies alongside any other information the Company may provide about a particular use of personal data, for example when collecting data via an online or paper form.

This Privacy Notice also applies in addition to the Company’s other relevant terms and conditions and policies, including:

• The Data Protection policy;


• Any contract between the Company and its staff or clients;


• The Staff Fair Processing Notice;


• Retention of Records Policy;


• The Company’s IT Information Security, Computing & Equipment Policy (Handbook section 7)

Anyone who works for, or acts on behalf of, the Company (including staff and consultants) should be aware of and comply with the Company’s Data Protection Policy and the Staff Fair Processing Notice, which also provides further information about how personal data about those individuals will be used.

RESPONSIBILITY FOR DATA PROTECTION

The Company has appointed Mike Evans to oversee its role as Data Protection Manager (DPM), who will deal with all your requests and enquiries concerning the Company’s uses of your personal data (see section on Your Rights below) and endeavour to ensure that all personal data is processed in compliance with this policy and Data Protection Law.

Mike Evans may be contacted by:

• E-mail: mike.evans@banyards.co.uk


• Telephone: 020 3793 6250


• Post: Banyard Consultants, 28-30, Worship Street, London, EC2A 2AH

WHY THE COMPANY NEEDS TO PROCESS PERSONAL DATA

In order to carry out its ordinary duties to staff and clients, the Company may need to process a wide range of personal data about individuals (including current, past and prospective staff and clients) as part of its daily operation.

The Company will need to carry out some of this activity in order to fulfil legal rights, duties or obligations – including those under a contract with its staff, or clients.

Other uses of personal data will be made in accordance with the Company’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals, and provided it does not involve special categories of personal data.

The Company expects that the following uses may fall within the category of its “legitimate interests”:

• To provide building services design, commissioning management, building information modelling and commissioning validation services to clients;


• Maintaining relationships with clients and the business community;


• For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as diversity or gender pay gap analysis and taxation records);


• To give and receive information and references about past, current and prospective members of staff;


• To monitor (as appropriate) use of the Company’s IT and communications systems in accordance with the Company’s IT Information Security, Computing & Equipment Policy;


• For security purposes, including the door entry system; and


• Where otherwise reasonably necessary for the Company’s purposes, including to obtain appropriate professional advice and insurance.

In addition, the Company may need to process special category personal data (concerning health, ethnicity or sexual life) or criminal records information (such as when carrying out DBS checks) in accordance with rights or duties imposed on it by law, or from time to time by explicit consent where required. These reasons may include:

• In connection with employment of its staff, for example DBS checks, welfare or pension plans;


• For legal and regulatory purposes (diversity monitoring and health & safety) and to comply with its legal obligations and duties of care.

TYPES OF PERSONAL DATA PROCESSED BY THE COMPANY

This will include by way of example:

• Names, addresses, telephone numbers, e-mail addresses and other contact details;


• Bank details and other financial information; and


• Where appropriate, information about individuals’ health, and contact details for their next of kin.

HOW THE COMPANY COLLECTS DATA

Generally, the Company receives personal data from the individual directly. This may be via a form, or simply in the ordinary course of interaction or communication (such as verbally, by e-mail or by written documents).

However in some cases personal data may be supplied by third parties (for example another employer, or other companies or authorities working with that individual).

DATA COLLECTED THROUGH OUR WEBSITE

We may collect the following information from visitors to our website;

• IP addresses and information about the location of the visitor


• The way that a visitor uses the website, including the pages viewed, dates, times and duration


• Data to show where visitors navigated to or from our website and searches made on our website.

This data is used to enable us to;

• Run the website ensuring that it works properly


• Improve the information on the website


• Maintain the websites security

Cookies are a piece of data which a website sends to a user’s computer. It is stored on the user’s computer and can be used to collect information on their site usage. We use cookies to identify how many users visit each page of our website so that we can improve the websites value to our visitors. We do not use cookies in any way which would allow us to identify visitors to our website. If you want to block cookies then you can do so through your web browser or through other software but in doing so you may find that you will be unable to visit some or all of our website.

WHO HAS ACCESS TO PERSONAL DATA AND WHO THE COMPANY SHARES IT WITH

Occasionally, the Company will need to share personal information with third parties, such as professional advisers (lawyers and accountants) or relevant authorities (HMRC, police or the local authority).

For the most part, personal data collected by the Company will remain within the Company, and will be processed by appropriate individuals only in accordance with access protocols (ie. on a “need to know” basis). Particularly strict rules of access apply in the context of:

• Medical records;


• Financial information.

Finally, in accordance with Data Protection Law, some of the Company’s processing activity is carried out on its behalf by third parties, such as IT systems, web hosting or cloud services and storage providers. This is always subject to undertakings from such third parties that personal data will be kept securely and only in accordance with the Company’s specific direction.

HOW LONG WE KEEP PERSONAL DATA

The Company will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason.

If you have any specific queries about how this policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the DPM. However, please bear in mind that the Company may have lawful and necessary reasons to hold on to some data.

YOUR RIGHTS

Individuals have various rights under Data Protection Law to access and understand personal data about them held by the Company, and in some cases ask for it to be erased or amended or for the Company to stop processing it, but subject to certain exemptions and limitations.

Any individual wishing to access or amend their personal data, or wishing it to be transferred to another person or organisation, should put their request in writing to the DPM.

The Company will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within the statutory time-limits, which is one month in the case of requests for access to information. The Company will be better able to respond quickly to smaller, targeted requests for information. If the request is manifestly excessive or similar to previous requests, the Company may ask you to reconsider or charge a proportionate fee, but only where Data Protection Law allows it.

You should be aware that certain data is exempt from the right of access. This may include information which identifies other individuals, or information which is subject to legal professional privilege.

CONSENT

Where the Company is relying on consent as a means to process personal data, any person may withdraw this consent at any time. Please be aware however that the Company may have another lawful reason to process the personal data in question even without your consent. That reason will usually have been asserted under this Privacy Notice or may otherwise exist under some form of contract or agreement with the individual (for example: an employment contract).

DATA ACCURACY AND SECURITY

The Company will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must please notify the DPM of any changes to information held about them.

An individual has the right to request that any inaccurate or out-of-date information about them is erased or corrected (subject to certain exemptions and limitations under Act): please see above.

The Company will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to company systems. All staff will be made aware of this policy and their duties under Data Protection Law and receive relevant training.

QUERIES AND COMPLAINTS

Any comments or queries on this policy should be directed to the DPM.

If an individual believes that the Company has not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should notify the DPM. An individual can also make a referral to or lodge a complaint with the Information Commissioner’s Office (“ICO”), although the ICO recommends that steps are taken to resolve the matter with the Company before involving the regulator.