Privacy Policy Notice
Last Reviewed: 13 August 2026 | Next Review: 13 August 2027
At Clough Harris Limited, we are committed to protecting the privacy and confidentiality of personal information entrusted to us by our customers, employees, suppliers and other stakeholders. We recognise the importance of maintaining the privacy and security of personal data and are committed to complying with applicable data protection laws and regulations, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Policy outlines our commitment to responsible data handling practices and our approach to the collection, use, disclosure, security and retention of personal information.
1. Data Collection and Use
We collect and process personal information only where it is necessary for legitimate business purposes and where we have an appropriate lawful basis to do so. Depending on the circumstances, this may include processing that is necessary for a contract, to comply with a legal obligation, for our legitimate interests, or on the basis of consent where consent is appropriate. We use personal data only for specified purposes and share or disclose it to third parties only where this is necessary, appropriate and lawful.
2. Data Security
We implement appropriate technical and organisational measures to safeguard the security and confidentiality of personal data against unauthorised access, disclosure, alteration, loss or destruction. We review our security measures as appropriate to mitigate risks and protect against data breaches.
3. Data Accuracy and Integrity
We take reasonable steps to ensure the accuracy and integrity of personal information in our possession. We maintain procedures for updating and correcting inaccurate or outdated data and respond appropriately to requests for rectification or deletion.
4. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods may vary according to the type of information and the purpose for which it is held, and we review our retention practices in line with legal requirements and data minimisation principles.
5. Individual Rights
We respect the rights of individuals in relation to their personal data and provide appropriate mechanisms for exercising those rights. Depending on the circumstances, these may include the right to access, rectify or erase personal information, restrict or object to processing, and request data portability. Where processing is based on consent, individuals may also have the right to withdraw that consent. We handle requests promptly and transparently in accordance with applicable data protection law.
6. International Data Transfers
Where personal data is transferred to a separate organisation outside the UK, we ensure that the transfer is made in accordance with applicable data protection law and that appropriate protections are in place. This may include reliance on UK adequacy regulations or other legally recognised safeguards where required.
7. Data Governance and Accountability
We maintain appropriate policies, procedures and accountability measures to support compliance with data protection law. Responsibility for data protection is assigned within our organisation, and we keep our practices under review to promote responsible handling of personal information.
8. Training and Awareness
We provide appropriate data protection and privacy training or guidance to employees and contractors according to their roles and responsibilities. We promote awareness of data protection obligations and encourage the prompt reporting of any concerns or incidents.
Key Principles of UK GDPR
Lawfulness, Fairness and Transparency: We process personal data lawfully, fairly and transparently, and provide appropriate information about how and why personal information is used.
Purpose Limitation: We collect personal data for specified, explicit and legitimate purposes and do not use it in a manner that is incompatible with those purposes.
Data Minimisation: We collect only the personal data that is adequate, relevant and limited to what is necessary for the purposes for which it is processed.
Accuracy: We take reasonable steps to keep personal data accurate and, where necessary, up to date, and to correct or erase inaccurate information without undue delay where appropriate.
Storage Limitation: We keep personal data for no longer than is necessary for the purposes for which it is processed, subject to applicable legal and regulatory requirements.
Integrity and Confidentiality: We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
Accountability: We take responsibility for complying with data protection principles and maintain appropriate records, policies and procedures to demonstrate compliance where required.
Your Individual Rights
Right of Access: You may request access to personal data held by Clough Harris Limited and information about how it is processed.
Right to Rectification: You may request the correction of inaccurate or incomplete personal data.
Right to Erasure: In certain circumstances, you may request the deletion of your personal data where there is no lawful reason for its continued processing.
Right to Restriction of Processing: In certain circumstances, you may request that the processing of your personal data is restricted.
Right to Data Portability: Where this right applies, you may request that personal data you have provided to us is supplied in a structured, commonly used and machine-readable format, or transferred to another organisation where technically feasible.
Right to Object: In certain circumstances, you may object to the processing of your personal data, including processing based on legitimate interests and processing for direct marketing.
Right to Withdraw Consent: Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Data Protection Concerns and Complaints
If you have a question, concern or complaint about the way Clough Harris Limited handles your personal information, please contact us using our published contact details. We will acknowledge receipt of a data protection complaint within 30 days and will take appropriate steps to investigate and respond without undue delay, keeping you informed as appropriate.
If you remain dissatisfied, you have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Further information is available at ico.org.uk.