Privacy Policy

Controlled corporate policy
Document reference: 03.10
Version: 3
Issue date: 11 September 2026
Review frequency: Annual

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed.

Please read the following carefully to understand how we will treat and protect your personal data.

About us

Emtec Climate Solutions Ltd is registered in England and Wales under company number 09639974. Our registered office is Unit 6 Harvard Court, Quay Business Centre, Warrington, Cheshire, WA2 8LT.

For most activities described in this policy, Emtec Climate Solutions Ltd is the data controller. This means we decide why and how personal data is used. In limited circumstances we may process personal data on behalf of a customer, in which case that customer is the data controller and we act as its data processor.

Our Data Protection Department can be contacted at our registered address or by emailing info@emteccs.co.uk.

What information we collect

Depending on your relationship with us, we may collect and use:

Identity and contact information, such as your name, job title, employer, postal address, email address and telephone number.
Customer, supplier and commercial information, including enquiries, quotations, contracts, service history, site details, purchase orders, invoices, payments and account correspondence.
Operational and technical information, including asset details, job records, engineer notes, photographs, reports, permits, access requirements and health and safety information.
Website and device information, including your IP address, browser and device details, pages viewed, referring pages, cookie identifiers and interaction data.
Marketing preferences and records of communications with us.
Recruitment information, including CVs, qualifications, employment history, references, interview notes, right-to-work information and other information supplied during an application.
Vehicle, journey and dashcam information, including registration numbers, driver identifiers, GPS location, date and time, speed, direction, ignition state, acceleration, braking, driving events and video footage.
Information contained in emails, telephone calls, meeting notes, complaints, claims and other correspondence.

Some records may incidentally contain special category data, such as health information needed for workplace safety or reasonable adjustments. We only use this information where an additional legal condition applies and appropriate safeguards are in place.

How we obtain personal data

We may obtain personal data:

Directly from you, including through our website, email, telephone, meetings, quotations, contracts, surveys or job applications.
From your employer, customer, principal contractor, facilities manager, supplier or another organisation involved in the relevant work.
From publicly available sources, professional directories, tender portals and credit-reference or due-diligence providers.
From our business systems and service providers, including Microsoft 365, HubSpot, JobLogic, Xero and Quartix.
Automatically through website technologies, vehicle tracking equipment and dashcams.

If you provide personal data about another person, you should ensure you are authorised to do so and, where appropriate, make this policy available to them.

How we use personal data

To respond to enquiries, prepare quotations and enter into and perform contracts.
To schedule and deliver work, manage variations, provide technical support and maintain service records.
To manage customer, supplier and subcontractor relationships.
To issue and pay invoices, recover debts and maintain financial and accounting records.
To manage site access, health and safety, quality assurance, audits, accreditations and incident investigations.
To operate and protect our website, communications, CRM, job-management, finance and other business systems.
To assess job applications, conduct checks and manage recruitment and employment obligations.
To send relevant business-to-business service information and marketing where permitted, and to maintain marketing preferences.
To prevent fraud and crime, protect our staff and assets, manage insurance, and establish, exercise or defend legal claims.
To comply with legal and regulatory requirements and cooperate with public authorities.

We will never sell your personal data to third parties.

Our lawful bases for using personal data

Under UK data protection law, we must have a lawful basis for each use of personal data. Depending on the circumstances, we rely on:

Contract - where processing is necessary to take steps at your request before a contract or to perform a contract with you.
Legal obligation - where processing is necessary to comply with the law.
Legitimate interests - where processing is necessary for our business or a third party, provided those interests are not overridden by your rights and freedoms. This includes delivering and improving our services, administering and protecting our business, managing our fleet and establishing or defending claims.
Consent - where consent is appropriate and required, including for certain non-essential cookies or marketing activities. You may withdraw consent at any time.
Vital interests - in rare circumstances where processing is necessary to protect someone's life.

Vehicle tracking and dashcams

We use the Quartix platform across Company vehicles to support fleet operation, health and safety, driver and vehicle security, journey and incident investigation, crime prevention and detection, and insurance or legal claims. We rely on our legitimate interests for this processing, balanced against the rights and freedoms of employees, passengers, pedestrians and other road users.

Depending on the installed equipment and configuration, the system may process vehicle location, journey times, speed, direction, ignition status, acceleration, braking, driver identifiers and dashcam footage. Audio recording is disabled by default and will not be enabled unless there is a specific, documented and lawful need.

The data is hosted in the cloud through Quartix. Emtec Climate Solutions Ltd is the data controller and Quartix acts as our data processor when providing the tracking and dashcam service. Routine footage is not ordinarily stored on Emtec systems, although an authorised person may download a relevant clip for an accident, reported incident, complaint, insurance claim, legal matter or data protection request.

Only a small, specifically authorised group may access the Quartix platform, using individual accounts and permissions. Access is limited to a genuine business need and is reviewed periodically. We display appropriate vehicle signage and provide information to employees about the system.

Footage may be shared where necessary with insurers, legal advisers, law enforcement authorities, regulators or parties involved in an incident or claim.

Who we share your information with

Where necessary and proportionate, we may share personal data with:

Customers, principal contractors, facilities managers, suppliers and subcontractors involved in delivering or receiving services.
Professional advisers, auditors, insurers, brokers, banks and finance providers.
IT, communications, hosting, CRM, job-management, finance, payment, document-storage and cybersecurity providers, including Microsoft 365, HubSpot, JobLogic, Xero and Quartix.
Regulators, accreditation bodies, HM Revenue & Customs, courts, law enforcement authorities and other public bodies where required or permitted by law.
Prospective purchasers, investors, funders or advisers involved in a merger, acquisition, reorganisation or sale, subject to appropriate confidentiality controls.
Other parties where you ask us to share information or where we have another lawful basis.

Where we store your personal data

Personal data may be stored in Company-approved systems and with service providers acting on our behalf. Some providers may store or allow access to personal data outside the UK.

Where a restricted international transfer occurs, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, binding corporate rules or another mechanism permitted by UK law. We also carry out any required transfer risk assessment and apply appropriate safeguards.

Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, tax, health and safety, insurance and reporting requirements, resolve disputes and establish or defend legal claims.

Contracts, customer, supplier and financial records are normally retained for six years after the relevant transaction or end of the relationship, unless a longer period is required.
Unsuccessful recruitment records are normally retained for up to six months after the recruitment decision, unless a longer period is justified or agreed.
Marketing records are retained until you opt out or the information is no longer relevant. We may retain a limited suppression record to respect your preference.
Routine dashcam footage is retained for the shortest configured period necessary. Quartix states a maximum retention period of six months. Relevant clips may be preserved for longer where required for an incident, complaint, insurance claim, legal proceedings or a legal obligation.
Vehicle tracking and telematics information is retained for the configured Quartix period necessary for the documented fleet purposes and is reviewed periodically.
Website and cookie information is retained for the period stated through the relevant cookie tool or notice.

Data security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure or access. These include access controls, individual user accounts, device and network security, backup arrangements, staff awareness and contractual controls for service providers. Access is limited to people who need the information for their role.

Your rights

Depending on the circumstances, you may have the right to:

Be informed about how your personal data is used.
Request access to the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to erase data where there is no good reason for us to continue using it.
Ask us to restrict how data is used.
Receive certain data in a portable format.
Object to processing based on legitimate interests and object at any time to direct marketing.
Withdraw consent at any time where we rely on consent.
Ask for safeguards relating to solely automated decisions that produce legal or similarly significant effects.

These rights are not absolute and exemptions may apply. We may need to verify your identity before responding. We normally respond within one month and do not charge a fee, although the law allows fees or refusal in limited circumstances involving manifestly unfounded or excessive requests.

Automated decision-making

We do not currently make decisions about individuals based solely on automated processing where the decision produces legal or similarly significant effects. If this changes, we will provide the information and safeguards required by law.

Data breaches

We have procedures for responding to suspected personal data breaches. Where required by law, we will notify the Information Commissioner's Office and affected individuals within the applicable timescales.

How we use cookies

Our website may use essential cookies and, where permitted, analytics or marketing cookies. Cookies and similar technologies help us operate and protect the site, understand how it is used and improve its content and performance. You can manage non-essential cookies through the website cookie controls.

Third-party links

Our website may contain links to third-party websites. Those organisations are responsible for their own privacy policies and practices. Please review their privacy information before providing personal data to them.

Changes to this policy

We keep this privacy policy under regular review and will publish material changes on our website. Where appropriate, we may also tell affected individuals directly. This policy was last updated in September 2026 and replaces the version dated 19 March 2019.

How to contact us

Please contact us if you have a question, wish to exercise a right or are concerned about how we use personal data. You can email info@emteccs.co.uk, use the contact form on our website, or write to: Data Protection Department, Emtec Climate Solutions Ltd, Unit 6 Harvard Court, Quay Business Centre, Warrington, Cheshire, WA2 8LT.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority. Information about making a complaint is available at ico.org.uk/make-a-complaint.

Policy Review & Approval

This policy will be reviewed annually by the CEO and updated where required to reflect changes in legislation, regulation, recognised best practice and company arrangements.

Signed: __________________________________
CEO: Marc Rigby
Date: 11 September 2026