Privacy Policy

Data we collect

• Identity & contact — name, business name, role, email, postal address, billing details.
• Accreditation materials — policies, RAMS, training/competence records, insurance evidence, and other documents supplied for applications/renewals. These may include details of your staff (e.g., qualifications/competence).
• Communications — emails, call notes, and messages.
• Website & device data — IP address, pages viewed, and cookie identifiers (see Cookies).
• Payment records — invoices and transaction references (no card data stored by us; any online payments use our payment provider’s secure systems).

Special category data: we do not seek to collect sensitive data. If you choose to provide it within accreditation evidence, we process it only under your instructions and with appropriate safeguards.

How we use your data

• Provide services — to scope requirements, prepare documentation, submit applications, and manage renewals.
• Operate our website & business — troubleshooting, analytics, and service improvement.
• Customer support — to respond to enquiries and provide updates on your projects.
• Legal, compliance & accounting — to meet tax, regulatory and record-keeping obligations.
• Marketing — with your consent (e.g., newsletters) or where our legitimate interests apply. You can opt out at any time.

Our lawful bases

• Contract — processing necessary to deliver our services or take steps at your request before entering a contract.
• Legitimate interests — running and improving our services, protecting our business, and communicating with existing clients and prospects in a proportionate way.
• Consent — for optional marketing and non-essential cookies. You can withdraw consent at any time.
• Legal obligation — where laws require certain records (e.g., tax/audit).

Who we share data with

We only share what’s necessary, with:

• Accreditation bodies — e.g., CHAS, Constructionline, SafeContractor, SSIP/SMAS — to submit or maintain your applications.
• Service providers — secure hosting, email, file storage, analytics, and accounting tools that process data on our behalf under contracts.
• Professional advisers — accountants, insurers, legal advisers, where necessary.
• Authorities — if required by law or to protect legal rights.

Some providers may be outside the UK/EEA; where so, we rely on appropriate safeguards (e.g., ICO-approved International Data Transfer Agreement or EU Standard Contractual Clauses).

How long we keep data

We retain personal data only as long as needed for the purposes set out above, and to meet legal/accounting requirements. Typical retention periods:

Your rights

Under UK GDPR you have the right to request access, correction, deletion, restriction, portability, and to object to certain processing (including direct marketing). Where we rely on consent, you can withdraw it at any time.

To exercise your rights, email info@towercompliance.co.uk. We will respond within one month.