Privacy policy

This policy explains how Garrison Facilities Management Ltd ("Garrison FM", "we", "us") collects and uses personal data. We are the controller of the personal data described here, which means we decide how and why it is used.

We are a company registered in England and Wales under company number 17444832. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

For anything about this policy or your data, email info@garrisonfm.co.uk or call 07808 153514. Please put "Data protection" in the subject line so it reaches the right person quickly.

This policy applies to personal data about:

• People who visit garrisonfm.co.uk
• People who contact us by the enquiry form, email or phone
• Clients and their staff, agents and contacts
• People we meet or record information about at buildings we inspect, such as residents, staff and contractors

When we carry out work for a client, the client usually decides what happens to information about their building and the people in it. In that case we may act on the client's instructions as their processor, and the client's own privacy notice also applies.

Enquiries. When you send the enquiry form, email or call us, we collect what you give us:

• Your name, email address, phone number and role
• Building details: building type, number of buildings, postcode and the date of the current fire risk assessment
• Anything you write in your message or tell us on the phone

Clients. If you become a client, we also hold contact and billing details, the agreed quote and correspondence about the work.

Site visits. During a fire risk assessment or fire door inspection we record observations about the building. This can include the names and roles of people we speak to, and photographs. We take photographs of building features, not of people, and we avoid capturing anyone in them where we can. We do not ask residents or staff about their health. If a client asks us to record information about someone who would need help to evacuate, we only record what is needed for fire safety and we treat it as special category data, described below.

Website visits. The website uses Vercel Web Analytics to count page views. It does not use cookies and does not identify you. Our hosting provider also keeps short-term server logs, which include IP addresses, to keep the website secure and working.

We do not use the website to collect payment details, and we do not buy personal data from third parties.

UK data protection law says we must have a lawful basis for each use of personal data. Ours are:

• Replying to your enquiry and giving you a quote: steps taken at your request before entering into a contract, or our legitimate interest in replying to people who contact us
• Carrying out and reporting on the work you book: performance of our contract with you, or our legitimate interest in delivering work for a client who has engaged us
• Invoicing, accounting and keeping business records: compliance with our legal obligations under tax and company law
• Keeping records of our work so we can deal with questions or claims about it later: our legitimate interest in defending our work
• Keeping the website secure and understanding how it is used: our legitimate interest in running a secure, working website

Where we rely on legitimate interests, we have considered whether your interests or rights override ours. You can ask us for details of that assessment.

Special category data. If we record information about someone's health to help with their evacuation, we do so only on a client's instructions and only where the law allows. That is usually because the processing is needed for the client's obligations under fire safety law, or because the person has given explicit consent.

Marketing. We do not send marketing emails unless you ask for them, and we do not sell personal data.

Automated decisions. We do not make decisions about people by automated means alone.

We use service providers to run our business. They process personal data on our behalf, under written contracts, and only on our instructions:

• Vercel Inc., which hosts the website and provides cookie-free visitor statistics
• Resend, which delivers enquiry form submissions to our inbox
• Squarespace and Mailgun, which forward email sent to our domain
• Google, which provides our email and document storage
• Software providers we use to write, store and send reports

We may also share personal data with our accountants, insurers and professional advisers; with a client, where the data is part of the work they engaged us to do; with a fire and rescue authority, court or regulator where the law requires it; and with a buyer if our business, or part of it, is sold.

Some of our service providers process data outside the UK, mainly in the United States. When they do, we rely on a safeguard UK law allows: UK adequacy regulations, such as the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum. You can ask us for details of the safeguard for a particular provider.

We keep personal data only as long as we need it:

• Enquiries that do not lead to work: 2 years from our last contact
• Client records, quotes, invoices and correspondence: 6 years after the end of the financial year in which the work finished
• Fire risk assessment and fire door inspection reports, site notes and photographs: 15 years from the date of the report, because claims about professional work can be made up to 15 years later under the Limitation Act 1980
• Server logs held by our hosting provider: a short period set by that provider, usually days

After these periods we delete the data or anonymise it so it no longer identifies anyone.

We use providers with recognised security standards, the website runs over an encrypted connection, and access to our email and records is limited to the people who need it. If a personal data breach happens, we will report it to the Information Commissioner's Office within 72 hours where the law requires, and tell the people affected where it puts them at high risk.

Under UK data protection law you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct data that is wrong or incomplete
• Delete your data
• Restrict how we use your data
• Give you your data in a portable format, or send it to another organisation
• Stop using your data where we rely on legitimate interests
• Stop using your data for marketing, at any time

Some rights apply only in certain circumstances, so we may not be able to do everything you ask. If so, we will explain why. Where we rely on your consent, you can withdraw it at any time.

To use any of these rights, email info@garrisonfm.co.uk. We may ask you to confirm your identity. We reply within 1 month. If a request is complex, we can extend that by up to 2 more months, and we will tell you within the first month if we need to. There is normally no fee.

If you are unhappy with how we have handled your personal data, please tell us first at info@garrisonfm.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

The website does not set cookies and does not use any tracking or advertising technology. Vercel Web Analytics counts visits without cookies and without storing information on your device. If we ever add cookies that are not strictly necessary, we will ask for your consent first and update this policy.

We review this policy when our services or the law change. The date at the top shows when it was last updated. If we make a change that significantly affects how we use your data, we will tell clients directly.