PRIVACY POLICY
Privacy Policy
Introduction
SRC Infrastructure Ltd, and its subsidiary companies (SRC) are committed to respecting your privacy.
​In respect of your personal data, SRC acts as a Data Controllers within the definition of the General Data Protection Regulation (EU) 2016/679 (GDPR). ​
​
This privacy policy explains how we will collect, store, use and otherwise process any personal data you provide via our website,via email or when you otherwise communicate with us (including in the course of the services we provide or the running of our business). This notice also explains your rights in respect of any of your personal data being processed by SRC.
​
This Policy applies to any persons that provide personal data through the methods described above. This may include our current and prospective clients’ personnel; our joint venture partners’ personnel; third parties with whom we have contact by virtue of providing our services (e.g. third party payers of invoices); contractors/ suppliers and their personnel; those with whom we work in the context of our corporate responsibility initiatives; those who submit correspondence to us or whose details are otherwise entered into our systems and portals; and any visitor to our offices and projects.
​
Where you provide personal data about you, your personnel or other third parties (e.g. if you are a recruitment agent), you warrant that you have the consent of the individual to do this and that the information is accurate and up-to-date. You will inform us if the wishes of the individual or any information changes.
​
SRC Infrastructure Ltd is a Limited Company registered in England and Wales, registration number 04694217 .
​
You can contact our Data Protection Officer by calling us on 0207 537 2444, emailing us at gdpr@srcinfrastructure.com or writing to the below registered address:
​
Via Post:-
SRC Infrastructure Limited
30 Churchill Place
London
E14 5EU
What personal data do we collect?
Your personal data will only be processed for the purposes set out below and in accordance with Data Protection Law. SRC will not process your personal data in any manner incompatible with these purposes unless we are required to do so by law.
What do we use your data for?
SRC may hold and process your personal data for the following purposes:
-
record and respond to any communication you have made with us including by way of telephone, through the website, email address of SRC, any other electronic form of communication and post;
-
provide you with information that you have requested
-
manage our relationship with you or third parties (such as your personnel) including for administration, accounting and relationship management purposes;
-
process any application you (or your representative) has submitted for an employment or other opportunity (such as agency or volunteering work) with the SRC;
-
equal opportunities monitoring information (including information about your gender, race, ethnicity, sexual orientation and disabilities);
-
on-boarding with SRC and pre-employment screening such as reference checks, right to work checks and criminal conviction checks;
-
for administration purposes and access to our systems and portals;
-
help us develop the website to be more useful to you, to keep it safe and secure;
-
to respond to any problems you report with our website;
-
For processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
-
For SRC to comply with the law (not including contractual obligations)
-
Special categories of personal data (such as information about your health) will be processed where SRC needs to carry out its legal obligations; to run the business; where the processing is necessary for the assessment of your working capacity, occupational health or obtaining a medical diagnosis; or where it is needed in the public interest (such as equal opportunities monitoring). In exceptional circumstances, we may process this data with your explicit consent.
Sharing your personal data
We will only share your data where it is required in order to effectively offer or provide our professional services to you. There are also organisations who will have access to your data due to the services they provide to SRC such as IT support companies, email and phone service providers and external auditors. While we may not actively share your specific data with these firms we will ensure that when providing access to any data systems, the security of that data is considered and protected at all times.
​
Sharing your data outside the European Union
We shall not be sharing data outside of the European Union.
​
How long will we keep your data?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our Master Document List/Data Retention and Erasure Procedure which is available from the Office Manager. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements
Your personal data rights
In respect of your personal data being processed by SRC:
-
You have the right to ask us what personal data we are processing about you and request access to or copies of that information.
-
You have the right to request that your personal data which is inaccurate, or incomplete is rectified.
-
You have the right to request that your personal data is deleted however we may have the right to continue processing your data in certain circumstances.
-
You have the right to request that your data is given to you in a format that can be used by another controller and where possible that this is sent directly to the other controller by us.
-
Where the processing relies upon your consent or if you are under 18 the consent of an adult bringing the claim on your behalf then the person giving consent has the right to withdraw this at any time.
-
You have the right to object to the processing of your data where the grounds we rely upon are our legitimate interests or the legitimate interests of a third party. Upon receiving an expression of objection, we will review the grounds for processing and respond accordingly. Where we are processing for direct marketing purposes you have the right to object at any time and we will cease processing for such purposes where an objection is received.
-
You have the right not to be subject to automated decision-making processes including profiling however SRC does not employ any automated decision-making processes.
-
You have the right to restrict the processing of your personal data:
-
where the accuracy is contested while this is investigated;
-
where the processing is unlawful, but you do not want the data to be deleted;
-
where we no longer need to process the data, but you would like us to store it without further processing for the establishment, exercise or defence of legal claims;
-
where you have objected to the processing and we are processing for our legitimate interests while it is established if our interests override your rights.
-
​
We will respond to your request in relation to any of the above rights within one month of us receiving your request unless there is likely to be a delay providing the information or response in which case we will notify you within one month of receiving the request. There will be no fee payable for us to provide you with the information requested unless the request is for duplicate copies of documents previously provided to you or we feel the request is manifestly unfounded or excessive. If a request is manifestly unfounded or excessive we may refuse to provide the data rather than charging a fee. Where a fee is charged it will reflect the administrative costs involved in providing you with the information.
​
We may require identification from you for security purposes before providing any information or acting on requests. Where this is required we will notify you within one month of receipt of your request.
​
Where you make a request to us electronically we will endeavour to respond electronically. If you would prefer not to receive the information electronically you should request this.
​
If we are unable to comply with your request, we will inform you within one month of receipt of your request providing the reasons and advising you of your options to escalate the matter further.
​
All requests in relation to the above should be addressed to:-
SRC Infrastructure Limited
30 Churchill Place
London
E14 5EU
​
by email to gdpr@srcinfrastructure.com
​
You have the right to lodge a complaint with the Information Commissioners Office who regulate Data Protection compliance in the UK if you are not satisfied with any response provided by Strategic Rail Consultants Limited in relation to the exercise of your rights under the relevant English Data Protection law.
​
Automated Decision Making
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
​
Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.
​
The categories of personal data concerned
With reference to the categories of personal data described in the definitions section, we process the following categories of your data:
-
Personal data: Name, email address, company telephone number, job title, company address.
​
We have obtained your personal data from you directly.
​
What is our legal basis for processing your personal data?​
Personal data (article 6 of GDPR)
​
Our lawful basis for processing your general personal data:
Consent of the data subject
Processing necessary for the performance of a contract with the data subject or to take steps to enter into a contract
Processing necessary for compliance with a legal obligation
More information on lawful processing can be found on the ICO website.
Sharing your personal data
Your personal data will be treated as strictly confidential, and will be shared only with Clients who are requesting references. Your permission shall be sought first.
​
Providing us with your personal data
We require your personal data as it is a requirement necessary to enter into a contract.
If you fail to adhere the consequences will be failure to enter into a contract.
​
Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:
-
The right to request a copy of the personal data which we hold about you;
-
The right to request that we correct any personal data if it is found to be inaccurate or out of date;
-
The right to request your personal data is erased where it is no longer necessary to retain such data;
-
The right to withdraw your consent to the processing at any time, WHERE CONSENT WAS YOUR LAWFUL BASIS FOR PROCESSING THE DATA;
-
The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable i.e. where the processing is based on consent or is necessary for the performance of a contract with the data subject and where the data controller processes the data by automated means);
-
The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
-
The right to object to the processing of personal data, (where applicable i.e. where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics).
​
Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Office Manager. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
​
Data protection officer
We have appointed a data privacy manager to oversee compliance with this privacy notice. This shall be the Office Manager. If you have any questions about this privacy notice or how we handle your personal information, please contact the data privacy manager. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
If you have any questions about this privacy notice, please contact the Office Manager:
via phone: 0207 537 2444
via email: gdpr@srcinfrastructure.com