ABOUT US WHAT WE DO PLANT HIRE ABOUT US WHAT WE DO PLANT HIRE GDPR PRIVACY NOTICE General C.J. O’Shea and Company Ltd and C.J. O’Shea (Plant Hire) Ltd (“We” or “Us” or “Our”) are committed to protecting and respecting your privacy. We take data protection seriously. This policy sets out our commitment to protecting personal data when working with both existing and former partners and suppliers. We are registered as data processors with the Information Commissioner’s Office (ICO). This policy applies where personal data is exchanged between C.J. O’Shea and Company Ltd and C.J. O’Shea (Plant Hire) Ltd and: Our suppliers and service providers who are natural persons (such as self-employed persons); The representatives or contact persons of Our suppliers and service providers who are legal entities; and Any other visitor to one of Our sites, Plant Yard or Head Office. We invite You to carefully read this Privacy Notice, which sets out in which context We are processing Your personal data and explains your rights and Our obligations when doing so. Personal data means any information relating to an identifiable living person, i.e. the information is obviously about that person or is capable of being used to learn, record or decide something about them (e.g. name, first name, last name, email). It does not have to be confidential or private and could relate to anyone, e.g. employees, project participants, brokers, suppliers and contractual counterparties, including sole traders, a company’s owners, directors, partners and/or any individual who may interact with C.J. O’Shea and Company Ltd and C.J. O’Shea (Plant Hire) Ltd. We use this policy during procurement to make our commitment to data protection clear and to seek suppliers and partners who demonstrate a similar commitment. 1. What personal information do we have about you? We may collect personal data from You directly (e.g. on invoices, contracts, insurance policies, correspondence, business cards) or from third parties. We may also obtain Your personal information (including that of your staff) from the following sources: From your staff: Your staff will know what personal information We obtain from them, because the member of staff (or someone they have authorised US to deal with e.g. another member of Your staff) has provided it to Us. Examples of how we obtain personal information about You includes when You market, offer and/or agree to supply Us with products or services (including as part of any bid or tender process); when You give Us information via email, during a telephone call or in face to face discussions and also from networking events, trade shows, exhibitions. We will also hold health and safety records related to data about You and Your performance of Your contracts with Us. From third parties: We may obtain personal information about You from third party sources, by way of introduction. For example, We may be passed Your details by other parties within the industry/Our clients as a potential supplier. From Your employees: We may obtain personal information about You from Your employees and other staff who have been introduced to Us From Your customers and contacts: We may obtain personal information about You from Your customers and clients who have been introduced to Us. What choices do you have as to the personal information We collect? To complete an order with You to buy goods and services from you, as a minimum We need the following in order to place the Contract:  Your name, postal address, email address and phone numbers, as well as a contact within Your business and details of Your preferred method of contact (“Contact Details”);  The description and quantities of the goods and services You will provide Us;  Your payment details (e.g. financial details i.e. bank account number, bank sort code)  Satisfactory pre-qualification checks including: The names of team members and their training certificates  Health and safety details By giving Us Your personal information You will be agreeing to Us, Our agents, Our insurers and the other persons who We describe in this notice processing this information for all purposes as are relevant to Your relationship with C.J. O’Shea and Company Ltd and C.J. O’Shea (Plant Hire) Ltd. Before You provide information about others, You should make sure they are aware of how We will use their information and have given their permission. If You intend to provide Us with personal data about other individuals (e.g. Your colleagues), You must provide a copy of this Privacy Notice to the relevant individuals, directly or through Your employer. If You prefer for Us to hold and/or use less personal information about You, You can choose to make less available but please note that withdrawing or withholding personal information from Us will mean that You may not receive updates and requests for further goods and services from Us (whether by telephone, email or other means), plus it may mean that We cannot place a contract with You for the purchase of goods or services if You do not provide Us with the minimum details (as set out above). If you ask us to erase any of Your personal information We may be unable to comply with Your previous instructions to Us about Your personal information. For example, if We erase records of Your instruction not to email You, You may receive an email from Us if We subsequently lawfully acquire Your email from a third party. 2. How do We use Your personal information? We may use Your personal information for any of the following purposes, whether We obtained it directly from You (or someone You authorise); or another source. Use Basis of Use To contact You about a potential supply arrangement with You Our legitimate interest in approaching You about possible business opportunities To make a decision to buy goods and/or services from You, including making enquiries of You, undertaking supplier approval checks and negotiating the terms of any contract Our legitimate interest in approaching You about possible business opportunities and taking steps to enter into a contract To perform Our obligations to You under the contract with You for the supply of goods and services, including the processing of payments to You Our legitimate interest in complying with Our obligations under a contract with You To take legal or administrative action in relation to Our supply agreements with You, including to enforce the terms of the contract and resolve any disputes Our legitimate interest in enforcing the contract and in resolving disputes with You and as necessary to establish, exercise or defend legal claims To undertake financial management, planning and reporting within Our business Processing will be in Our legitimate interest in respect of corporate governance and management To undertake health and safety management activities and checks Processing will be in Our legitimate interest to ensure the health and safety of Our staff and visitors to Our Head Office, Plant Yard and various sites To keep in touch with You regarding future business opportunities Our legitimate interest in staying in touch with You to propose and discuss potential repeat business We may cite You as a referee in tenders, and may include case studies about Our work with You unless you tell us otherwise Our legitimate interest in ensuring We are able to present effective tenders that contain examples of Our work provided that You can ask Us to stop at any time 3. Who has access to your personal information and to whom are they transferred? In the course of our activities and for the same purposes as those listed in this Privacy Notice, Your personal data can be accessed by or transferred to the following categories of recipients on a need to know basis to achieve such purposes: Our employees; Selected third parties who help Us perform Our contract with you. This includes third parties who help Us directly (such as other of Our suppliers) and third parties who help us indirectly (such as external marketing companies and service providers who host and or/transmit data about You for Us, such as Dropbox, We-transfer). Our banks and other payment processing service providers who process Our payments to You; Our other suppliers and service providers that provide services and products to Us; Our IT systems providers, database providers and consultants; Any third party to whom We assign or novate any of Our rights or obligations; Our professional service providers such as accountants, solicitors internal and external; Any third party company or companies in the event that We go through a business transition, such as a merger, sale or transfer of any part of Our business or its assets; Any agent or representative acting for You The above third parties are contractually obliged to protect the confidentiality and security of Your personal data, in compliance with applicable law. Your personal data can also be accessed by or transferred to any national regulatory, enforcement, public body or court, where we are required to do so by applicable law or regulation or at their request. We do not share Your personal information with third parties for their own marketing purposes. Do we transfer Your personal information abroad? In some cases, We will hold, in or transfer Your personal information, to a location that is outside the United Kingdom, and even outside the European Union. This will be the case if you are, or a member of Our Supply chain for a particular opportunity or contract, is located outside the European Union. 4. How do we protect your personal data? We have implemented appropriate technical and organisational measures to provide a level of security to Your personal data. The purpose thereof is to protect against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing. When handling Your personal data, We only collect and process personal data which is adequate, relevant and not excessive. To ensure that Your personal data remains up to date and accurate, We may request that You confirm the personal data we hold about You. You are also invited to spontaneously inform Us whenever there is a change in Your personal circumstances so We can ensure Your personal data is kept up to date. 5. How long do we store your personal data for? We only retain Your personal information for as long as is necessary to fulfil the purposes We collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. We will retain Contact Details and records of Our contact with You until You ask us to delete them. We will retain details relating to orders We place with You or Your organization for as long as is necessary for Us to establish, exercise or defend legal rights. There can be extensive guarantees from our Suppliers (for example 15 or even 30 years) and in such circumstances We will need to hold personal information consisting at lease of name(s), contact details and relevant records (such as correspondence, emails) for extended periods in line with the guarantee given by suppliers. In determining the appropriate period for the retention of Your personal information, We consider the amount, nature and sensitivity of that data, the purposes for which We process your personal information and whether We can achieve these purposes by other means, as well as the applicable legal requirements. Personal data collected and processed in the context of a dispute are deleted or archived (i) after a settlement has been reached, (ii) once a decision in last resort has been rendered or (iii) when the claim becomes time barred. 6. What are your rights and how can you exercise them? What if your personal information changes? It is important that the information We hold about You is correct and accurate. Please tell Us if Your personal Information changes during Your dealings with Us. What rights do you have? You may exercise the following rights under the conditions and within the time limits set forth in law: Request access; request correction: The right to request access to Your personal information that We hold about you. (Commonly referred to as a “data subject access request”) as processed by Us and, if you believe that any information relating to You in incorrect, obsolete or incomplete, to request its correction or updating; Request Erasure: The right to request the erasure or Your personal data or the restriction thereof to specific categories of processing; Withdrawal of consent: The right to withdraw Your consent at any time, without affecting the lawfulness of the processing before such withdrawal; Object to processing: The right to object, in whole or in part, to the processing of Your personal data; and Request the transfer: of Your personal information to a third party. If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal information, or request that we transfer a copy of your personal information to another party, please contact Us at C.J. O’Shea and Company Ltd, Unit 1, Granard Business Centre, Bunns Lane, Mill Hill, London, NW7 2DZ or email the person at the company with whom you routinely correspond. No fee is usually required You will not pay a fee to access Your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if Your request for access is clearly unfounded or excessive. Alternatively, We may refuse to comply with Your request in such cases. What we may need from You We may need specific information from You to help us to confirm Your identity and ensure Your right to access the information (or to exercise any other right). This is another appropriate security measure to ensure that the personal information is not disclosed to someone who is not entitled to receive it. Withdrawing consent In the limited circumstances where You have provided Your consent to the collection, processing and transferring of Your personal Information for a specific purpose, You have the right to withdraw Your consent for that specific processing at any time. To withdraw Your consent, please contact Us gdpr@oshea.co.uk. Once we have received notification of Your withdrawal of consent, We will no longer process Your information for that purpose, unless we have another legitimate basis to do so by law. Changes to this notice We reserve the right to make changes to this notice from time to time. If this notice changes in any way, We will place an updated version on Our Website. Regularly reviewing Our website will ensure that You are always aware of what information We collect, how We use it and under what circumstances, if any, We will share it with other parties. If We make material changes to this notice, We will notify You via a prominent notice on Our email footers. If you do not agree to then changes that We make from time to time, please tell Us via the contact details below: Email: GDPR@oshea.co.uk C.J. O’Shea and Company Ltd Unit 1, Granard Business Centre Bunns Lane, Mill Hill, London, NW7 2DZ May 2018 The Information Commissioner’s office is the UK’s supervisory authority for privacy and data protection matters for more information visit www.ico.org.uk/concerns Granard Business Centre, Bunns Lane, Mill Hill, London, NW7 2DZ 020 8959 3600 info@oshea.co.uk CJ O'Shea Planthire, Station Yard, Station Road, Smallford, AL4 0HF 01727 826 748 sales@osheaplanthire.co.uk STANDARDS EQUAL OPPORTUNITIES TRAINING HEALTH & SAFETY ENVIRONMENT MODERN SLAVERY GDPR PRIVACY NOTICE RISK ASSESSMENT – COVID-19 C.J.O’Shea and Company Limited is a company registered in England and Wales. Registered number: 00939436.