Privacy Policy
How Principal Management Services Limited collects and uses personal data.
Principal Management Services Limited
Last updated: [Date]
1. Who We Are
Principal Management Services Limited is a construction health and safety consultancy registered in England and Wales.
- Company number: [Company Number]
- Registered office: [Registered Office Address]
- Trading address: [Trading Address]
- Email: info@principal-management.co.uk
- Phone: [Phone Number]
- Data Protection Lead: [Director Name]
We are the data controller for the personal data described in this policy. If you have any questions about how we use your personal data, please contact us at info@principal-management.co.uk.
2. What Data We Collect and Why
We process personal data across our core business activities. The legal basis for each is set out below.
2a. Website Visitors and Enquiries
When you contact us via our contact form, email, or phone, we collect:
- Name, email address, phone number, and company name
- The content of your enquiry
- IP address and browser type (collected automatically via our analytics tools)
- Cookie data (see Section 7 — Cookies)
Legal basis: Legitimate interests (responding to your enquiry and managing our business relationship). Where you have given consent for analytics cookies, we rely on that consent for cookie-based tracking data.
Retention: Contact form enquiries and correspondence are retained for 2 years from the date of last contact, or until the enquiry is resolved, whichever is later.
2c. Booking Clients
When you book a consultation, site safety inspection, scaffold inspection, or temporary works consultation through our Wix Bookings system, we collect:
- Name, email address, phone number, and company name
- Project details relevant to the service booked (site address, project type, scaffold details, etc.)
- Calendar and appointment data
Legal basis: Contract performance — processing is necessary to arrange and deliver the booked service.
Retention: Booking records and associated correspondence are retained for 6 years (professional liability period).
2f. Sub-Contractor Personal Data
As part of our sub-contractor compliance assessment service, we may process personal data about individual sub-contractors, including:
- CSCS card details and card numbers
- Training records and qualification certificates
- Competency assessments
Legal basis: Legitimate interests — assessing supply chain competency is a core professional service activity, and holding these records is necessary to deliver that service to our clients (principal contractors).
Data sharing: Sub-contractor compliance records are shared with the engaging principal contractor (the client who commissioned the compliance review). They are not shared with any other third party.
Retention: Sub-contractor compliance records are retained for the duration of the engagement plus 2 years.
3. How We Use Your Data
We use personal data for the following purposes:
- Providing the consultancy or inspection service you have requested
- Processing your booking and sending confirmation communications
- Sending automated booking reminders (24 hours before your appointment)
- Responding to your enquiries and correspondence
- Maintaining records for professional liability and compliance purposes
- Analysing website usage to improve our service (analytics cookies — subject to your consent)
- Complying with our legal and regulatory obligations
We do not use your personal data for automated decision-making or profiling.
4. Data Sharing
We share personal data only with the following third parties and only where necessary:
| Recipient | Purpose | Data shared |
|---|---|---|
| Wix | Website hosting, booking system, and store platform | Booking data, order data, contact form submissions |
| Analytics (GA4) — subject to your consent; Google Calendar for booking sync | Analytics data (with consent); booking appointment data |
We do not sell personal data to any third party. Ever.
We do not share personal data with marketing companies, data brokers, or any party not listed above. If we are required to share data by law (e.g., in response to a court order or regulatory requirement), we will notify you unless prohibited from doing so.
5. Data Retention
| Data type | Retention period | Reason |
|---|---|---|
| Contact form enquiries | 2 years from last contact | Business records |
| Booking and consultation records | 6 years | Professional liability |
| Sub-contractor compliance records | Duration of engagement + 2 years | Professional records |
When data reaches the end of its retention period, it is securely deleted.
6. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access — you can request a copy of the personal data we hold about you
- Right to rectification — you can ask us to correct inaccurate data
- Right to erasure — you can ask us to delete your data (subject to legal retention requirements)
- Right to restriction — you can ask us to restrict how we process your data
- Right to data portability — you can ask for your data in a structured, machine-readable format
- Right to object — you can object to processing based on legitimate interests
To exercise any of these rights, contact us at info@principal-management.co.uk. We will respond within one calendar month.
Right to complain: If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling the ICO helpline on 0303 123 1113.
7. Cookies
Our website uses cookies — small text files stored on your device.
Essential cookies (always active — no consent required): These are necessary for the website to function. They include Wix session cookies, security cookies, and CSRF protection.
Analytics cookies (consent required): Google Analytics 4 (GA4) and Wix Analytics set cookies to help us understand how visitors use our site. These cookies are not set until you give your consent via our cookie consent banner. Per the Privacy and Electronic Communications Regulations (PECR), we require your active consent before placing non-essential cookies on your device.
Marketing cookies: We do not currently use marketing or advertising cookies.
You can manage your cookie preferences at any time via the cookie settings link in our website footer. You can also withdraw consent at any time by clearing your browser cookies and opting out via the consent banner on your next visit.
For more detail on the cookies we use, see our full Cookie Policy / cookie consent settings.
8. Security
We take reasonable technical and organisational measures to protect your personal data, including:
- HTTPS encryption for all data transmitted to and from our website
- Access restrictions — client records are accessible only to our directors and authorised staff
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services or legal obligations. We will post the updated policy on this page with a revised "Last updated" date. For significant changes, we will notify clients directly by email where we hold contact details.
10. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data:
- Email: info@principal-management.co.uk
- Phone: [Phone Number]
- Address: [Registered Office Address]
- Data Protection Lead: [Director Name]