Privacy Policy

The McGoff Group ( “we”, “us”, or “our”) is strongly committed to protecting personal data.  This privacy statement describes why and how we collect and use personal data and provides information about individuals’ rights.  It applies to personal data provided to us, both by individuals themselves or by others.  We may use personal data provided to us for any of the purposes described in this privacy statement or as otherwise stated at the point of collection.

Personal data is any information relating to an identified or identifiable living person.  The McGoff Group processes personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose may differ.

When collecting and using personal data, our policy is to be transparent about why and how we process personal data.  To find out more about our specific processing activities, please go to the relevant sections of this statement.

Data Protection

The General Data Protection Regulation (GDPR) and the current Data Protection Act regulate our use of Employee’s personal data. As an employer it is our responsibility to ensure that the personal data we process in relation to our employees is done so in accordance with the required principles. Any data held shall be processed fairly and lawfully and in accordance with the rights of data subjects.

We will process data in line with our privacy notices in relation to both job applicants and employees.

Employees have several rights in relation to their data. More information about these rights are available on request. We commit to ensuring that our employee’s rights are upheld in accordance with the law and have appropriate mechanisms for dealing with such.

We may ask for consent for processing certain types of personal data. In these circumstances, the employee will be fully informed as to the personal data we wish to process and the reason for the processing. Employee’s may choose to provide or withhold their consent. Once consent is provided, employees are able to withdraw consent at any time.

Collection of personal data

We collect and process personal data about our suppliers including subcontractors in order to manage the relationship, contract, to receive services from our suppliers and, where relevant, to provide professional services to our clients.

Use of personal data

We use personal data for the following purposes:

Receiving services or products

We process personal data in relation to our suppliers and their staff as necessary to receive the services. For example, where a supplier is providing us with services, we will process personal data about those individuals that are providing services to us.

Providing professional services or products to clients

Where a supplier is helping us to deliver services to our clients, we process personal data about the individuals involved in providing the services in order to administer and manage our relationship with the supplier and the relevant individuals and to provide such services to our clients.

Administering, managing and developing our businesses and services

We process personal data in order to run our business, including:

• managing our relationship with suppliers;
• developing our businesses and services (such as identifying client needs and improvements in service delivery);
• hosting or facilitating the hosting of events; and

Security, quality and risk management activities

We have security measures in place to protect our and our clients’ information (including personal data), which involve detecting, investigating and resolving security threats.  Personal data may be processed as part of the security monitoring that we undertake; for example, automated scans to identify harmful emails.  We have policies and procedures in place to monitor the quality of our services and manage risks in relation to our suppliers.  We collect and hold personal data as part of our supplier contracting procedures.  We monitor the services provided for quality purposes, which may involve processing personal data.

Complying with any requirement of law, regulation or a professional body of which we are a member

We are subject to legal, regulatory and professional obligations.  We need to keep certain records to demonstrate that our services are provided in compliance with those obligations and those records may contain personal data.

Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).
Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

Personal data held by us may be transferred to:

Third party organisations that provide applications/functionality, data processing or IT services to us

We use third parties to support us in providing our services and to help provide, run and manage our internal IT systems.  For example, providers of information technology, cloud based software as a service provider, website hosting and management, data analysis, data back-up, security and storage services.  The servers powering and facilitating that cloud infrastructure are located in secure data centres within the UK.

Third party organisations that otherwise assist us in providing goods, services or information

Auditors and other professional advisers;

Law enforcement or other government and regulatory agencies or to other third parties as required by, and in accordance with, applicable law or regulation
Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, to establish, exercise or defend legal rights.  We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.

Changes to this privacy statement

We recognise that transparency is an ongoing responsibility so we will keep this privacy statement under regular review.

Data controller and contact information.
The data controller is McGoff Group

If you have any questions about this privacy statement or how and why we process personal data, please contact us at:

Emma James – Data Protection Officer
McGoff Group
1 St George’s Court
Altrincham Business Park
WA14 5EF

Individuals’ rights and how to exercise them

You have a right of access to personal data held by us as a data controller.  This right may be exercised by writing to us. We may charge for a request for access in accordance with applicable law.

Amendment of personal data

To update personal data submitted to us, you may write to us.
When practically possible, once we are informed that any personal data processed by us is no longer accurate, we will make corrections (where appropriate) based on your updated information.

Withdrawal of consent

Where we process personal data based on consent, individuals have a right to withdraw consent at any time.

Other data subject rights

This privacy statement is intended to provide information about what personal data we collect about you and how it is used.  As well as rights of access and amendment referred to above, individuals may have other rights in relation to the personal data we hold, such as a right to erasure/deletion, to restrict or object to our processing of personal data and the right to data portability.  Some of these rights will only be available from 25 May 2018.

Complaints

We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send write to us. We will look into and respond to any complaints we receive.
You also have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”) (the UK data protection regulator).
For further information on your rights and how to complain to the ICO, please refer to the ICO website.