Status	Draft
Control Document Number	T.030110.07
Version	7
Effective Date	October 2026
Policy Owner	Linda Harvey, Head of Finance Data Protection Officer
Next Review Date	October 2027
Registered Address	12 Henson Close, Telford Way Industrial Estate, Kettering, Northants, NN16 8PZ   Company number: 02577303
Website	www.phoenixsurfacing.com
Applicable to	All website visitors, employees, subcontractors and suppliers

This privacy policy notice is the same privacy notice that is published on our website. It is separate from Phoenix Surfacing Ltd.’s Data Protection Policy.

Phoenix Surfacing Ltd respects your privacy. This notice explains what to expect when you visit our website, contact us using the email addresses displayed on the website, download information from the website, or enquire for a job through our online job enquires forms on our Phoenix Surfacing and Phoenix Traffic Management Careers pages.

1. How to contact us

Phoenix Surfacing Ltd is the controller of the personal information described in this notice. Our company address can be found above and is displayed on our website, and our telephone number and primary email address can be found below. Please use the contact details above if you have a question about this notice or want to exercise a data protection right.

Telephone: 01536 416 540

Email: enquiries@phoenixsurfacing.com

2. Who this notice applies to

This notice applies to anyone whose personal information we process through or in connection with our public website. This includes:

• people who browse our website or download our publicly available certifications or accreditations;
• people who contact us using a name, email address or telephone number through the email address or telephone numbers displayed on our website;
• people who submit an online job enquiry form through our career’s pages;
• people whose information is supplied to us by a job applicant, for example a previous employer or referee.

Our website is primarily an information only website. It does not contain any online forms for customer or work enquiries, user accounts, e-commerce or AI Bot live chats. General enquiries are made using the contact details published on the website.

3. What information we collect, use and why

General Website Use

You can browse our business information and download publicly available certificates or accreditations without completing a form or giving us your name. Our website and hosting systems may nevertheless process technical information needed to operate, secure and understand use of the website, such as IP address, browser or device information, date and time of access, pages or files requested, referring information and cookie or analytics information.

We use this information to provide and secure the website, diagnose technical problems, prevent misuse and, where applicable, understand website usage. Our lawful basis under UK GDPR is normally our legitimate interests in operating, maintaining and protecting our website. Where PECR requires consent for a cookie or similar technology, we will ask for that consent before using it.

Contacting Us – General Enquiries

If you choose to email, telephone or otherwise contact us using details on the website, we may process your name, contact details, the organisation you represent, and the information contained in your communication. We use it to receive, respond to and keep an appropriate record of your communication.

Depending on the nature of the contact, our lawful basis may be taking steps at your request before entering into a contract, performing a contract, complying with a legal obligation, or our legitimate interests in communicating with people who contact our business and keeping appropriate business records.

Job Vacancy Enquiries

Should you enquire about a job or potential vacancies through our Careers page, we use the information you provide to assess your enquiry. All submitted forms will generate an automated response to the email address provided. Subject to the assessment or the information provided and the recruitment needs of the business, the information provided will be used to communicate with you, and, where appropriate, progress pre-employment checks and an offer of employment.

The online form asks for information including your name, date of birth, contact details, address and postcode, National Insurance number, previous-employer details, right-to-work status, driving-licence information, criminal-record information, qualifications, training qualification status, fit-to-work information and, if you choose to provide it, your CV.

For ordinary recruitment information, our lawful bases may include taking steps at your request before entering into an employment contract (Article 6(1)(b)), compliance with legal obligations (Article 6(1)(c)) and our legitimate interests in managing a fair and effective recruitment process (Article 6(1)(f)), depending on the particular processing.

You do not have to provide information that is described as optional. Where information is required for us to assess an application or comply with a legal requirement, not providing it may mean that we cannot progress your application.

As part of our online job application form, we may ask applicants to provide a limited yes/no declaration about whether they have a previous criminal conviction and whether they have undergone a fit-to-work medical assessment within the previous 12 months.

At the initial enquiry stage, we do not ask applicants through the online form to provide details of any criminal conviction, medical condition, medical history or the results of a medical assessment. We only use this information where it is relevant and necessary for our recruitment process and the requirements of the role concerned. Where further checks or information are required at a later stage of recruitment, we will only obtain information that is necessary and lawful for that purpose at the consent of the person making the enquiry.

Information relating to criminal convictions and offences is subject to additional protection under data protection law. Where we process such information, we will ensure that we have an appropriate lawful basis and that the processing is authorised in accordance with the Data Protection Act 2018.

Where information we obtain constitutes health information or other special-category personal data, we will only process it where we have both an appropriate lawful basis and an applicable condition for processing special-category data.

5. Where we get personal information from

Most information covered by this notice comes directly from you when you use the website, contact us or complete the Careers form. Technical website information may be generated automatically by your browser, device, our hosting environment or website technologies.

During recruitment, we may also obtain information from previous employers or referees you identify, and from organisations involved in lawful pre-employment checks where those checks are necessary. We will tell you about relevant checks at the appropriate stage of recruitment.

6. What happens when you submit a job application

Enquiries submitted through the Careers form are sent to a restricted shared mailbox monitored by two authorised members of staff. Access is limited to people who need the information for recruitment. Relevant information may be shared internally with an appropriate manager where necessary to assess or progress an application.

After submission, an automated acknowledgement is sent to the email address you provided. It thanks you for your application and explains that, if you do not hear from us within 28 days, you should consider the application unsuccessful. It also explains that the application and associated data will be retained in the shared mailbox for one year before deletion.

If your enquiry is successful, you will receive direct communication from the business. Relevant information will be moved into the records needed to manage your employment and will then be

retained in accordance with our employee record-retention requirements outlined in our Data Protection Policy.

7. How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, including any legal, regulatory or record-keeping requirements.

Information	Retention approach
Unsuccessful online job enquiry forms	One year after submission in line with the information given to applicants, unless a longer period is required for a specific legal reason.
Successful job enquiries	Relevant information becomes part of the employment record and is retained under our employee retention arrangements.
Pre-employment vetting information	Kept only for as long as necessary for the check and decision. We may retain a limited record of the outcome where appropriate.
General website/email communications	For as long as reasonably necessary to deal with the communication and meet applicable business or legal record-keeping requirements.
Website technical/security information	For the period reasonably required for website operation, security and troubleshooting, according to the settings of our website and hosting providers.
Cookies	For the duration stated in our cookie information / cookie controls for the relevant cookie.

8. Who we share information with

We do not sell your personal information, and we do not use website or recruitment information for third-party marketing. Where necessary for the purposes described in this notice, information may be accessible to or shared with:

• authorised Phoenix Surfacing staff and managers who need it for the relevant purpose;
• our website design, hosting and technical support providers;
• our Microsoft 365, email and IT service providers;
• providers used for lawful recruitment, occupational-health, driving-licence or criminal-record checks where relevant;
• professional advisers where necessary; and
• regulators, law-enforcement bodies, courts or other authorities where disclosure is required or permitted by law.

9. International transfers

Some technology suppliers may use infrastructure or support services located outside the UK. Where personal information is transferred outside the UK, we will ensure that the transfer is permitted by UK data protection law and that an appropriate safeguard or other lawful transfer mechanism is used where required.

We keep our suppliers and data flows under review so that this section reflects the services in use.

10. Cookies and similar technologies

Our website uses cookies and analytics technologies. A cookie is a small piece of information stored on, or accessed from, your device. Some technologies are necessary for the website to work or remain secure. Others, such as certain analytics technologies, require consent before they are used.

Our website provides cookie controls so that you can make choices about non-essential cookies. You can also use your browser settings to manage cookies. Blocking some cookies may affect how parts of a website work.

The cookie information presented through our website should identify the cookies and similar technologies actually in use, their purposes, providers and duration. We keep this information under review when the website or its plugins change.

A summary of our cookie script can be seen below.

11. Your data protection rights

Depending on the circumstances and the lawful basis we rely on, you may have the right to: •        ask us for access to your personal information;

• ask us for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase your information in certain circumstances;
• ask us to restrict the use of your information in certain circumstances;
• object to processing based on legitimate interests and to direct marketing;
• receive information you provided to us in a portable format where the right to data portability applies; and
• withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing already carried out before withdrawal.

These rights are not absolute and do not all apply in every situation. We do not normally charge a fee for dealing with a rights request.

12. Automated decision-making

We do not use solely automated decision-making or profiling to decide whether to employ an applicant following a job enquiry.

13. Security

We use appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure or access. Access is restricted according to business need. In particular, online enquiries are delivered to a restricted shared mailbox, protected by two-factor authentication, web security policies and are monitored by authorised members of staff only.

14. Links and downloadable documents

Our website does not link the visitor to websites operated by other organisations. Downloading one of our publicly available certificates or accreditations does not require you to input any personal data. Normal website technical information may still be processed when a file is requested or downloaded.

15. Complaints

If you have concerns about how we use your personal information, please contact us first using the details in section 1 so that we can consider the matter.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. You can find current contact and complaints information at www.ico.org.uk/make-a-complaint/

16. Changes to this notice

We review this notice at least annually and sooner where there is a significant change to our website, recruitment process, suppliers, use of personal information or applicable law. Where a change materially affects how we use information already collected, we will take reasonable steps to bring the change to the attention of affected people.

Tom Greasley
Managing Director