Privacy Policy

1. Introduction

Helix Fire & Security Ltd ("Helix", "we", "us", "our") is committed to protecting and respecting your privacy. This policy explains how we collect, use, store, share and protect personal data when you interact with us — whether you are a client, a website visitor, an enquirer, a supplier or a job applicant.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We act as a Data Controller for the personal data we collect about you, except where we explicitly act as a Data Processor on behalf of a client (for example, when handling personal data within a managed building on a client's behalf).

2. Information We Collect

From clients and enquirers

When you contact us, request a survey, agree a quote or become a client, we typically collect:

• Your name and job title
• Business or organisation name (where applicable)
• Property address and details
• Contact details — email, phone number, postal address
• Information about the services you are interested in or have engaged us for
• Records of our communications with you (calls, emails, messages)
• Service history, including reports, certificates and visit records
• Payment and invoicing information

From website visitors

Our website may collect limited technical information automatically through standard analytics, including IP address, browser type, pages visited and referral source. This is used to understand site performance and improve content. We do not use intrusive tracking or profile-building cookies.

From job applicants

If you apply for a role with us, we collect the information you provide in your application — CV, references, qualifications, contact details and any supporting information. We only retain this information for the duration needed to evaluate your application.

3. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiry — when you contact us to ask about services, request a survey or discuss a quote
• To deliver our services — including arranging surveys, scheduling work, providing certifications, managing maintenance plans and responding to reactive callouts
• To manage our business relationship — invoicing, account management, communications about your service plan, and renewal discussions
• To meet legal and regulatory obligations — including maintaining service records that we or our clients are legally required to keep
• To improve our services — analysing patterns of feedback and operational data to make our delivery better
• To respond to job applications — assessing your suitability for available roles

4. Legal Basis

We rely on one or more of the following legal bases under UK GDPR, depending on the activity:

• Contract — processing necessary to enter into or perform a contract with you
• Legal obligation — processing necessary to comply with our legal duties, including maintaining service records and tax records
• Legitimate interests — processing necessary for our legitimate business interests, such as responding to enquiries, account management and improving services, where these interests are not overridden by your rights
• Consent — where you have given consent for a specific purpose (for example, optional marketing communications)

5. Who We Share Data With

We do not sell your personal data to third parties. We may share your data only with:

• Suppliers and contractors who provide services to us (for example, hosted IT services, accounting software, payment processors) — under appropriate data processing agreements
• Manufacturers where this is necessary to register warranty, deliver replacement parts or activate services on equipment we have installed for you
• Regulators, inspectors or authorities where required by law, or where the records relate to compliance evidence the authority is entitled to request
• Our professional advisers — solicitors, accountants and insurers — where reasonably necessary
• A purchaser or successor in the event of a business sale or restructure, under appropriate confidentiality arrangements

6. Data Retention

We keep personal data only as long as we need to for the purpose for which it was collected. Typical retention periods are:

• Enquiry data — retained for up to 24 months after the most recent contact, unless you become a client
• Client and project records — retained for 7 years after the end of the engagement, in line with statutory record-keeping requirements
• Service and compliance records — retained for the life of the installed system plus 7 years, to support compliance evidence
• Invoicing and accounting records — retained for 7 years in line with HMRC requirements
• Job applications — retained for 12 months unless you ask us to delete sooner, or unless you join the company

7. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include access controls, secure storage, encrypted transmission where appropriate, regular reviews of our data handling practices, and training for staff who handle personal data.

No system is entirely immune to risk, but we will notify you and the relevant authority promptly if a personal data breach occurs that is likely to result in risk to your rights.

8. Your Rights

Under UK GDPR you have the following rights in respect of personal data we hold about you:

• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to request deletion of your data, where applicable
• Right to restriction — to limit how we use your data in certain circumstances
• Right to portability — to receive your data in a structured, machine-readable format
• Right to object — to object to certain types of processing, including direct marketing
• Right not to be subject to automated decision-making — Helix does not use automated decision-making in any meaningful sense

To exercise any of these rights, please contact us using the details at the end of this policy. We will respond within one month unless the request is particularly complex, in which case we may extend by up to two further months and will let you know.

9. Marketing

We do not run aggressive marketing programmes. If you become a client, we may occasionally email you about service updates, renewal reminders or relevant changes to fire and security regulations that may affect your property. You can opt out of these at any time by replying to any such email or by contacting us directly.

We do not sell, rent or share your details with third-party marketers under any circumstances.

10. Cookies

Our website uses only essential cookies necessary for the site to function correctly, plus minimal analytics cookies that help us understand site usage in aggregate. We do not use behavioural tracking cookies or third-party advertising cookies. You can control cookies through your browser settings.

11. Children's Data

Our services are not directed at children. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected information about a child, please contact us so we can remove it.

12. International Transfers

Helix is a UK-based business and most of our data processing takes place within the UK. Where any of our service providers are based outside the UK, we ensure appropriate safeguards are in place — typically through approved transfer mechanisms recognised under UK GDPR.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, legal requirements or feedback. The "last updated" date at the top of this policy shows when it was last revised. Material changes will be brought to clients' attention through normal communication channels.

14. Contact Us

If you have any questions about this policy, want to exercise your data rights, or wish to raise a concern about how your data is being handled, please contact us:

• Email: hello@helixfs.co.uk
• Phone: 07359 589933
• Post: Data Protection Enquiries, Helix Fire & Security Ltd, 29 Green Lane Road, Leicester, LE5 3TN

15. Complaints

If you are not satisfied with how we have responded to a privacy concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or on 0303 123 1113.