cookie & PRIVACY POLICY
privacy policy
Last updated: 30 October 2026
At a glance
Who we are: Safe & Sound UK Limited, Unit 3 Millards Way, Standerwick, Frome, Somerset, BA11 2PL.
What we collect: contact, contract and payment details, information from credit reference agencies, CCTV and incident records at sites we protect, website data, and job applicant details.
Credit checks: we may check your credit and identity through Creditsafe and its data partner TransUnion (section 5).
Your rights: you can ask to see, correct or delete your data, or object to how we use it (section 13).
Questions: contact our Data Protection Lead, Jacqui Jones, at mydata@safeandsoundgroup.com.
The full policy follows below.
1. Who we are
This Privacy Policy explains how Safe & Sound UK Limited ("we", "us", "our") collects, uses, shares and protects personal data. It applies to our customers, prospective customers, suppliers, business contacts, job applicants and visitors to our website.
We are the data controller for the personal data described in this policy. Our details are:
Organisation name (legal entity): Safe & Sound UK Limited
Registered address: Unit 3 Millards Way, Standerwick, Frome, Somerset, BA11 2PL
Contact email: mydata@safeandsoundgroup.com
Contact telephone: +44 (0)1225 774008
Company registration number: 05563894 (registered in England and Wales)
ICO registration number: Z3086287
We provide SIA-licensed security services, including static guarding, mobile patrols, CCTV monitoring and alarm response, as well as security training courses. We trade as Safe & Sound, and this policy also covers our website, safeandsoundgroup.com. We are in the final stage of achieving SIA Approved Contractor Scheme (ACS) accreditation and we currently hold ISO 9001:2015 certification.
When we act for our clients
When we operate CCTV, alarm or access control systems on behalf of a client, the client is usually the data controller and we act as their data processor. In those cases we process personal data only on the client's documented instructions, under a written data processing agreement, and the client's own privacy notice applies. Requests about that footage or data may be passed to the client.
We are the data controller for our own records, such as incident reports, patrol logs and our own CCTV.
2. Data Protection Officer
We have appointed a Data Protection Officer (DPO) to oversee our compliance with data protection law. You can contact our DPO about any question relating to this policy or your personal data:
Name: Jacqui Jones, Data Protection Lead
Email: mydata@safeandsoundgroup.com
Post: Data Protection Lead, Safe & Sound UK Limited, Unit 3 Millards Way, Standerwick, Frome, Somerset, BA11 2PL
3. Personal data we collect and where it comes from
We collect only the personal data we need for the purposes set out in this policy. This may include:
Identity and contact data: name, job title, postal address, email address, telephone number.
Account and contract data: site details, service orders, training course bookings and attendance, contract records, correspondence.
Financial data: billing address, payment history, invoices, bank details for payments, and online payments for course bookings (handled by our payment provider; we do not store full card details).
Credit and identity verification data: identity checks, credit commitments, payment history and public record information from credit reference agencies (see section 5).
Security and site data: CCTV images, body-worn camera recordings, vehicle registration numbers, alarm activation records, visitor logs, incident and patrol reports at sites we protect.
Website and technical data: IP address, browser type, pages visited and cookie data.
Recruitment data: CVs, application forms, references, right-to-work documents and SIA licence details supplied by job applicants.
Criminal offence data (job applicants only): results of DBS checks and security screening required for SIA-licensed roles.
We obtain personal data from these sources:
Directly from you – when you request a quote, enter into a contract, contact us or apply for a job.
From credit reference agencies – via Creditsafe, which uses its data partner TransUnion (see section 5).
From your employer or organisation – where you are a contact for one of our business customers or suppliers.
From publicly available sources – such as Companies House and the electoral register.
From our security systems – such as CCTV and alarm monitoring at sites we protect.
4. How we use personal data
We use personal data to:
provide quotations and assess applications for our services;
enter into and perform contracts with customers, suppliers and business partners;
deliver security services, including guarding, patrols, CCTV monitoring and alarm response;
prevent and detect crime, and record and investigate incidents at the sites we protect;
manage training course bookings, payments and attendance;
manage accounts, invoicing and payments, and recover debts;
verify identity, assess creditworthiness and prevent fraud;
comply with legal, regulatory, accounting and tax obligations, including SIA and ACS requirements;
maintain the security of our systems and the data we hold;
respond to enquiries and complaints, and send you updates about our services;
analyse how our website is used so we can improve it; and
recruit staff, including SIA licence, right-to-work and background screening checks.
Marketing
We may send updates about our services to business contacts on the basis of our legitimate interests. We only send marketing to individual consumers if they have opted in. Every marketing message includes a simple way to opt out, and we act on opt-outs straight away.
5. Credit Reference and Affordability Checks
To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.
Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority. FCA Firm Reference Number: 742313
TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority. FCA Firm Reference Number: 737740
The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.
Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:
Creditsafe Privacy / Transparency Notice: [Transparency Notice | Customers & Suppliers – insert Creditsafe link]
TransUnion Bureau Privacy Notice: www.transunion.co.uk/legal/privacy-centre/pc-bureau
6. Legal Basis for Processing Personal Data
Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Depending on the activity, we rely on the following lawful bases:
Performance of a contract – where processing is necessary to deliver services or meet contractual obligations, including obligations involving TransUnion.
Legal obligation – where processing is required to comply with applicable laws, regulatory requirements, or statutory obligations.
Legitimate interests – where processing is necessary for legitimate business purposes such as system security, fraud prevention, risk management, audit, and compliance, and where such interests do not override the rights and freedoms of individuals.
Consent – where required by law, and where individuals have been provided with a clear choice and the ability to withdraw consent at any time.
Where legitimate interests are relied upon, appropriate assessments are conducted to ensure that the rights and freedoms of data subjects are protected.
In rare cases, such as a medical emergency at a site we protect, we may also rely on vital interests – where processing is necessary to protect someone's life.
Special category and criminal offence data
Some processing involves more sensitive data, such as criminal record checks for job applicants in SIA-licensed roles. For this data we rely on additional conditions under the Data Protection Act 2018, including obligations under employment law, substantial public interest (preventing or detecting crime), and the establishment, exercise or defence of legal claims.
Our legitimate interests
Our legitimate interests include operating our business, fulfilling contractual obligations, ensuring system and data security, preventing fraud, supporting audit and compliance activities, and protecting TransUnion data. These interests are balanced against the rights and freedoms of individuals, with appropriate safeguards in place.
7. Provision of Personal Data
Is the provision of personal data statutory or contractual?
The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations. Personal data is required to:
enter into and perform contracts with customers, suppliers, or business partners;
process orders, manage accounts, and deliver goods and services;
verify identity and prevent fraud; and
comply with applicable legal, regulatory, accounting, and tax obligations.
What are the consequences of not providing personal data?
If you choose not to provide the personal data we request:
we may be unable to enter into a contract with you;
we may be unable to fulfil orders, supply goods, or provide services;
we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and
as a result, our services may be delayed, restricted, or declined.
Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us.
8. Non-Automated Decision Making and Profiling
We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.
These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.
The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.
9. Who we share personal data with
We may share personal data with customers or business partners, third-party service providers, regulators, or law enforcement bodies where required, and professional advisers. In particular, recipients may include:
Credit reference agencies – Creditsafe and its data partner TransUnion (see section 5);
Our clients – operational information needed to deliver their security services, such as incident reports, logs and CCTV footage;
Our group companies – Safe & Sound Haulage Limited and F.A.S.T Ambulance Service Limited, which share administrative and IT systems with us under a written data sharing agreement;
Service providers – such as IT and cloud, payroll, accounting, banking, training and background-checking (DBS) providers acting on our instructions under written data processing agreements;
Regulators and authorities – such as the Security Industry Authority (SIA), the ICO, HMRC, the Health and Safety Executive and the police, where required by law, to prevent or detect crime, or in response to a lawful request; and
Insurers and professional advisers – such as our insurers, auditors, accountants and solicitors, including for claims and legal proceedings.
We do not sell personal data.
10. International Data Transfers
We store and process personal data in the United Kingdom wherever possible. Data used for credit reference and affordability checks, including data obtained from Creditsafe and TransUnion, is handled only within the UK and is not accessed by individuals or providers outside the UK.
Some of our service providers are based in, or use systems located in, the United States. These are our website host (Squarespace) our website analytics provider (Google Analytics), and our office suite (Microsoft 365). Where personal data is transferred outside the UK, we make sure it is protected by an approved safeguard. This is either the UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”), for certified providers, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact our Data Protection Lead for more information about these safeguards.
11. How long we keep personal data
We keep personal data only for as long as necessary for its purpose and to meet legal or regulatory obligations. Data used for credit reference or affordability checks is retained only for as long as required and then securely deleted.
Our main retention periods are:
Client contracts and records: 6 years after the contract ends.
Financial and accounting records: 6 years after the end of the tax year.
Credit reference and affordability check results: only as long as required for the decision and related legal obligations, then securely deleted.
CCTV footage: 31 days, or up to 6 years where linked to an incident or legal claim.
Incident reports: 6 years after the incident.
Training course records: 6 years.
Unsuccessful job applications: 6 months after the recruitment process ends.
DBS check certificates: no longer than 6 months after the recruitment decision.
Website analytics data: 26 months.
We may keep data for longer where it is needed for legal proceedings, an investigation or a regulatory enquiry. When data reaches the end of its retention period, we securely delete or anonymise it.
12. How we keep personal data secure
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include:
unique user accounts, strong passwords and multi-factor authentication for remote access and sensitive systems;
role-based access, so staff can only see the data they need for their job;
encryption of data in storage and in transit, including encrypted laptops, mobile devices and backups;
firewalls, anti-malware protection and regular security updates;
secure storage of CCTV footage, with access restricted and logged;
clear desk and screen rules, locked storage and secure shredding of paper records; and
mandatory data protection training for all staff, with annual refreshers.
If a data breach occurs that is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay where the risk is high.
13. Your rights
Under UK data protection law, you have the following rights in relation to your personal data:
Right of access – You have the right to request a copy of the personal data we hold about you and information about how it is used.
Right to rectification – You have the right to request that inaccurate or incomplete personal data is corrected.
Right to erasure ("right to be forgotten") – You have the right to request that we delete your personal data where there is no lawful reason for us to continue processing it.
Right to restrict processing – You have the right to request that we limit how we use your personal data in certain circumstances.
Right to data portability – You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transfer it to another organisation where technically feasible.
Right to object – You have the right to object to the processing of your personal data where we rely on legitimate interests or where data is used for direct marketing.
Rights relating to automated decision making – You have the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you.
Right to withdraw consent – Where we rely on consent, you may withdraw it at any time.
To exercise any of these rights, please contact our Data Protection Lead in writing using the details in section 2. We may need to verify your identity before we act on your request.
We will respond within one month of receiving your request. For complex requests we may extend this by up to two further months, and we will tell you if we need to. We do not normally charge a fee, unless a request is manifestly unfounded or excessive.
Some rights are not absolute. For example, we may need to keep data to meet a legal obligation, or withhold information that would affect the rights of others or prejudice an investigation or legal proceedings. If so, we will explain why.
14. Complaints
You have the right to complain to the UK Information Commissioner's Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data.
We would appreciate the chance to resolve your concerns first, so please contact our Data Protection Lead in the first instance. You can contact the ICO at any time:
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
15. Our website and cookies
Cookies
Cookies are small text files placed on your device when you visit a website. We use the following types:
Necessary cookies – essential for the website to work, such as letting you navigate the site and use secure areas like the course booking checkout. These do not need your consent.
Analytical/performance cookies – help us understand how visitors use the website, such as which pages are visited most, so we can improve it.
We only set analytical and advertising cookies if you agree to them through our cookie banner. You can change your choice at any time.
The specific cookies we use include:
_ga (Google Analytics): distinguishes users so we can produce visitor statistics.
_gid (Google Analytics): distinguishes users to help us understand how the site is used.
_gat (Google Analytics): limits the rate of requests sent to Google Analytics.
Google Analytics is configured to limit the data it collects, and analytics data is kept for 26 months. You can also control and delete cookies through your browser settings. Disabling some cookies may affect how the website works.
Links to other websites
Our website may contain links to third-party websites. We are not responsible for their privacy practices or content, and we encourage you to read their privacy policies.
Children
Our website and services are not intended for children under 13. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
16. Changes to this policy
We review this Privacy Policy at least once every 12 months and update it when our practices or the law change. The date at the top of this policy shows when it was last updated.
17. Contact us
If you have any questions about this Privacy Policy, please contact:
Jacqui Jones, Data Protection Lead, Safe & Sound UK Limited, Unit 3 Millards Way, Standerwick, Frome, Somerset, BA11 2PL
Email: mydata@safeandsoundgroup.com
Telephone: +44 (0)1225 774008