Your privacy is important to us. When we process your personal data we comply with the UK GDPR and the Data Protection Act 2018, together with any other applicable data protection and privacy legislation.
Your personal data includes all the information we hold that identifies you or is about you. More information about the types of personal data we process about you is set out below.
Everything we do with your personal data counts as processing it, including collecting, storing, amending, transferring and deleting it.
This privacy policy provides information about the personal data we process about you, why we process it and how we process it. It applies to customers, suppliers and business contacts as well as candidates contacting us in relation to job vacancies.
Our responsibilities
Spence Harris Hogan Limited t/a SHH Architecture and Interiors (“SHH”) is registered in England with registered company number 02610615 and address at 1 Vencourt Place, Ravenscourt Park, Hammersmith, London W6 9NU. SHH is the controller of the personal data you provide.
If you have any questions about the ways in which we process your personal data, please contact us at info@shh.co.uk.
1. What data do we process about you?
Individual clients and prospective clients
If you wish to use our services as an individual client (for example in relation to your residential property) we process the following information about you, which may be collected through our website, by phone, by email or by other means:
• Identity data such as your full name and title and information about your directorships or shareholdings in any business related to the property, particularly if the business is funding the services we provide to you;
• Contact data such as your residential address, billing address (if different), email address and telephone numbers.
We process most of your information on the grounds of fulfilment of our contract with you, namely to liaise with you in respect of the services you have requested and provide those services to you. We may also use your personal data for our legitimate interests, including to provide you with information and/or a quote for our services or to carry out credit reference checks.
Website Visitors
To help us improve our website and the products and services we offer, we collect data about the ways in which you use our website. This includes, for example, technical data such as your IP address, which is collected through our use of cookies. More information (including the retention period for each cookie) can be found in our cookie policy, which is set out below.
Business Customers, Suppliers, Business Contacts and Visitors to our Premises
If you work for one of our business customers, suppliers or are one of our business contacts, we usually process your name and business contact details, such as your business email address and phone number and the address of your organisation. We process the information on the grounds of our legitimate interests in maintaining our relationship with you and the organisation for which you work.
We use CCTV in and around our premises for the purposes of crime prevention, detection and security. We retain CCTV images for 3 weeks unless the footage is relevant to an incident or investigation in which case we will retain the footage until the incident or investigation is concluded.
Candidates
If you apply for a job vacancy with us, or speculatively send us your CV, the personal data that we are likely to process about you includes:
• identity data such as your first name, middle names, last name, marital status, title, date of birth and gender;
• contact data such as your postal address, email address and telephone numbers;
• background data such as your education, career background and work experience;
• personal information such as your skills and qualities; and
• any other information that you include on any CV, application or covering letter you send to us.
We process your information on the grounds of our legitimate interests to determine whether or not we have a suitable vacancy for you. To the extent we need to process special categories of data about you (for example, to ensure our premises are suitably equipped for you if you attend for an interview), we will do so in accordance with our legal obligations. If you provide other special categories of data to us, we will usually process it on the grounds of your consent because you have voluntarily provided the information to us.
2. Our collection of your personal data
Customers, Prospective Customers, Suppliers and Business Contacts
We use different methods to collect data from and about you including through:
• Direct interactions
You may give us your personal data by corresponding with us by email, phone, post or otherwise or by filling in forms on our website. This includes personal data you provide when you choose to use our design services, when you liaise with us to discuss our services, if you ask us to send you information about our services or get in touch with us for any other reason.
• Automated technologies or interactions
As you interact with our website, we may automatically collect personal data about you. You can find out more information in our cookie policy, which is set out below.
Candidates
We receive personal data directly from you when you contact us in respect of a specific vacancy or with a speculative approach. We may also receive information about you from recruiters and agencies.
3. Who will receive your personal data?
Your personal data is only transferred to the extent that this is necessary. Recipients of your personal data may include:
• third party payment processors;
• third parties who work with us to provide the design services you have requested including suppliers of items you have requested and third party delivery companies and couriers;
• legal advisors to the extent they need to see your personal data to provide us with legal advice;
• third party providers of credit reference checks;
• third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy; and
• if you are a candidate, we may provide feedback to you via the recruiter or agency that recommended you to us.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
We may transfer your personal data outside of the EEA if we are working with you on a project located outside of the EEA. Any transfers of personal data will be minimal and limited to transfers of data to local companies that may, for example, deliver products directly to you. The personal data transferred to them is likely to be limited to your name and delivery address. If you would like any more information about the safeguards in place in respect of the transfer, please contact us.
4. How long will we keep your personal data?
Prospective Customers
We will retain your personal data while discussions with you are ongoing. If you choose not to go ahead with a project with us we will delete your personal data from our systems by the end of the next calendar year.
Customers
Your personal data is retained for no more than 16 years from the date we finish our provision of services to you. This enables us to meet the retention requirements set by the Royal Institute of British Architects and provides us with an additional calendar year so we can adopt an annual rolling deletion process.
Suppliers and Business Contacts
Your personal data is retained for the duration of our relationship with you or the organisation for which you work and for a further period of 7 years from the date our relationship with you ceases. Please let us know if you leave the organisation or if your details change. If we receive notification from you or your organisation that you no longer work at that organisation, or if we no longer maintain a working relationship with your organisation, we will delete your information from our system.
Candidates
If you are successful, we will retain your personal data in line with our employee facing privacy policy, a copy of which will be provided to you. If you are unsuccessful, we will retain your application, CV and/or covering letter and any other personal data you provided to us for 6 months from the date we reach our decision in case any other suitable roles arise in which we think you may be interested, or in case you have any questions about our decision. After that date, your personal data will be permanently deleted or destroyed.
5. What are your rights?
You benefit from a number of rights in respect of the personal data we hold about you. We have summarised your rights below, and more information is available from the Information Commissioner’s Office website. These rights apply for the period in which we process your data. There are certain caveats and exemptions to those rights which mean that in some circumstances you may not be entitled to exercise them, if we believe that is the case upon receipt of a request from you we will let you know.
Access to your data
You have the right to ask us to confirm that we process your personal data, as well as access to and copies of your personal data. You can also ask us to provide a range of information, although most of that information corresponds to the information set out in this fair processing notice.
Rectification of your data
If you believe personal data we hold about you is inaccurate or incomplete, you can ask us to rectify that information.
Right to be forgotten
In some circumstances, you have the right to ask us to delete personal data we hold about you.
Right to restrict processing
In some circumstances you are entitled to ask us to suppress processing of your personal data. This means we will stop actively processing your personal data but we do not have to delete it.
Data portability
You have the right to ask us to provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit the personal data to another data controller.
Right to object
You are entitled to object to us processing your personal data:
• if the processing is based on legitimate interests or performance of a task in the public interest or exercise of official authority;
• for direct marketing purposes (including profiling); and/or
• for the purposes of scientific or historical research and statistics.
We do not intend to use your personal data to send you direct marketing nor for scientific or historical research and statistics.
Automated decision making
Automated decision making means making a decision solely by automated means without any human involvement. We do not carry out any automated decision making.
6. Questions or concerns
If you think we have processed your personal data unlawfully or that we have not complied with GDPR, please get in touch with us so we can help. You can report your concerns to the supervisory authority in your jurisdiction. The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You can call the ICO on 0303 123 1113 or get in touch via other means, as set out on the ICO website – https://ico.org.uk/concerns/.
