About the company

Waystone Limited (“Waystone”) is a company registered in England and Wales under company number 02451184 whose registered office is at CP House, Otterspool Way, Watford, WD25 8JJ. The Company is registered as a data controller with the ICO and our registration number is ZA918928. The Company have a Privacy officer (“PO”). Contact details can be found at the end of this privacy notice.

About the privacy policy

This privacy notice applies to the personal data the Company (which includes Waystone subsidiaries – Waystone Development Ltd, Waystone 32 Ltd and Waystone Unity LLP) collects data about you through www.waystone.co.uk (our “Website”), by post, by telephone, in person, through our social media platforms, from third parties and when you otherwise communicate with us.

If you visit our website, the Company will collect information about your engagement with us online via our cookies and similar technologies such as your IP address and geographical location. See our Cookie Notice for more information on our use of cookies and similar technologies

Our Website may, from time to time, contain links to and from the websites of third parties. If you follow a link to any of these websites, please note that these websites have their own privacy policies and the Company does not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Definition of personal data

Personal data is any information that relates to an identified or identifiable living individual. This means that the individual is directly identifiable from that information or could be indirectly identified from that information in combination with other information.

Personal Data the Company collects:

Initial enquiry about land

• Registration with the Company – by phone, email or registered interest through the website.
  • What is collected: – Name, email address, phone number, Company name (this could be through a third-party broker).
  • Purpose: – To register your interest in our products and services and to provide consent for communication.
  • Data retention: – In alignment with all the Company customer data – 7 years.
  • Lawful basis: – In order to contact you about arranging a suitable date and time for viewings. Plus to be able to assist in any future proposals.

Land Sites

• Local Authorities
  • What is collected: – Name, email address, phone number,
  • Purpose: – To agree design of the build.
  • Data retention: – 25 years after the completion of the site. This is due to any potential legal requirements. Or longer depending on specific circumstances.
  • Lawful basis: – To enable the agreement of the build.
  • Third party data transfer: – Information is passed to utility companies as required.
• Construction Contracts
  • What is collected: – Name, email address, Company name, phone number, home address (if a sole trader), bank account details.
  • Purpose: – For an agreement to work on the construction site.
  • Data retention: – 7 years after the end of the contract. This is due to legal requirements.
  • Lawful basis: – To enable work to be performed on the construction site.

Services provided to visitors of the land sites and the offices

• Provision of CCTV
  • What is collected: – Video footage of land perimeter and site office.
  • Purpose: – To protect persons and property.
  • Data retention: – Up to 7 days unless requested for legal purposes, after which video footage is automatically written over.
  • Lawful basis: – Legitimate interest in keeping the property secure and to protect persons.
• Holding names of business contacts
  • What is collected: – Name, email address, Company name, phone number.
  • Purpose: – Enable communication with a view to working together.
  • Data retention: – In alignment with all the Company customer data – 7 years.
  • Lawful basis: – Legitimate interest in being able to do business.
• Visitors to the land sites and offices
  • What is collected – Name, vehicle licence number, work credentials (where appropriate)
  • Purpose – To allow access to the site.
  • Data retention – Deletion of the visitor sign in sheets once visitor’s book is completed.
  • Lawful basis – Legitimate interest in being able to do business.
• Entry to the land sites
  • What is collected – Name, time of entry.
  • Purpose – To allow access to the office.
  • Data retention –1 year after termination of agreement.
  • Lawful basis – Being able to provide safe and secure access to the site.
• Insurance claims
  • What is collected – Name, address, car registration, medical records.
  • Purpose – To process any claims filed.
  • Data retention – For as long as there is the potential for a claim or while the claim is active.
  • Lawful basis – Legal obligation in order to be able to process claims.

Note that data may be held for longer than the stated retention period because:

i) We review and delete information periodically.

ii) After deletion on the database, data will continue to exist temporarily on backup files which are maintained to ensure operational resilience. The Company uses IT security techniques to ensure that these are accessible only for the purpose of restoring the database in the event of a loss of data and that they cannot be copied to reveal data. Backup files are destroyed on a rotating basis within 4 weeks.

The Company retains core information for 7 years after the end of an agreement.

Job applications

If you apply to work with the Company, the Company will use the data the Individual gives the Company only to process the Individual’s application and to monitor recruitment statistics. If the Company wants to disclose information to an Individual outside the Company – for example, if the Company needs a reference – the Company will make sure the Company tells the Individual beforehand, unless the Company are required to disclose this information by law.

If the Individual is unsuccessful in the job application, the Company will hold the Individual’s personal data for 6 years after the Company has finished recruiting the position the Individual applied for. After this date the Company will destroy or delete the Individual’s information.

Data sharing

Except as explained in this privacy notice, the Company will not share your personal data without your consent unless required to do so by law.

The Company may share your personal data with the following third-parties where the Company are legally required to do so or to assist us with administering the provision of our services to you: Business partners, suppliers and sub-contractors for the performance of any contract the Company enters into with them to perform services on our behalf, such as:

• External auditors
• Payroll providers
• External advisors
• Debt collection agencies

How the Company protects your personal data

Data Security

The Company implement appropriate technical and organizational measures to protect your personal data.

Transfers of your personal data outside the UK

Your Personal Data may be processed outside of the UK. This is because the organisations the Company uses to provide our service to you are based outside the UK.

The Company have taken appropriate steps to ensure that the Personal Data processed outside the UK has an essentially equivalent level of protection to that guaranteed in the UK. The Company do this by ensuring that:

• Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation), or
• The Company enters into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary.

How long the Company keeps your personal data

The Company will retain your personal data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.

At the end of the retention period, your personal data will be securely deleted or anonymised, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning

Your data rights and how to complain

You have certain rights in relation to the processing of your Personal Data, including to:

• Right to be informed

You have the right to know what personal data the Company collects about you, how the Company uses it, for what purpose and in accordance with which lawful basis, who the Company shares it with and how long the data is kept it. The Company use our privacy notice to explain this.

• Right of access (commonly known as a “Subject Access Request”)

You have the right to receive a copy of the Personal Data the Company holds about you.

• Right to rectification

You have the right to have any incomplete or inaccurate information the Company holds about you corrected.

• Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete your Personal Data.

• Right to object to processing

You have the right to object to us processing your Personal Data. If you object to us using your Personal Data for marketing purposes, the Company will stop sending you marketing material.

• Right to restrict processing

You have the right to restrict our use of your Personal Data.

• Right to portability

You have the right to ask us to transfer your Personal Data to another party.

• Automated decision-making.

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. The Company does not use automated decision-making.

• Right to withdraw consent

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, the Company will no longer process your information for the purpose(s) you originally agreed to, unless the Company is permitted by law to do so.

• Right to lodge a complaint

You have the right to lodge a complaint with the relevant supervisory authority, if you are concerned about the way in which the Company is handling your Personal Data. The supervisory authority in the UK is the Information Commissioner’s Office who can be contacted online at: Contact us | ICO

How to exercise your rights

You will not usually need to pay a fee to exercise any of the above rights. However, the Company may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, the Company may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. The Company may need to request specific information from you to confirm your identity before the Company can process your request. Once in receipt of this, the Company will process your request without undue delay and within one month. In some cases, such as with complex requests, it may take us longer than this and, if so, the Company will keep you updated.

How to contact us and our Privacy Officer

If you wish to contact us in relation to this privacy notice or if you wish to exercise any of your rights outlined above, please contact us as follows:

Privacy Officer
CP House
Otterspool Way, Watford
England, WD25 8JJ
By email: sue.nicklin@waystone.co.uk