sales@suttonpower.co.uk  |  +44 (0)1724 710010

Privacy Policy

Sutton Power, Sutton Energy & Sutton Energy Technology are trading names of Sutton Project Management LTD, referred to in this document as ‘company’.

How and what data we collect 

This privacy policy is aimed at all entities who interact with Sutton Power. This engagement may be in respect of:

Customers who may: 

  • Make an enquiry in relation to our products and services.
  • Request us to tender / quote for the supply of goods or services.
  • or use our products and services.
  • Subscribe to newsletters or alerts from us.
  • Where your information is available publicly.

Suppliers who:

  • Supplies products and or services to our ‘company’.
  • Have been approached to supply good or service to our ‘company’.

Personnel and workers (whether employed directly or not)

  • When an application to work for or on behalf of our ‘company’ is made.
  • When an application to provide services to our ‘company’ is made.
  • When you become an employee or our ‘company’.
  • When you provide subcontractor services to or on behalf of our ‘company’

Website and online users who: 

  • Use and interact with our website(s) or our digital campaigns

Visitors who are: 

  • Attending or planning to attend our factory, office or supplied equipment location sites.

This Privacy Policy is designed to:

  • Provide you with a clear overview of how we collect, use, and manage your personal data from the point at which it is gathered and onwards.
  • Explain how we use your information and how we comply with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
  • Set out your rights in relation to your personal information and how you can exercise them. For example, you have the right to object to certain uses of your information and to request the correction of any inaccurate data.

Data Processing

Sutton Project Management Ltd acts as a Data Controller, which means we determine what personal information is collected, how it is used, and for what purpose. We are responsible for ensuring that all processing of personal data complies with data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

All employees, managers, directors, and contractors working on behalf of Sutton Project Management Ltd are expected to handle personal data in accordance with this Privacy Notice and our GDPR & Data Protection Procedure. This ensures that whenever we process your personal information, it is done lawfully, fairly, and transparently.

Please note that, where necessary, your personal information may occasionally be processed at locations other than Sutton Project Management Ltd offices or sites (for example, by approved contractors working on our behalf).

If you have any concerns about the way we handle your personal information, you can contact our Data Protection Officer (DPO) using the details provided at the end of this notice.

We will only process your personal data under one or more of the following lawful bases:

  • Compliance with a legal obligation – where processing is necessary for us to meet the requirements of the law.
  • Contractual performance – where processing is required to deliver our services or fulfil a contract with you.
  • Vital interests – where processing is necessary to protect someone’s life.
  • Public interest or official authority – where processing is required in the exercise of official authority or to carry out a task in the public interest.
  • Legitimate interests – where processing is necessary for the purposes of our legitimate business interests, provided these are not overridden by your rights and interests.
  • Consent – where you have given us clear permission to process your personal data for a specific purpose.

What We Use Your Information For

We only collect and use personal data where it is necessary for legitimate business purposes, to fulfil legal or contractual obligations, or to provide the products and services you have requested.

Sutton Project Management Ltd collects and processes personal data in order to operate as a professional and legitimate business, and to provide customers with the products and services they request. The information we collect may be used for the following purposes:

  • Maintaining accurate records for employment, payroll, and financial reporting.
  • Verifying the competencies of individuals working for or providing services to the company.
  • Supporting the maintenance of business relationships and enhancing operational value.
  • Managing and maintaining our approved supplier database.
  • Ensuring accurate site and project records, including the ability to identify persons on site in the event of an emergency.
  • Accessing emergency contact information quickly, if required.
  • Conducting internal monitoring and reviewing of management systems.
  • Improving the products and services we deliver to our customers.

Sharing of Information

As a Data Controller, Sutton Project Management Ltd will define the purpose for which personal data is required and ensure that any sharing of data is carried out lawfully, fairly, and within the permitted grounds under the UK Data Protection Act 2018 and, where applicable, the UK GDPR. If data sharing cannot be conducted in compliance with these requirements, it will not take place.

Data will only be shared in a manner appropriate to its sensitivity, in line with company protocols, and using secure methods. When sharing data, we will always ensure that:

  • The recipient’s identity is verified and their reason for requesting the data is legitimate.
  • The data being shared is current, accurate, and relevant to the stated purpose.
  • Only the minimum necessary amount of data is transmitted, and unnecessary information is excluded.
  • Data is transferred using a secure platform and, wherever possible, in a format that cannot be altered.
  • Recipient details are re-verified prior to transmission to prevent unauthorised access.

We may share your personal data with carefully selected third parties, such as service providers, suppliers, professional advisers, or regulatory bodies, but only where this is necessary for business operations, to meet legal or contractual obligations, or where you have given your consent. We do not sell or share your information with third parties for marketing purposes.

Methods of Information Sharing

When personal or sensitive information needs to be transmitted, Sutton Project Management Ltd ensures that only secure and approved methods are used. The method chosen will depend on the nature of the information, its sensitivity, and the purpose of transmission.

  • Phone – Where information is shared over the phone, the recipient’s identity must be verified, and the reason for the request must be confirmed as legitimate.
  • Online Services – Information transmitted via online portals or services must be secure and encrypted, and may only be entered by authorised persons under the supervision of the Data Protection Officer (DPO).
  • Face to Face – Information may only be provided in person where approved by the DPO and in accordance with documented company protocols.
  • Verified Email – Only secure and encrypted email servers may be used to send and receive personal or sensitive information.
  • Letter – Standard post may be used only where no personal or sensitive data is enclosed.
  • Secure Letter – Where postal services are used to transmit sensitive or personal data, secure methods with appropriate tracking must be applied.

Retention of Data

We will not keep personal data for longer than necessary. Information is retained only for as long as it is required to fulfil the purposes outlined in this Privacy Policy, or to comply with legal, regulatory, or contractual obligations.

Examples include:

  • Employee records – retained for the duration of employment and for up to 6 years after employment ends, in line with legal and contractual obligations.
  • Financial and tax records – retained for a minimum of 6 years, in line with HMRC requirements.
  • Supplier and subcontractor records – retained for up to 6 years after the end of the business relationship.
  • Customer and project records – retained for the duration of the contract and for up to 6 years thereafter, to enable us to respond to queries, legal obligations, or warranty issues.
  • At the end of the relevant retention period, personal data will be securely destroyed or anonymised so it can no longer be associated with an individual.

International Data Transfers

We do not routinely transfer personal data outside the United Kingdom.

If, in future, it becomes necessary to transfer personal data internationally (for example, where service providers or partners are located outside the UK), we will ensure that such transfers are conducted in compliance with data protection legislation. This means we will only transfer data where:

  • The destination country has been granted an adequacy decision by the UK Government; or
  • UK-approved Standard Contractual Clauses or equivalent safeguards are in place; and
  • Data subjects continue to have enforceable rights and effective legal remedies.

Protection of information

We apply appropriate technical and organisational measures to ensure data is protected, including:

  • Access controls on all IT systems, networks, and offices.
  • Encryption, anonymisation, and secure archiving techniques where applicable.
  • Password protection for all files containing personally identifiable information.
  • PCs, laptops, and mobile devices secured with passwords and protected against malware, viruses, and spyware.
  • Regular data backups to prevent loss.
  • Strict access controls on company devices and mobile phones, ensuring only authorised personnel can view information for legitimate purposes.
  • Employee confidentiality obligations, enforced through restrictive covenants signed at the time of employment.
  • Restricted physical access to buildings.
  • Secure storage of confidential paper waste in locked receptacles pending shredding and disposal.
  • Regular uploading of paper-based information into secure electronic systems.
  • Retention of financial paper files at the company’s registered office.
  • Offices and worksites secured when unmanned.
  • Secure and irretrievable disposal of personal data once its retention period has expired.

Other Relevant Information

Requests from Authorities

By law, Sutton Project Management Ltd may be required to share certain personal information with government or regulatory authorities upon request. These may include, but are not limited to, HM Revenue & Customs (HMRC), the Health & Safety Executive (HSE), Customs and Excise, legal representatives, or the Child Maintenance Service. We will always verify the legitimacy of any such request before providing data, and where appropriate, we will inform or obtain consent from the individual concerned.

Website Data

When enquiries are submitted through our website contact form, the information provided (such as name, email, and phone number) is transmitted to us by email. This information is then accessed only by authorised employees for the purposes of responding to enquiries and providing information about our products and services.

In addition, our web hosting provider collects anonymised analytics data, which may include user behaviour, device type, language preferences, geographic location (country level only), site journey, and page interactions. This information is used to improve user experience, identify our target audience, enhance website visibility, support marketing opportunities, and improve usability.

Where personal details (such as employee information) are published on our website, this is only done with the express consent of the individual.

Children

We do not employ, subcontract, or retain details of individuals under the age of 18, nor do we offer services that require parental consent.

Special Category Data

We do not process or store “special category” data under GDPR, such as:

  • Medical or health records.
  • Data revealing racial or ethnic origin.
  • Political opinions.
  • Religious or philosophical beliefs.
  • Trade union membership.
  • Genetic or biometric data.
  • Data concerning a person’s sex life or sexual orientation.

Your Rights

Under the UK General Data Protection Regulation (UK GDPR), you have a number of rights in relation to your personal data. These include:

  • Right to Rectification – You have the right to have any inaccurate or incomplete personal data we hold about you corrected. Requests must be submitted in writing to the Responsible Person/DPO.
  • Right of Access – You may request a copy of the personal data we hold about you. Requests must be submitted in writing to the Responsible Person/DPO. We will respond within 30 days and will not charge for providing this information.
  • Right to Object or Restrict Processing – You may object to, or request restriction of, our processing of your personal information. Requests should be submitted in writing to the Responsible Person/DPO.
  • Right to Erasure (“Right to be Forgotten”) – You may request that we erase your personal data from our records. Requests must be submitted in writing to the Responsible Person/DPO.
  • Right to be Informed – If your personal data is subject to a data breach or unauthorised access, we will notify you to the extent required and undertake a full investigation. Where appropriate, the Information Commissioner’s Office (ICO) will also be informed.
  • Right not to be subject to Automated Decision-Making – We do not use personal data to make automated decisions, including profiling. All decisions are subject to human review.
  • Right to Data Portability – You have the right to request and receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to reuse it across different services.

Contact Details

If you have any questions about this Privacy Policy, the way we process your personal data, or if you wish to exercise any of your rights, please contact us:

Andy Martin

Sutton Project Management LTD

Priory Works

Crowle

DN17 4BY

 

INFO@SUTTONPOWER.CO.UK

 

Right to Complain

If you are not satisfied with the way we have handled your personal data, you have the right to raise your concerns with us directly in the first instance. If you remain dissatisfied, you also have the right to lodge a complaint with the UK’s supervisory authority for data protection:

Information Commissioner’s Office (ICO)

Website: https://www.ico.org.uk
Telephone: 0303 123 1113

The ICO will expect you to have given us the opportunity to resolve your complaint before contacting them.

Last Updated: 21/08/2025