Privacy Policy

Thurston Group Limited was founded in 1970, we manufacture high-quality bespoke Portable
and Modular Buildings for our client’s construction and development projects across the UK and
Europe, and acts as both manufacturer and principal contractor in addition to providing a
manufacturing service for other specialist contractors delivering projects across a range of
sectors, such as; Infrastructure, Residential, Education, Healthcare, Commercial and Leisure.
All divisions of Thurston Group Ltd operate from our head office and factory based in Horbury, and
additional production facilities based in Catfoss and Ottringham, Yorkshire.
Here at Thurston Group we process personal data for 4 main reasons:
1. In relation to client organisations and their employees;
2. As employers;
3. In the performance of a supplier contract;
4. If we have permission from the user, or where otherwise allowed by law, to market them

Who we share information with:

We will not share your information with any third parties unless:
I. It is necessary in the performance of our contractual obligation to you;
II. They are a third-party data processor acting on our instruction.

Lawful Basis

Our lawful basis for processing your personal information is set down in the General Data Protection
Regulation (GDPR) under Article 6(1)(b) contract: the processing is necessary for a contract we
have with you, or because you have asked us to take specific steps before entering into a contract.
Where we market to you our lawful basis for processing your personal information is set down in the
GDPR under Article 6(1)(f): legitimate interests: the processing is necessary for Thurston Group’
legitimate interests or the legitimate interests of a third party unless there is a good reason to
protect the personal data which overrides those legitimate interests.

Collection of personal information

We may gather information about you when you fill in forms on our websites and when you contact
us by phone or email. The information you give us may include (but is not restricted to) your name,
postal address, email address, landline and/or mobile telephone number, and information about
your employment (including your job title, responsibilities and employer’s details) as well as other
personal information. Thurston Group does not use cookies on our website.

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised
access or disclosure, we have put in place suitable physical, electronic and managerial procedures
to safeguard and secure the information we process.

Use of data processors

Data processors are third parties who necessarily provide elements of our internal practices. We
have contracts in place with our data processors. This means that they cannot do anything with your
personal information unless we have instructed them to do it. They will not share your personal
information with any organisation apart from us. They will hold it securely and retain it for the period
we instruct.

Use of other third parties

Some third parties with whom we share your data are data controllers in their own right in which
case they will have their own retention periods. We have contracts with all third parties to ensure
the security of your data that we share with them.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these
links to leave our site, you should note that we do not have any control over that other website.
We cannot be responsible for the protection and privacy of any information which you provide whilst
visiting these sites and those sites are not administrated by this privacy statement. You should
exercise caution and look at the privacy statement applicable to the website with which you are
engaging.

Employees and Contractors

Thurston Group is the data controller for the information you provide during the employment and
application process unless otherwise stated. If you have any queries about the process or how we
handle your information please contact our dedicated Data Protection officer, Yvette Thompson.

What will we do with the information you provide to us?

All of the information you provide during the process will only be used for the purpose of
progressing your application, or to fulfil legal or regulatory requirements. We will not share any of the
information you provide during the recruitment process with any third parties for marketing
purposes or store any of your information outside of theEuropean Economic Area. The information
you provide will be held securely by us and/or our data processors whether the information is in
electronic or physical format.

We will use the contact details you provide to us to contact you to progress your application. We will
use the other information you provide to assess your suitability for the role you have applied for.
Speculative Applications. As a construction business we sometimes receive speculative
applications. When these are received, if there is no suitable vacancy at that time we keep them in
our system for 12 months at which point we will securely delete your information.

What information do we ask for, and why?

We do not collect more information than we need to fulfil our stated purposes and will not retain it
for longer than is necessary. The information we ask for is used to assess your suitability for
employment. You don’t have to provide what we ask for but it might affect your application if you
don’t.

Advertised positions

We ask you to send us a current CV and a covering letter which will include your personal details
including name and contact details, as well as your previous experience, education, referees and
any other information relevant to the role you have applied for.

Shortlisting

The relevant head of department will shortlist applications for interview. They will receive all
information supplied at that time. You may be required to provide:
• Proof of your identity – you will be asked to attend our office with original documents, we will
take copies.
• Proof of your qualifications – you may be asked to attend our office with original documents, we
will take copies.
• You may be asked to complete a DBS (Disclosure and Barring Service) check to declare any
unspent convictions.
• We may contact your referees, using the details you provide in your application, directly to
obtain references.
• We may ask you to complete a questionnaire about your health. This is to establish your
fitness to work as well as for your well-being whilst on our premises.
If we make a final offer, we will also ask you for thefollowing:
• Bank details to process salary payments.
• Emergency contact details, so we know who to contact in case of an emergency at work.
• Information for your inclusion into our pension scheme.
• Driving License and endorsement details, if you will be using a company vehicle.
If you are unsuccessful following assessment for the position you have applied for, we may ask if
you would like your details to be retained in our talent pool for a period of 12 months. If you say
yes, we would proactively contact you should any further suitable vacancies arise.

Contractors

The nature of Thurston Group’ business means that we necessarily employ freelance specialists
on a contract basis. We process the employment/engagement information supplied for the
performance of that contract in the same secure way as we do for our permanent staff. We retain
their data for the duration of that contract and for such period thereafter as is necessary in line with
our retention policy. Thurston Group is the data controller for the information you provide for the
duration of our contractual relationship unless otherwise stated. If you have any queries about the
process or how we handle your information please contact us. We will process this data because
the processing is necessary for the performance of our mutually agreed contract.

We will process special category data we hold about you in accordance with Article 9(2)(b) of the
GDPR, i.e. that the processing is necessary for the purposes of carrying out the obligations and
exercising specific rights of Thurston Group or of the data subject in the field of employment and
social security and social protection law in so far as it is authorised by Union or Member State law
or a collective agreement pursuant to Member State law providing for appropriate safeguards for
the fundamental rights and the interests of the data subject.

Criminal Offence Data

Due to the nature of our work, in that employees and contractors may come into contact with
children and vulnerable persons, we require that some employees are subject to a DBS check.
These forms are processed electronically and stored in a secure location accessible only to
specified members of staff. Where third parties require the information, this is pseudonymised prior
to disclosure. Any checks that disclose criminal convictions are not retained by Thurston Group. We
process this data in accordance with Article 10 of the GDPR (and/or any subsequent legislation
contained in the Data Protection Bill). We do not keep a comprehensive register of our employees’
criminal convictions.

Where employment and freelance information is kept
HR data is kept securely in electronic and hard copy files and accessed only by members of the
Senior Management team, Human Resources, and SHEQ.

How long is the information retained for?

If you are successful, the information you provide during the application process will be retained by
us as part of your employee file for the duration of your employment/engagement plus 6 years
following the end of your employment/engagement. This includes your criminal records declaration,
fitness to work, records of any security checks, and references. The information generated throughout
the assessment process, for example, interview notes, is retained by us for 6 months following the
closure of the campaign.

Others

There may be other individuals with whom we do business and for whom we hold personal data,
such as those who work for supplier companies. We process this information in accordance with
our contracts with those organisations.

Updating your personal information

You can update your personal information at any time, and change your marketing preferences.
To do this, please email us at info@thurstongroup.co.uk

Your Rights

Under current UK data protection legislation, you have rights as an individual which you can exercise
in relation to the information we hold about you. Individuals have the right to see the personal data
held by Thurston Group (a subject access request). Once the person requesting the information
has been identified the request will be carried out within one calendar month in a clear and easy
to read way. There are numerous and various exemptions to this right and each request will be
dealt with on a case by case basis.

Individuals have the right to have their data rectified where it is incorrect or out of date. Where a
request for data rectification is made it will be dealt with in a similar way to a subject access request
(SAR), i.e. within a strict time frame. You also have the rights to (i) erasure and (ii) restriction and
you can request that we remove your data or restrict the processing of it. Your right to object to the
processing of your data is an absolute right which will be dealt with immediately unless there are
compelling grounds for us to continue the processing where appropriate.

You can read more about these rights here:

https://ico.org.uk/for-the-public/is-my-information-being- handled-correctly/

This privacy policy was updated on 28th September 2018. We reserve the right to update and alter this policy.