Who is this privacy notice for?
This Privacy Notice applies to information we collect about clients and businesses who interact with CDS Rose Ltd, whether that be contracting our services, receiving marketing information or interacting with us on social media platforms. It explains what personal information may be collected and how we use it.
Who we are
We are CDS Rose Ltd, a UK-based registered company (registration number 07089509) specialising in Legionella compliance and water hygiene management services across London and the South East of England. We are committed to providing a professional and speedy service whilst maintaining the highest quality of work.
We are also committed to protecting personal data shared with us and complying with data protection law to its fullest extent. This Privacy Notice explains how we use and protect personal information, to show that we are adhering to the Data Protection Act 2018 (DPA 2018), UK GDPR and the Privacy and Electronic Communications Regulations in respect of marketing compliance.
The DPA 2018 and UK GDPR require every organisation that processes personal information to be registered with the Information Commission. Our registration number is ZA856973.
How to contact us
If you have any questions about how your personal information is used, please contact our Director, Samantha Carter, by email at info@cdsroseltd.co.uk or by post at:
30 Reinden GroveMaidstone
Kent
ME15 8TH
What personal information we collect and how we use it lawfully
The following sections explain the types of data we collect and the legal basis, under current data protection legislation, on which this data is processed. Most of the information we process is provided to us directly by you for one of the following reasons:
- Service enquiries
- Tendering or pricing a survey
- Contracting our services
- Administering your account with us
- Invoicing and financial transactions
- Responding to any concerns or complaints
- Collecting client reviews to evaluate and promote our services
- Limited analytics on our web traffic
- Legal compliance and financial audit purposes
Service enquiries
If you enquire about our services as a business customer, we will collect the organisation you work for, your name and contact details (phone and email), and the location of the premises needing our services.
This will be collected either via the website, email or telephone, depending on your preferred contact method. As it is necessary for us to collect that data to enable us to respond to your enquiry in the way you would expect, we have a legitimate interest in processing that data. You can request your information to be deleted at any time; however, we might not be able to provide you with our services or a reply if you request deletion of your information.
Service commissioning
If you commission our services, we will be entering into a contractual relationship with you, and this is our legal basis for processing your information. We will collect any organisational details, contact details and any details of contacts you provide us with to enable us to fulfil our contractual obligations towards you.
We will also process limited financial details for the purpose of invoicing and financial transactions.
Website traffic analytics
We use Google Analytics to monitor website traffic. This helps us understand how you interact with our websites, measure the effectiveness of our websites and improve user experience. When you accept cookies on our sites, you are consenting to the cookie being deployed. We consider it is in our legitimate interest to understand the nature of your engagement if you accept cookies.
Types of information
The types of information that we may collect or hold about you are:
- Where you have contracted our services, we will hold your contact details including your name, email address and phone number (mobile and occasionally landline).
- Where it differs from the billing address, we may hold the premises address for an assessment or for providing water hygiene services.
- For service enquiries, we will simply hold your name, email address and phone number.
- We cannot identify individuals from our web analytics data, although Google Analytics does capture such aspects as the date and time of visits, pages visited and scrolled, and outbound clicks.
Sources of information
Your information may be sourced directly from you or a business representative when you contact us. This information will be captured from enquiries, requests for service details and responses to advertised vacancies.
Who we may share your information with
We, like many businesses, work in partnership with a number of third-party suppliers:
| Partner | Purpose | Location and safeguards |
|---|---|---|
| QuickBooks | Accounting platform | QuickBooks is a cloud-based accounting platform operated by Intuit. Data is hosted within secure data centres, with customer data for UK and EU users typically stored in the EU, supported by appropriate transfer safeguards where applicable. The platform applies industry-standard technical and organisational security measures, including encryption in transit and at rest, access controls and regular security monitoring. |
| OMB Tax Ltd | Accountants | OMB Tax Ltd is a UK-based accountancy firm operating within the United Kingdom. Client data is processed primarily within the UK, using controlled systems and procedures appropriate to professional accountancy services. Security measures include restricted access to client information, secure storage systems and confidentiality obligations aligned with regulatory and professional standards. |
| General administration | Google Workspace is used to support general administration functions. Data is stored within Google's global data centre infrastructure, with location controls and data residency options applied where available. Google implements robust security measures including encryption at rest and in transit, strong access management, multi-factor authentication and continuous security monitoring. | |
| Microsoft Teams | Online meeting delivery | Microsoft Teams is used for online meeting delivery and collaboration. Data is hosted within Microsoft's cloud environment, with UK and EU tenant data stored in EU data centres where applicable. The service benefits from Microsoft's enterprise-grade security framework, including encryption, identity and access management, audit logging and compliance with recognised international security standards. |
Outside of our contracted suppliers, we will only share your information where we may be legally required to do so.
How long we keep your data
We take the principles of data minimisation seriously and ensure that we only ever ask for the minimum amount of data for the associated purpose and delete that data once it is no longer required.
- QuickBooks, as our accounting platform, defaults to a seven-year retention period for financial transactional data.
- Where your information is associated with assessments, surveys or service delivery, we will keep that information for up to five years.
- As a client who receives marketing information from us, we will hold your information in perpetuity. If you unsubscribe from our marketing emails, we will retain limited details in order to suppress further contact with you.
Security
We ensure that your contact information is kept safe and secure and have appropriate technical and organisational security measures in place to protect the limited amount of identifiable data that we do hold.
All our staff are externally vetted (DBS checked) for your added peace of mind.
Your data protection rights
You have a number of rights under UK data protection law. These are listed below, along with our contact details, should you wish to make a request.
- Informed: You have the right to be informed about how we handle your personal data. This privacy statement is one of the ways we do this.
- Access: You have the right to ask for a copy of the personal data we hold about you and the purposes for which we are using it. Personal data is any information which can directly or indirectly identify you.
- Rectification: You have the right to ask us to change any details that we hold which are incorrect, inaccurate or need updating.
- Erasure (known as the right to be forgotten): You have the right to ask us to delete your personal details under certain circumstances. We will assess any deletion request on a case-by-case basis. If you subscribe to our email list, we can quickly fulfil your request, but in other circumstances there may be reasons why we need to keep information about you.
- Object: You have the absolute right to object to receiving direct marketing from us. You also have the right to raise an objection about how we are handling your personal information.
- Restriction: You have the right to ask us to restrict or suppress your personal information. This would mean we would store it but not use it.
- Portability: You have the right to obtain and reuse your personal data for your own purposes across different services. Due to the nature of our organisation, we do not believe this right is likely to apply.
The Data (Use and Access) Act 2025 created a formal, legally regulated complaints process for personal data concerns. Under these requirements, we must acknowledge any complaint received within 30 days of receipt, investigate those concerns and respond to you without undue delay. In more complex cases, we will keep you informed of progress throughout the investigation.
You still have the right to escalate your concerns at any time to the UK regulator, the Information Commission, by contacting them through their complaints service. Under these changes, the Information Commission will not investigate complaints where there has been no attempt at local resolution first.
If you would like to exercise any of the rights listed above, or any other legal rights you have over your data under current legislation, please email info@cdsroseltd.co.uk.
Marketing
Email campaigns
CDS Rose issues periodic marketing to clients and businesses who have engaged with us or enquired about our services. Business-to-business marketing does not require explicit consent provided the content of the communication is relevant to the recipient.
Recipients may unsubscribe at any time by using the unsubscribe link in the email.
Social media advertising
We do not undertake paid advertising on social media platforms, although you may come across us naturally in your newsfeed as we post regularly about our products, services and exhibition attendance.
Cookies
Our site uses very few cookies, but we do utilise Google Analytics to track engagement with our websites. We will always ask for your consent before deploying non-essential cookies to your devices through our Consent Management Platform, CookieYes. CookieYes captures and manages all cookies that we use, and you may change your preferences at any time.
Our promise to you
- We will keep your information secure and confidential.
- We do not spam you with marketing, although we do send business-to-business marketing emails from time to time. You are in control of how we communicate with you and can opt in, opt out or change your preferences at any time through the unsubscribe link at the bottom of any marketing email received.
- We will not sell your data to a third party.
- We will not share your data with a third party save for our contracted suppliers and subcontractors in order to fulfil a service.
- We know how to manage your information appropriately and in line with legal and regulatory requirements.