Data Controller: MH Fire & Security Limited

Registered address: The Laurels, 18a St Cyres Road, Penarth, CF64 2WQ

Email: [email protected]

Telephone: 02920 003621

We are registered with the Information Commissioner's Office (ICO) as a data controller. If you have any questions about how we handle your personal data, please contact us using the details above.

We may collect and process the following categories of personal data:

• Identity data: your name
• Contact data: email address, telephone number, postal address
• Enquiry data: the content of messages you send us via our contact form or by email
• Technical data: IP address, browser type and version, time zone, browser plug-in types, operating system, and other technology on the devices you use to access our website
• Usage data: information about how you use our website, products, and services
• Marketing preferences: your preferences in receiving marketing from us

We do not collect any special category data (such as health, racial or ethnic origin, political opinions, religious beliefs, or biometric data) unless specifically required for a service and with your explicit consent.

We use your personal data for the following purposes:

• To respond to enquiries you submit via our contact form or by telephone or email
• To provide quotations and carry out fire and security installation, maintenance, and service work
• To manage our ongoing relationship with you as a customer
• To send service reminders, maintenance notifications, and compliance updates where you have requested this
• To comply with our legal and regulatory obligations (including SSAIB certification requirements)
• To improve our website and services using anonymised analytics data
• To send marketing communications where you have given your consent or where we have a legitimate interest to do so

We will never sell your personal data to third parties or use it for purposes incompatible with those listed above.

Under UK GDPR, we rely on the following lawful bases to process your personal data:

• Contract (Article 6(1)(b)): processing is necessary to perform a contract with you or to take steps at your request before entering into a contract (e.g. providing a quotation or carrying out installation work)
• Legal obligation (Article 6(1)(c)): processing is necessary to comply with a legal obligation (e.g. maintaining records required by our SSAIB certification or fire safety legislation)
• Legitimate interests (Article 6(1)(f)): processing is necessary for our legitimate interests, such as responding to enquiries, improving our services, and direct marketing to existing customers, provided these interests are not overridden by your rights
• Consent (Article 6(1)(a)): where you have given clear consent for us to process your data for a specific purpose, such as receiving our newsletter or marketing communications

We do not sell, rent, or trade your personal data. We may share your data with:

• Service providers: third-party companies that provide services on our behalf, such as IT support, email hosting, and website analytics. These providers are contractually obligated to process your data only on our instructions and in accordance with UK GDPR.
• Monitoring stations: where you have subscribed to a monitored alarm service, your contact details and alarm information will be shared with our approved monitoring centre for the purpose of responding to activations.
• Regulatory bodies: SSAIB or other certification bodies as required to maintain our accreditation.
• Law enforcement or regulators: where we are legally required to do so.

We do not transfer your personal data outside the United Kingdom or the European Economic Area unless appropriate safeguards are in place.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

• Customer records: retained for 7 years after the end of our business relationship, in line with HMRC requirements
• Installation and maintenance records: retained for the lifetime of the system and for a minimum of 6 years thereafter, as required by BS 5839 and BS 4737
• Enquiry data (no contract entered into): retained for up to 12 months
• Marketing consent records: retained until you withdraw consent or for 3 years from last contact, whichever is sooner

When data is no longer required, it is securely deleted or anonymised.

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you (a Subject Access Request)
• Right to rectification: you may ask us to correct inaccurate or incomplete data
• Right to erasure: you may ask us to delete your personal data where there is no compelling reason for us to continue processing it
• Right to restrict processing: you may ask us to suspend processing of your data in certain circumstances
• Right to data portability: you may request that we transfer your data to you or a third party in a structured, commonly used, machine-readable format
• Right to object: you may object to processing based on legitimate interests or for direct marketing purposes
• Rights related to automated decision-making: we do not use automated decision-making or profiling

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Our website uses cookies to distinguish you from other users and to improve your experience. A cookie is a small file placed on your device.

We use the following types of cookies:

• Strictly necessary cookies: essential for the website to function. These cannot be switched off.
• Analytics cookies: help us understand how visitors interact with our website. We use this information to improve our site. These are only set with your consent.
• Preference cookies: remember your settings and choices (e.g. cookie consent preferences).

You can control and delete cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. You can also manage your consent preferences via the cookie banner displayed on your first visit.

We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These include:

• Encrypted data transmission (HTTPS/TLS)
• Access controls limiting who can access personal data within our organisation
• Regular security reviews of our systems and processes
• Staff training on data protection obligations

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. Where changes are significant, we will notify you by email (if we hold your email address) or by a prominent notice on our website.

We encourage you to review this policy periodically to stay informed about how we protect your data.

If you have any questions, concerns, or requests relating to this privacy policy or our data processing activities, please contact us: