Who we are
This privacy notice is issued by CompetentRoofer Limited trading as NFRC Competent Person Scheme a company registered in England and Wales (company number 5704588) with the registered address 31 Worship Street, London EC2A 2DY and known as ‘NFRC CPS’ (collectively referred to as “we”; “us” and “our”) and relates to our use of any personal data, concerning you, (referred to as “data”, “you”, “your”, “user” and “end-user”) collected by us; where you are an NFRC CPS registered (contractor) business, an individual who works for or with an NFRC CPS registered (contractor) business or consumer.
We respect your privacy rights and your rights as a data subject. We will manage and protect your data accordingly whilst it is in our hands in accordance with all applicable data protection legislation and in accordance with this notice. This notice supersedes any previous Privacy Notice. We may update this Privacy Notice from time to time to ensure that it remains accurate.
Who is the Data Controller?
NFRC CPS acts as a Data Controller in respect of your personal data that we process. If you have any questions about this Privacy Notice and how we use your personal data, please get in touch using the details below:
NFRC Competent Person Scheme
31 Worship Street
London
EC2A 2DY
Tel: 020 448 3189
E-Mail: [email protected]
How did we receive your data?
Your data was submitted to us, in order to arrange your certification services, by the NFRC CPS Registered Contractor (business). Your data was not sourced by us, from a publicly accessible source. We collect personal and relevant payment collection data via: Website forms, Secure NFRC CPS Registered Contractor (business) Login Member Portal, telephone, email, face-to-face, written documentation via Post.
What types of data do we process?
Below is a list of data subject types and the information we collect and use:
NFRC CPS Registered Contractor business:
A company that is registered with NFRC CPS and is using one of our services. Information held will include: contact names, contact telephone numbers, contact email.
Individual (who works for or with an NFRC CPS (contractor) business):
Key business contacts for installation, works, health and safety, finance and marketing, associated with business activities registered via NFRC CPS.
Information held will include: contact name, contact telephone number, Contact email, qualification, training and opinions of competence records
Consumer:
A customer of the NFRC CPS Registered Contractor (business). Information will include: contact name, contact telephone number, contact email address, postal address.
In respect of your data: We do not hold or process special categories of data (those relating to your racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; sexual orientation; genetic data; biometric data; or data relating to any criminal convictions or offences).
What is the purpose of data processing?
We need to process your data in order to fulfil processes which determine if the NFRC CPS Registered Contractor (Businesses) meet NFRC CPS Certification scheme criteria, which may include government authorised schemes.
The legal basis for processing your data are:
- Processing your data is necessary in order to protect the vital interests of building occupants and users by providing a framework for ensuring installation work meets industry standards and, where applicable, Building Regulation requirements.
- Where your data is processed for a government-endorsed Competent Person Scheme, processing your data is necessary in order to perform a public task in the public interest and the task has a required legislative requirement.
- Processing your data is necessary in pursuit of our legitimate interests in certifying NFRC CPS Registered Contractor’s (business) installation work.
- Processing your data is necessary for the fulfilment of the certification contract between the NFRC CPS Registered Contractor (business) and us.
How will we use your data?
We will use your data, in the normal course of business to:
- Certify installation work.
- Handle consumer complaints.
- Deal with any complaints that you may have.
- Verify identity.
- Confirm with third parties that you have, where applicable, met scheme requirements.
- NFRC CPS Registered Contractor’s (business) will be listed in a directory on NFRCcps.com to enable consumers to contact or identify them.
Your data will not be used by us for the purposes of any automated decision-making or profiling.
What types of data do we process?
NFRC CPS Registered Contractor (business) key contacts:
The data we hold is limited to your name, contact details, relevant qualifications, address, and information we receive as part of a complaint made by you.
Individual (who works for or with an NFRC CPS Registered Contractor (business):
The data we hold is limited to your name, contact details, relevant qualifications and information we receive as part of a complaint made by you.
Consumer:
The data we hold is limited to your name; address; contact details; information about your installation; and information we receive as part of a complaint made by you.
Will third parties receive your data? What are their interests?
Where NFRC CPS has a legal duty, or is bound by scheme license holder requirements, NFRC CPS will share information with national and local Government departments and scheme license holders.
We shall not transfer your data to organisations located in countries outside of the United Kingdom.
How long will we keep your data?
Your data will be retained only for as long as is necessary for us to effectively monitor the performance of the certified installed works or product during its life cycle. This means that your data will be retained until the expected life of the installation work/products; or as long as is necessary to defend against legal claims; whichever period is the longest.
What are your rights to the data?
Right of Subject Access
You can request details of all data we hold about you by submitting a subject access request to the Data Protection Officer, at the address provided above.
We aim to comply with such a request from you within one month of the request being made. Where we cannot provide you with this information within one month; we shall inform you of this and provide the reasons why this cannot be achieved; at which point, we shall have a total of 3 months to comply with this request.
In the normal course of business, we shall not charge a fee for a subject access request. However, in the event that you make a subject access request that is of a manifestly unfounded, repetitive or excessive nature, we reserve the right to charge a fee of £10 per request.
Right of Rectification
In the event that your data is incorrect; you have the right to have this rectified by us. In the event that any of your data is incorrect, please contact the Data Controller at the address provided above. The only instance of a charge being applied for data to be rectified is when incorrect contact and/or property location details are provided or after 28 days from completion of a notification.
Right of Objection
You have the right to object to our processing of your data. Please note, that where we require to continue to process your data for reasons such as the defence of certification claims, we shall not be required to cease processing your data. In the event that you wish to object to us processing your data, please contact the Data Protection Officer at the address provided above.
Right of Erasure
You have the right to request that we delete your data provided that; we no longer require your data; or there is no legitimate legal basis for us to process your data; or we have unlawfully processed your data; or the data must be erased in order to comply with the law.
If you have grounds to request that we delete your data, and you wish to do so, please contact the Data Protection Officer at the address provided above. We shall not charge a fee for your data to be deleted from our databases.
Right to lodge a complaint
If you have any complaints about how we process your data; please contact the Data Controller, at the address provided above.
In the event that we are unable to resolve your complaint, you have the right to make a complaint to the Information Commissioner’s Office if you believe that your information has been mishandled by us. The Information Commissioner’s Office can be contacted as follows:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113