Privacy Notice

Who we are

Q-Mass Ltd is a precision engineering company registered in Scotland, with its registered office at 1A Langlands Drive, Kelvin South Business Park, East Kilbride, G75 0YH.

For the purposes of the UK GDPR and the Data Protection Act 2018, Q-Mass Ltd is the data controller for the personal data described in this notice.

If you have any questions about this notice, or about how we handle your personal data, contact us at mail@q-mass.co.uk or on +44 (0) 1355 247 780. [TO CONFIRM: ICO registration number]

The personal data we collect

Website enquiries. When you submit the contact form on this website we collect your name, email address and the content of your message. We use this only to respond to your enquiry.

Commercial contacts. When you do business with us as a customer or supplier, we process the business contact details of your representatives: name, job title, employer, business email address and business telephone number. We use this to issue quotations, process orders, arrange delivery, raise invoices, manage payment and handle quality matters.

Job applicants. When you apply for a role with us, whether by email to jobs@q-mass.co.uk or through the application form on this website, we process the information contained in your CV and application, including your contact details, employment history, qualifications and any other information you choose to give us.

Where we get your data from

Most of the personal data we hold is given to us directly by you. Where you are a representative of a customer or supplier, we may also receive your business contact details from the organisation you work for, from a colleague, or from a purchase order, quotation request or delivery document. [TO CONFIRM: whether recruitment agencies are used, in which case applicant data may also reach us from them]

Special category data

We do not seek to collect special category data, meaning information about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, or genetic and biometric data. Where it becomes necessary to process such data, for example in connection with workplace health and safety or security clearance for defence work, we will identify an appropriate additional condition for processing under Article 9 of the UK GDPR before doing so. [TO CONFIRM: whether security vetting is carried out]

Why we are allowed to process it

We rely on the following lawful bases:

• Contract. Processing necessary to enter into or perform a contract with you, or with the organisation you represent.
• Legitimate interests. Processing necessary to operate our business, respond to enquiries, manage customer and supplier relationships, and maintain the quality and traceability records our sector requires. We have considered your rights and consider this processing proportionate.
• Legal obligation. Processing necessary to meet obligations under tax, export control, health and safety and other applicable law.
• Consent. Where we ask for it explicitly, for example to keep your CV on file after a recruitment process has closed. You can withdraw consent at any time.

If you do not provide your personal data

Providing your business contact details is not a statutory requirement, but we need them in order to enter into and perform a contract. If they are not provided we may be unable to process an order, arrange delivery or invoice for work carried out. Providing information in a job application is voluntary, but without it we cannot consider your application.

Who we share it with

We do not sell, rent or trade your personal data. We share it only where necessary, with:

• our sub-contractors and suppliers, where needed to fulfil an order;
• couriers and logistics providers, to arrange delivery;
• our professional advisers, including accountants, auditors and legal advisers;
• certification and regulatory bodies, where they exercise a right of audit or inspection;
• our IT and software providers, who process data on our behalf under contract;
• government or regulatory authorities, where we are required by law to do so.
• Webflow, Inc., which hosts this website and stores contact form submissions on our behalf as our data processor.
• our email provider, which processes and stores the notification emails generated by the contact form. [TO CONFIRM: provider name]

Transferring data outside the UK

This website is built and hosted on Webflow, and contact form submissions are stored by Webflow on our behalf. Webflow, Inc. is based in San Francisco, United States, and stores customer and end user data on servers in the United States. This means that if you submit the contact form, your name, email address and message are transferred to and stored in the United States.

Webflow is certified under the UK Extension to the EU-U.S. Data Privacy Framework. Its Data Processing Addendum also incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Agreement. We rely on these as the safeguard for this transfer. Webflow publishes a list of its own sub-processors, which include Amazon Web Services and Cloudflare, at webflow.com/legal/subprocessors.

When the contact form is submitted, a notification email containing your enquiry is also sent to a Q-Mass mailbox. A copy of your enquiry is therefore held in our email system as well as in Webflow. [TO CONFIRM: which email provider Q-Mass uses, and whether that provider stores data outside the UK. If it does, it must be named here with its own safeguard]

[TO CONFIRM: whether any other supplier, sub-contractor or IT provider is located outside the UK, for example an email provider, CRM or accounting system. Each needs to be identified here with its own safeguard]

How long we keep it

We keep personal data only for as long as we need it:

• Website enquiries: submissions remain stored in Webflow until we delete them, and a copy is held in the mailbox that receives the notification email. [TO CONFIRM: how long after an enquiry is closed submissions and notification emails will be deleted]
• Customer and supplier records: 6 years after the end of the relationship, to meet statutory limitation and tax requirements.
• Unsuccessful job applications: [TO CONFIRM].
• Quality records: retained in accordance with our quality management system, which for aerospace, defence and nuclear work is a minimum of 15 years. These records may incidentally contain the names of personnel who carried out or approved work.

Automated decision-making

We do not make decisions about you based solely on automated processing, and we do not carry out profiling that produces legal effects concerning you or similarly significantly affects you.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete data where there is no good reason for us to keep it;
• object to processing based on our legitimate interests;
• ask us to restrict processing in certain circumstances;
• ask us to transfer your data to another organisation in a structured, commonly used format;
• withdraw consent, where our processing is based on consent.

To exercise any of these rights, contact us using the details above. We will respond within one month.

You will not have to pay a fee to exercise these rights. We may need to ask you for information to confirm your identity before we act on a request, which helps ensure personal data is not disclosed to anyone who has no right to receive it.

If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would ask that you raise the matter with us first, so we have the opportunity to put it right.

Marketing

[TO CONFIRM: whether Q-Mass sends marketing emails, newsletters or campaign communications. If so, this section must explain the lawful basis relied on, how the soft opt-in under the Privacy and Electronic Communications Regulations is applied, and how to opt out]

Cookies

This website does not use cookies for analytics, advertising or tracking. We do not use Google Analytics or any similar service, and Webflow does not add cookies to the websites it hosts.

If we add analytics, embedded video, maps or any other third party service to this website in future, we will introduce a cookie banner and update this notice before doing so.

A small number of strictly necessary cookies may be set in connection with the contact form, to protect against cross-site request forgery when a form is submitted. Cookies of this kind are exempt from the consent requirements of the Privacy and Electronic Communications Regulations, which is why this website does not display a cookie banner.

Links to other websites

This website may contain links to third party websites, including social media platforms. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy notices before providing them with any personal data.

Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss or misuse. These include restricting access to personal data to those who need it in order to do their job, and requiring our IT and software providers to maintain appropriate security measures under contract. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and will notify you directly where the breach is likely to result in a high risk to you. [TO CONFIRM: Cyber Essentials certification status and level]

Changes to this notice

We may update this notice from time to time. The version number and effective date at the top of this page indicate when it was last changed. Superseded versions are retained and available on request.