Privacy & GDPR.
Privacy Policy
Active Security Solutions North Yorkshire Ltd
Policy reference P35 | Last updated 29 October 2026 | Next review October 2027
This policy explains how we collect, use, share and protect personal information when you visit our website, contact us, use our services, supply services to us, apply for work or undergo security screening. It also explains your choices, your data protection rights and how to contact us.
1 Who we are and how to contact us
Active Security Solutions North Yorkshire Ltd is the controller of personal information where we decide why and how it is used. We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection and privacy legislation, as amended.
Address: 12 Falsgrave Road, Scarborough, North Yorkshire, YO12 5AT
Data protection contact: info@active-security.org.uk
ICO registration number: ZA449282
Website: https://www.activesecurityltd.co.uk
Please mark privacy enquiries for the attention of our Data Protection Contact. You may use these details to ask questions, exercise your rights or raise a complaint. You do not have to use a particular form or subject line.
Where we handle information solely on a client’s instructions, the client may be the controller and we may act as its processor. The client’s privacy notice and relevant site or event notices explain that processing. We will help direct requests to the responsible organisation where appropriate.
2 The personal information we collect
The information we collect depends on our relationship with you and what is necessary for the relevant purpose. It may include:
• Identity and contact details, such as your name, date of birth, address, address history, telephone number and email address.
• Business and service information, including your employer, job title, enquiries, quotations, contracts, invoices, payment details, correspondence and complaints.
• Recruitment and screening information, including applications, employment and education history, explanations of gaps, references, qualifications, identity documents, right-to-work evidence, SIA licence details, screening outcomes and relevant credit or public record information.
• Workforce information, including contracts, payroll and bank details, tax and pension information, training, attendance, shifts, and relevant employment records. Where used for booking on and off, this may include location information recorded at those times.
• Service delivery records, such as access records, incident reports, witness statements and relevant images or recordings where we are responsible for collecting them. Separate notices may apply to CCTV or other monitoring at particular sites.
• Website and communication information, such as IP address, browser and device details, pages visited, cookie preferences and marketing preferences.
Where necessary and lawful, we may handle health or disability information, for example for reasonable adjustments, workplace safety or an incident. We may also handle relevant criminal offence information for lawful screening or incident management. These types of information receive additional protection as explained in section 4.
3 Where personal information comes from
We obtain personal information directly from you through forms, applications, correspondence, telephone conversations, meetings and our services. We may also obtain it from:
• Employers, former employers, clients, recruitment agencies, labour providers, referees, training providers and professional bodies where relevant to an application, assignment or business relationship.
• Publicly available sources, including business websites, relevant professional networking pages, Companies House, public registers and the SIA licence register. Public availability does not remove our duty to use information fairly and only where necessary.
• Creditsafe and its data partner TransUnion for relevant consumer credit, identity and security screening checks, and other authorised providers supporting recruitment, screening or compliance.
• Clients, venue operators, witnesses, emergency services and other relevant organisations in connection with delivering services, managing incidents or handling claims.
• Our website and systems when you interact with them, including through cookies and similar technologies where permitted.
Where information comes from another source, we will provide the applicable privacy information within the timescale required by law, unless a lawful exception applies.
4 Why we use information and our lawful bases
We identify a lawful basis for each use of personal information. Where we rely on legitimate interests, we consider whether the use is necessary and balance our interests, or those of another organisation, against your rights and reasonable expectations.
Enquiries and business relationships
We use contact and business information to answer enquiries, prepare quotations, manage contracts and accounts, provide services and handle complaints. Our basis is taking steps at your request before a contract or performing a contract with you. Where you act for a company or another organisation, our basis is usually our legitimate interests in communicating with its representatives and managing the relationship. Legal obligations may apply to accounting, tax and regulatory records.
Recruitment and security screening
We use application, reference and screening information to assess suitability, verify identity and experience, prevent fraud and meet relevant security and client requirements. We rely on steps before entering a contract with you and our legitimate interests in recruiting suitable people and protecting clients, colleagues and the public. We rely on legal obligations for checks required by law, such as right-to-work checks. BS7858 and client screening requirements are not, by themselves, a statutory duty to process every category of information.
Workforce administration
We use workforce information to manage work, shifts, pay, training, welfare and employment matters. Our bases include performance of a contract with you, legal obligations relating to employment, tax, pensions and health and safety, and legitimate interests in administering and protecting our business. Location information used for booking on and off supports attendance verification and staff welfare.
Safety and service delivery
We use relevant operational information to provide security and stewarding services, manage access, record incidents, protect people and property, investigate concerns and handle claims. We rely on legitimate interests in providing safe and effective services, applicable legal obligations and, where necessary in an emergency, protection of someone’s vital interests.
Website operation and marketing
We use technical information to operate and secure the website, relying on our legitimate interests in maintaining a reliable service. For optional cookies, analytics and marketing, we use consent where required and legitimate interests only where legally appropriate. Sections 12 and 13 explain your choices.
Health and criminal offence information
In addition to an ordinary lawful basis, we need an applicable legal condition to use special category information, such as health data. Depending on the purpose, this may include meeting employment and social protection obligations under Article 9(2)(b), or establishing, exercising or defending legal claims under Article 9(2)(f). Criminal offence information is processed only where authorised by law and a relevant condition under the Data Protection Act 2018 applies. We limit checks to those appropriate for the role and maintain an appropriate policy document where required. We can explain the specific basis and condition applicable to a particular use on request.
5 Credit reference and affordability checks
To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.
• Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority. FCA Firm Reference Number: 742313.
• TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority. FCA Firm Reference Number: 737740.
The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.
Our current purpose for consumer searches is security screening in connection with BS7858, including verifying identity and assessing relevant financial probity indicators for appropriate roles. We request and use only the information relevant to that screening purpose. Any affordability assessment or other use outside security screening would need an applicable purpose, lawful basis and clear information to you before the check.
We provide identifying information, such as your name, date of birth and address history, to match you to the correct records. We explain relevant checks during recruitment and obtain any permission required by law or the provider’s terms.
Credit reference agencies may record that a search has taken place. The type of search determines who can see it and any effect on credit decisions. We will explain the check being requested before it takes place.
Creditsafe and TransUnion are responsible for their own processing as described in their notices. These explain data sources, uses, sharing, retention, international transfers and individual rights. Further information is available here:
Creditsafe Privacy and Transparency Notice for Customers and Suppliers
TransUnion Bureau Privacy Notice
TransUnion Credit Reference Agency Information Notice
If screening information appears incorrect, contact us promptly. You can also raise a dispute with the relevant provider. We will consider corrections and relevant explanations before making a decision.
6 Automated processing and human review
We may use automated tools to support identity verification, screening, risk assessment, fraud prevention and record management. These tools can compare identifying details with reference data and apply predefined rules to produce matches, alerts, scores or recommendations. This may involve profiling, meaning automated evaluation of relevant aspects of reliability or financial circumstances. An address mismatch or relevant adverse public record may trigger further checks or a request for supporting information.
We do not make decisions with legal or similarly significant effects on individuals based solely on automated processing. A person with authority to change the outcome carries out meaningful review of relevant results, supporting evidence and any explanation you provide. We do not automatically reject an application solely because a system generates an alert or score.
The outcome of screening may affect whether we offer work, allocate a particular role or need further evidence. You may ask us to explain a decision, correct inaccurate information, consider your views or review the outcome using the contact details in section 1. Providers’ own use of automated processing is explained in their privacy notices.
7 Whether you have to provide information
Some information is necessary to enter into or perform a contract, and some is required by law. For example, identity and right-to-work evidence may be needed for employment checks, payroll information for payment and tax duties, and contact or payment information for service contracts. Relevant screening information may be a condition of appointment or deployment under our security standards or client requirements, even where the particular check is not itself required by statute.
If you do not provide necessary information, we may be unable to progress an application, complete screening, offer or continue an assignment, enter a contract, process an order or provide a service. There may also be delays or restrictions while we seek evidence. We will explain the relevant requirement and consequence when requesting the information.
Optional information, such as consent to receive marketing, is not a condition of receiving our core services or applying for work. You can refuse or withdraw optional consent without affecting the lawfulness of earlier processing.
8 Who we share information with
We share information only where necessary for an identified purpose and with an appropriate lawful basis. Recipients may include:
• Authorised staff who need access for their role, including recruitment, vetting, operations, payroll and management.
• Creditsafe, TransUnion and other relevant screening, identity verification, reference or training providers.
• Clients and venue or event operators where necessary to manage deployments, confirm qualifications or screening status, provide services or investigate incidents. We limit disclosure to what is necessary; a need to confirm screening does not automatically justify sharing a full credit report.
• Providers of IT, hosting, communications, workforce management, payroll, pension, payment and professional support services.
• Insurers, legal and financial advisers, auditors and organisations involved in a proposed business transfer, subject to appropriate confidentiality and safeguards.
• HMRC, the SIA, police, emergency services, courts and other regulators or public authorities where required or otherwise lawfully justified.
Where a supplier processes information on our behalf, we require appropriate contractual safeguards. Some recipients act as independent controllers and are responsible for their own compliance. We do not sell personal information for third-party marketing.
9 International transfers
Information may be processed outside the UK where a service provider, its support team or an independent data provider operates internationally. We assess any restricted transfer for which we are responsible and use an appropriate legal mechanism before it takes place, such as UK adequacy regulations or approved contractual safeguards, with any further assessment or protections required by law.
You may contact us for information about the safeguards applicable to your information and how to obtain a copy, subject to necessary redactions. Independent controllers, including credit reference agencies, describe their own international processing in their privacy notices.
10 How long we keep information
We keep personal information only for as long as needed for the purpose for which it was collected, taking account of applicable legal requirements and our retention arrangements. The period depends on the type of record, our relationship with you, relevant security standards, the need to demonstrate compliance and any complaint, investigation or legal claim.
• Enquiry and business records are retained for the period needed to respond, manage the relationship and meet relevant accounting, tax or claims requirements.
• Recruitment and screening records are retained for the period needed to complete and evidence the process, meet applicable screening requirements and resolve relevant disputes. Detailed vetting material is reviewed separately from the record of a check’s outcome and removed when no longer needed.
• Employment, payroll and training records are retained according to the applicable statutory duties, employment relationship and relevant claims periods.
• Operational records, images and incident reports are retained for the relevant service and safety purpose, with longer retention only where justified, for example by an investigation or claim. Site notices may specify a shorter routine recording period.
• Marketing details are retained while there is a lawful basis to use them. We may keep a minimal suppression record after an opt-out so that your preference continues to be respected.
We securely delete or anonymise information when it is no longer needed. You can ask us for the retention period or criteria applicable to a particular record. Providers such as credit reference agencies apply their own retention periods, described in their notices.
11 How we protect information
We use technical and organisational measures appropriate to the information and its risks. These include access restrictions, system and record protection, staff guidance, and secure disposal. Only authorised users may access consumer reports for approved purposes.
If a personal data breach occurs, we assess the risk, take appropriate action and notify the ICO and affected people where legally required. Please contact us promptly if you believe information has been lost, misused or disclosed incorrectly.
12 Cookies and website analytics
Cookies and similar technologies store or access information on your device. They may support essential functions and security, measure website use, remember preferences or enable third-party content.
Where we use Google Analytics, it processes device, usage and interaction information to measure website performance. This can be personal data. Google’s processing is explained in its privacy information.
We seek consent before using cookies or similar technologies where the law requires it. Optional analytics or marketing technologies that require consent must remain disabled until you choose to enable them. You can decline or withdraw optional consent through the website’s cookie controls. You can also manage cookies through your browser, although blocking essential cookies may affect website functions.
The website’s cookie information explains the technologies in use, their purposes, providers and durations. The Google add-on below provides an additional opt-out option.
Google Privacy Policy
Google Analytics Opt out Browser Add on
13 Marketing and communications
We use contact details to send requested information and necessary service communications. We send promotional emails or texts only where we have consent or another route permitted by the Privacy and Electronic Communications Regulations. An enquiry does not, by itself, permit unrestricted marketing. Where a lawful existing-customer exception applies, we offer an opt-out when collecting details and in each marketing message.
You can stop direct marketing at any time using the unsubscribe link or by contacting us. Where email campaigns use opening or link tracking, we provide appropriate information and obtain consent where required. Opting out of marketing does not stop essential messages about an existing contract, employment or service.
14 Your data protection rights
Depending on the circumstances and lawful basis, you may have the right to:
• Be informed about how we use your personal information and request access to it.
• Ask us to correct inaccurate information or complete information that is incomplete.
• Request deletion, or restriction of use, where the applicable legal conditions are met.
• Receive certain information you provided in a portable format, where processing is automated and based on consent or a contract.
• Object to processing based on legitimate interests for reasons relating to your situation. You have an absolute right to object to the use of your information for direct marketing, including associated profiling.
• Withdraw consent at any time where we rely on it, without affecting earlier lawful processing, and exercise applicable rights relating to automated decisions.
Rights are subject to legal conditions. For example, information may need to be retained for a legal obligation or claim. We will explain any restriction or refusal.
Contact us using section 1 to make a request. We normally respond within one month, subject to any lawful extension or permitted pause, and explain any additional time needed. We may request proportionate evidence of identity. Requests are normally free; we may charge a reasonable fee or refuse only where the law permits, and will explain our reasons.
15 Complaints
If you are concerned about how we use your information, please contact our Data Protection Contact so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office (ICO), or another relevant supervisory authority where applicable. You do not have to obtain our permission to complain.
ICO complaints and contact information
ICO telephone: 0303 123 1113
ICO postal address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
16 External websites and social media
External websites and social media providers have their own privacy notices. Embedded features and sharing functions may disclose information to them. Check their notices before sharing details, and contact us directly about sensitive matters.
17 Changes to this policy
We review this policy at least annually and when our processing or legal requirements change. The date appears at the beginning. Where required, we will notify you of material changes or new uses before they take effect.
