Legal
Privacy notice
Last updated
This notice explains how Albiz Security uses personal data: what we collect on this website, by phone and by email, why we use it, who handles it for us, how long we keep it, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who are we?
ALBIZ SECURITY LIMITED, known as Albiz Security, is the controller of the personal data this notice describes. That means we decide why and how it’s used.
- Registered in England and Wales, company number 02177987
- Registered office: Unit C210, 20 Bugsby’s Way, London SE7 7SJ
- ICO registration number: ZB293166
For anything about your personal data, email info@albiz.co.uk or call 020 8305 1122.
What does this notice cover?
It covers personal data about people who:
- send us an enquiry or ask us to call them back
- apply for a job with us
- call or email us
- visit this website
It doesn’t cover our staff, or the records our officers keep on client sites, such as site logs and incident reports. We leave those logs and reports on site, and store some electronically on a secure server that complies with data protection law. To ask how we use your details in those records, contact us using the details above.
What data do we collect?
When you send an enquiry
Our quote form asks for your name, email address, phone number and company, the service you need and when, the site’s postcode or area, and a message about the site. Our urgent call-back form asks for your name, phone number, the site’s postcode or area and when you need guards. You can also give your email address and tell us what you need.
Your enquiry goes to HubSpot, where we keep it with any record we already hold for you, and to our team’s mailbox, which Microsoft 365 runs. If you use the urgent call-back form, we also post your name, phone number, email address if you gave one, location and what you told us in a private channel in Microsoft Teams, which is part of Microsoft 365, so that someone can call you back quickly.
When you send a form, we also receive your IP address and the page you sent it from. The page goes to HubSpot with your details. We use a coded version of your IP address to limit how many forms one connection can send, and we use your phone number in the same coded form to avoid alerting our team twice about one urgent request.
If you’ve agreed to analytics cookies, you gave us your email address and we don’t already have it, the form also sends HubSpot your email address, your IP address and the ID in your hubspotutk cookie, so that HubSpot can link your earlier visits to your enquiry.
We check enquiries automatically for spam. If one looks like spam, it goes only to our mailbox, where one of our team can read it. If our form can’t accept an enquiry, for example because it can’t read your phone number, we ask you to try again and keep a copy in the same mailbox, in case you can’t.
When you apply for a job
Our application form asks for your name, email address and phone number, your SIA licence number if you have one, your CV, and anything else you’d like to tell us. It also records the job you’re applying for, or that you’re sending a general application.
Your application and CV go to a private area of our Microsoft 365 account, which only the people who recruit for us can open. They don’t go to HubSpot, which we use for sales. Your CV is stored under a reference, not your name. If Microsoft 365 can’t take them straight away, Microsoft Azure holds them in private storage for about 30 days at most, until we can send them on.
If there’s no vacancy that suits you, or you send a general application, we keep your details on file and may contact you when a suitable role comes up.
Please don’t put sensitive details in your CV, such as your health, religion or ethnicity. If you need adjustments for an interview, tell us, and we’ll use what you tell us only to make them.
If we offer you a job, we’ll need more information, for example to check your right to work in the UK and, for security roles, your SIA licence. We also carry out screening and vetting, and take up references.
When you call or email us
If you call or email us, we’ll have your name, your contact details and whatever you tell us. We don’t record phone calls.
When you visit this website
Microsoft Azure hosts this website. Like any web host, it receives your IP address and details of your browser and device when you load a page, so that it can send you the page and keep the site secure.
Pages with a form also load Cloudflare Turnstile, a check that tells people from bots. Cloudflare receives your IP address and technical details of your browser and connection to make the check.
If you agree to analytics cookies, HubSpot records which pages you visit and when, the links you click, how you found us (for example through a search engine or a link in an email), and your browser, device and approximate location. It also works out a coded identifier from your browser’s details, to recognise it. If you don’t agree, HubSpot doesn’t set those cookies and doesn’t link your visits to you. Our cookie policy lists each cookie and explains how to change your choice.
When someone else gives us your details
Sometimes we get your details from someone else, for example a colleague who names you as the contact for a site.
Why do we use it, and on what lawful basis?
The law lets us use personal data only when we have a lawful basis for it. This table shows what we use your data for, and the basis we rely on for each use.
| What we use it for | Our lawful basis |
|---|---|
| Replying to your enquiry, calling you back and preparing a quote | Our legitimate interests in answering enquiries and winning work. If you’re asking for yourself, for example as a sole trader, taking the steps you’ve asked for before we enter a contract with you. |
| Providing our services and running a contract | Performing our contract with you or, if the contract is with your organisation, our legitimate interests in running it. |
| Considering your job application | Taking the steps you’ve asked for before we enter an employment contract with you, and our legitimate interests in recruiting suitable people. |
| Keeping your application on file for future roles | Our legitimate interests in filling future vacancies. You can ask us to remove it at any time. |
| Answering your calls and emails | Our legitimate interests in answering your questions and keeping a record of what we’ve agreed. |
| Website analytics, and linking your visits to your enquiry | Your consent, which you give or refuse in the cookie banner. You can withdraw it at any time. |
| Checking our forms for bots and spam, and keeping the website secure | Our legitimate interests in protecting our forms, our records and our clients’ details from spam and misuse. |
| Asking clients for reviews | Our legitimate interests in hearing honest feedback about our work. We ask once a year. |
| Sending marketing emails | We don’t send marketing emails at the moment. If we start, we’ll update this notice first. |
| Keeping the records the law requires, and dealing with legal claims | Our legal obligations, for example to keep accounting records, and our legitimate interests in making or defending legal claims. |
Where we rely on our legitimate interests, you can object (see “What are your rights?”). If we send you marketing emails, you can unsubscribe at any time, using the link in each email or by telling us.
Do you have to give us your data?
No. But we need your name and contact details to reply to an enquiry, and the details on our application form, including your CV, to consider you for a job.
Who do we share it with?
Four providers run our website, forms and systems, and handle personal data for us.
| Provider | What it does for us |
|---|---|
| HubSpot | Our customer relationship management (CRM) system. It holds enquiries and contacts, and runs our email and website analytics. Our HubSpot account is in HubSpot’s EU data centre. |
| Microsoft Azure | Hosts this website and runs the functions that receive our forms. If HubSpot, our mailbox or Microsoft 365 can’t take a form straight away, Azure holds it, with any CV, in private storage for about 30 days at most, until we can send it on. It also holds possible spam that way during an attack on our forms. |
| Microsoft 365 | Runs our team’s mailbox, which receives a copy of each enquiry, and Microsoft Teams, where we post urgent call-back requests in a private channel. It also holds job applications and CVs in a private area that only the people who recruit for us can open. |
| Cloudflare | Runs Turnstile, the bot check on our forms. Cloudflare also uses some of this information to improve Turnstile, and is responsible for that use itself. |
Each one explains how it handles personal data: see HubSpot’s privacy policy, the Microsoft privacy statement and Cloudflare’s Turnstile privacy addendum.
We also use providers for email, phone and IT. We may share personal data with our professional advisers, such as accountants and lawyers, with the police, courts or regulators when the law requires it, and with a buyer if all or part of our business is ever sold.
Is your data sent outside the UK?
Some of it is. Our HubSpot account is in HubSpot’s EU data centre, our Microsoft 365 data, including job applications and CVs, is held in the EU, and forms waiting to be delivered, with any CVs, are stored in Microsoft Azure in the EU. UK law recognises countries in the European Economic Area (EEA), which includes the EU, as protecting personal data adequately. The functions that receive our forms run in Microsoft Azure’s West US 2 region, in the United States, so anything you send through a form, including a CV, passes through the US on its way to us.
HubSpot, Microsoft and Cloudflare are US companies, and Cloudflare runs Turnstile on its worldwide network, so some data may also be handled outside the UK and EEA. All three say they comply with the UK Extension to the EU-US Data Privacy Framework, also called the UK-US data bridge, which UK law recognises as protecting personal data sent to companies certified under it. Their data processing terms also use standard contractual clauses as a further safeguard.
How long do we keep it?
We keep personal data only for as long as we need it for the reasons in this notice, or for as long as the law requires.
| What | How long we keep it |
|---|---|
| Enquiries and emails that don’t lead to work | 12 months |
| Client contacts and contract records | 10 years after the work ends |
| Job applications and CVs | We review each application 12 months after it arrives, and delete it if we no longer need it |
| Forms waiting to be delivered, and held spam | About 30 days at most |
| The coded IP addresses and phone numbers | About 2 days |
| Urgent alerts in our team’s Teams channel | 12 months |
| Cookies | Our cookie policy links to HubSpot’s list, which shows how long each cookie lasts |
What are your rights?
You have these rights over your personal data:
- Access: ask for a copy of the personal data we hold about you.
- Correction (rectification): ask us to correct data that’s wrong or incomplete.
- Deletion (erasure): ask us to delete your data, for example when we no longer need it.
- Restriction: ask us to limit how we use your data, for example while we check that it’s accurate.
- Objection: object to our using your data for our legitimate interests. If you object to marketing, we’ll stop.
- Portability: ask for the data you gave us in a format a computer can read, or ask us to send it to another organisation, where we use it with your consent or under a contract with you.
- Withdrawing consent: where we rely on your consent, such as for analytics cookies, withdraw it at any time. This doesn’t affect anything we did before you withdrew it.
To use any of these rights, email info@albiz.co.uk or call 020 8305 1122. It’s usually free. We may ask you to confirm who you are. We’ll reply within one month. If your request is complex, we may need up to two more months, and we’ll tell you within the first month if so.
Some rights apply only in certain situations. If one doesn’t apply to your request, we’ll explain why.
Do we make automated decisions about you?
No. We don’t make decisions about you by automated means alone, including profiling, that have a legal or similarly significant effect on you.
Our forms do run automatic checks for bots and spam. They don’t delete an enquiry that looks like spam: it goes to our mailbox for one of our team to read. If you need a quick answer, call or email us instead.
How do you complain?
If you’re unhappy with how we’ve handled your personal data, please tell us first, by email or phone. We’ll acknowledge your complaint within 30 days and tell you what we’re doing about it.
You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. Make a complaint on the ICO’s website or call the ICO on 0303 123 1113.
Will this notice change?
We’ll update this notice when we change how we use personal data. The date at the top of this page shows when it last changed.