Data Protection Policy

---

 1. Purpose

The purpose of this Data Protection Policy is to ensure that Harrison Steel Properties Ltd (“we”, “us”, “our”) complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws. We are committed to protecting the rights and freedoms of individuals whose personal data we process as part of our Non-Domestic Energy Performance Certificate (EPC) services.

2. Scope

This policy applies to:

• All employees, contractors, and representatives of Harrison Steel Properties Ltd
• All personal data processed in connection with our services
• Data stored in both electronic and paper formats

3. Data Protection Principles

We adhere to the following principles:

1. Lawfulness, fairness, and transparency – Data will be processed lawfully, fairly, and in a transparent manner.
2. Purpose limitation – Data will only be collected for specific, legitimate purposes and not processed in a manner incompatible with those purposes.
3. Data minimisation – Only data that is necessary for the purpose will be collected.
4. Accuracy – We will keep personal data accurate and up to date.
5. Storage limitation – Data will only be kept for as long as necessary for the purposes for which it was collected.
6. Integrity and confidentiality – We will ensure appropriate security of personal data to protect against unauthorised access, loss, or damage.

4. Lawful Bases for Processing

We process personal data under one or more of the following lawful bases:

• Contract – To perform our services under a contract with the client.
• Legal obligation – To comply with regulations, including EPC lodgement requirements.
• Legitimate interests – For administrative purposes and improving our services.
• Consent – For specific marketing or communication purposes.

5. Data Subject Rights

Under the UK GDPR, individuals have the right to:

• Access their personal data
• Request correction of inaccurate data
• Request deletion of their data (where legally permissible)
• Restrict or object to processing
• Request data portability in a machine-readable format

Requests should be made in writing to our Data Protection Officer.

6. Data Security Measures

We implement appropriate technical and organisational measures to safeguard personal data, including:

• Secure, password-protected systems
• Encrypted storage of sensitive information
• Controlled access to personal data on a need-to-know basis
• Secure disposal of data when no longer needed

7. Data Sharing

We may share personal data with:

• The government EPC register (as required by law)
• Our accreditation body for audit and compliance purposes
• Subcontractors or consultants under confidentiality agreements
• Regulatory or enforcement authorities when required by law

We will never sell personal data to third parties.

8. Data Retention

EPC-related personal data will be retained for 15 years in line with EPC validity requirements, unless a longer retention period is required by law.

9. Data Breaches

In the event of a data breach:

• We will take immediate steps to contain the breach.
• We will assess the risk to individuals and notify the ICO within 72 hours if required.
• We will notify affected individuals where the breach poses a high risk to their rights and freedoms.

10. Responsibilities

The Data Protection Officer (DPO) is responsible for ensuring compliance with this policy, responding to data subject requests, and liaising with the ICO.

11. Contact

Data Protection Officer
Harrison Steel Properties Ltd
Sixty Six, North Quay, Great Yarmouth, Norfolk, United Kingdom, NR30 1HE
Email: info@harrisonsteel.co.uk
ICO Registration Number: ZB640083

12. Review and Updates

This policy will be reviewed annually or sooner if there are significant changes in legislation, our operations, or data processing activities.