GDPR & Data Protection

Our commitment

CES delivers calibration, inspection and servicing for regulated, asset-heavy businesses, alongside the MyCalibrations platform, so taking data protection seriously isn't optional — it's the job. We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Calibration Engineering Services Ltd is registered in England & Wales (company number [NICK: CES company number]) and is registered with the Information Commissioner's Office, registration number [NICK: CES ICO registration number].

When we're a controller, and when we're a processor

Data protection law treats these two roles differently, and so do we.

Controller — our own data. For visitors and enquirers on this website, and for the people we deal with as a business, CES decides why and how data is used. That makes us the controller. Our Privacy Policy sets out what we collect and why.

Processor — our customers' data. Inside the MyCalibrations platform, the asset, certificate and compliance records belong to the customer organisation using them. They decide what goes in and why; they are the controller. CES processes that data on their documented instructions under a data processing agreement. We don't use customer data for our own purposes.

For the MyCalibrations platform, the customer is the controller and CES is the processor. [NICK / SOLICITOR: confirm controller/processor split for MyCalibrations data.]

Our lawful bases for processing

Where we act as a controller, we rely on:

• Legitimate interests — to respond to enquiries, run and secure the website, and manage our business relationships.
• Consent — where you've actively asked for something, such as specific information. You can withdraw consent at any time.
• Performance of a contract / steps towards one — to deal with a request that's part of entering a contract with us.
• Legal obligation — where the law requires us to keep or disclose data.

Where we act as a processor, the lawful basis sits with our client, the controller; we act on their instructions.

Your data-subject rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you;
• Rectification — have inaccurate data corrected;
• Erasure — have your data deleted, where the law allows;
• Restriction — limit how we use your data;
• Portability — receive your data in a portable format;
• Object — to processing based on legitimate interests, including direct marketing.

Where we hold your data as a controller, exercise any of these rights by emailing [NICK: CES data-protection email]. We'll respond within one month and won't charge a fee for a reasonable request.

Where your data sits inside a CES service or the MyCalibrations platform because of your relationship with one of our clients, that client is the controller — contact them first, and we'll support their response as their processor.

How we keep data secure

• UK hosting. The MyCalibrations platform runs on Microsoft Azure in the UK (UK South and UK West regions).
• Tenant isolation. Our multi-tenant architecture keeps each client's data separated from every other client's.
• Access control and encryption. We protect personal data with encryption in transit and at rest, access controls, and UK-region hosting. Access to data is restricted and authenticated. [NICK / SOLICITOR: confirm MyCalibrations hosting region, sign-in and security wording.]

We keep personal data only as long as needed for the purpose it was collected, then delete or anonymise it. As a controller, we keep website enquiry and correspondence data for up to 6 years from last contact. As a processor, we retain MyCalibrations platform data for 6 years unless a client's contract specifies a different period, in which case the contract governs.

Sub-processors and international transfers

When we use third parties to help deliver our website or the MyCalibrations platform, we put a contract in place and use only providers that meet our data-protection standards. Our sub-processors are:

• Microsoft Azure — hosting for our website and the MyCalibrations platform, in the UK (UK South and UK West regions).
• Twilio SendGrid — transactional and contact-form email delivery.

We use no other sub-processors.

Our hosting is UK-region throughout (Azure UK), so hosted personal data stays in the UK. Twilio SendGrid processes contact-form and transactional email in the United States, which involves a transfer of personal data outside the UK. That transfer is safeguarded under Twilio's Data Processing Addendum, using the UK International Data Transfer Agreement (IDTA) — and the EU Standard Contractual Clauses where applicable — with appropriate safeguards in place. Where any other transfer of personal data outside the UK takes place, we likewise rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement.

Data breaches

We have processes to detect, report and investigate personal-data breaches. Where we act as a controller and a breach is likely to risk people's rights and freedoms, we'll notify the ICO within 72 hours and affected individuals where required. Where we act as a processor, we'll notify the affected client without undue delay so they can meet their obligations as controller.

Data protection contact

We have not appointed a statutory Data Protection Officer, as we are not required to under UK GDPR. Data-protection matters are handled by Calibration Engineering Services Ltd. For any data-protection question, or to exercise your rights over data we hold as a controller, contact us at [NICK: CES data-protection email].

Complaining to the regulator

If you have a concern about how we've handled your personal data, please raise it with us first at [NICK: CES data-protection email] — we'd like the chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data-protection regulator, at ico.org.uk or by calling their helpline.