How CES collects, uses and protects personal data — for visitors to this website and for the people whose data lives in the MyCalibrations platform.
Effective [NICK: confirm date] · DRAFT — pending CES legal reviewCalibration Engineering Services Ltd ("CES", "we", "us") is the company behind this website and the CES platform (MyCalibrations). We are registered in England & Wales, company number [NICK: CES company number], with our registered office at The Old Stables, Calcroft Lane, Clanfield, Oxfordshire [NICK: confirm full address + postcode], United Kingdom.
We are registered with the Information Commissioner's Office (ICO), registration number [NICK: CES ICO registration number].
For any question about this policy or your personal data, contact us at [NICK: CES data-protection email].
CES handles personal data in two distinct ways, and the rules differ for each.
As a data controller. When you visit this website, fill in our contact form, or otherwise enquire about our services and the MyCalibrations platform, CES decides why and how your data is used. This policy covers that data.
As a data processor. The MyCalibrations platform is used by client organisations — calibration labs, fleet operators, quality teams — to run their own work. The records inside the platform (their customers, their engineers, their inspection data) belong to the client. They are the controller; CES processes that data on their instructions under a written contract. If your data sits inside a CES service or the MyCalibrations platform because you work for, or are a customer of, one of our clients, that organisation is your first point of contact, and their privacy notice governs it. The "Data inside the MyCalibrations platform" section below explains our role.
As a controller, we collect:
We do not knowingly collect special-category data through this website, and we ask you not to include sensitive personal information in the free-text form fields.
| What we do | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Reply to your enquiry and arrange an engineer site visit | To respond to a request you made | Legitimate interests / steps towards a contract |
| Keep a record of correspondence | To manage the relationship and our own records | Legitimate interests |
| Maintain and secure the website | To run a safe, working site | Legitimate interests |
| Send you information you've asked for | Because you asked | Consent, where consent applies |
We do not run automated marketing drip campaigns off the back of a service enquiry, and we will not sell or rent your details to anyone.
This website uses no analytics and sets no tracking or advertising cookies. Because we set no non-essential cookies, no cookie consent banner is required.
We share website personal data only with service providers who help us run the site and respond to you, and only as far as needed. Our sub-processors are:
We use no other sub-processors for website enquiry data.
We may also disclose data where the law requires it, or to protect our rights.
The MyCalibrations platform and our primary hosting are in the United Kingdom: Microsoft Azure, UK South and UK West regions. Website enquiry data is hosted in the UK.
Our email delivery sub-processor, Twilio SendGrid, processes contact-form and transactional email in the United States. This involves a transfer of personal data outside the UK. That transfer is safeguarded under Twilio's Data Processing Addendum, using the UK International Data Transfer Agreement (IDTA) — and the EU Standard Contractual Clauses where applicable — with appropriate safeguards in place. Where any other transfer of personal data outside the UK takes place, we likewise rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement.
We keep enquiry and correspondence data for up to 6 years from our last contact with you, then delete or anonymise it. We hold it for that period to deal with your enquiry, manage the relationship, and meet our own legal and accounting record-keeping needs.
Where CES acts as a processor for a client organisation, we handle their data strictly on their documented instructions, under a data processing agreement that sets out the subject matter, duration, purpose, security measures and sub-processors involved.
The MyCalibrations platform runs on Microsoft Azure in the UK (UK South and UK West regions), with per-tenant data isolation. We protect personal data with encryption in transit and at rest, access controls, and UK-region hosting. Our sub-processors for platform data are Microsoft Azure (hosting) and Twilio SendGrid (transactional email delivery). We retain platform data for 6 years unless a client's contract specifies a different period, in which case the contract governs.
If your data is in the MyCalibrations platform because of your relationship with one of our clients, please contact that organisation to exercise your rights. We will support them in responding.
Under UK data protection law you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we use it, and to data portability. Where we rely on consent, you can withdraw it at any time.
To exercise any of these rights over data we hold as a controller, email [NICK: CES data-protection email]. We'll respond within one month. (For data held inside a CES service or the MyCalibrations platform on a client's behalf, contact that client organisation first.)
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put things right first.
We may update this policy from time to time. The effective date at the top shows when it last changed.
Calibration Engineering Services Ltd