Privacy Notice

1. Scope

1.1. This Privacy Notice informs users about the nature, extent and purpose of the collection and use of personal data by Colt International Limited ("Colt", "we", "us" or the "Company"). It explains how we collect, use, share, retain and protect personal data and describes the rights available to individuals under applicable UK data protection law.

1.2. For the processing described in this Notice, the relevant Colt entity will act as the controller of your personal data. Where another Kingspan group company determines its own purposes and means of processing, that company may act as a separate controller. If you are unsure which entity is responsible for your personal data, contact the Data Protection Officer using the details in section 26.

2. Handling of personal data

2.1. Personal data is information relating to an identified or identifiable living individual. This can include a person’s name, email address, telephone number, business contact details, online identifiers and information about their interactions with us.

2.2. We process personal data lawfully, fairly and transparently and only where we have an appropriate lawful basis. Depending on the activity, this may be consent, performance of a contract or steps requested before entering a contract, compliance with a legal obligation, legitimate interests, or another lawful basis available under UK data protection law.

2.3. Colt shares employee-related personal data with relevant Kingspan group functions for authorised HR, payroll, workforce planning, salary and headcount reporting, financial reporting and corporate administration. Colt also shares financial and strategic business information, which is personal data only where it relates to identifiable individuals. Colt does not routinely share customer or supplier personal details with Kingspan for group business reporting. However, authorised Kingspan central IT personnel can access Colt systems on which employee, customer and supplier personal data is stored, where necessary for IT administration, security, maintenance, troubleshooting or support. Such access is subject to appropriate authorisation, access controls and confidentiality and security requirements. See section 23.

3. Compliance with Our Privacy Notice

3.1. We use personal data only in accordance with this Privacy Notice, applicable data protection law and our internal data protection policies and procedures.

4. We Never Sell Personal Information

4.1. We do not sell personal data to third parties. We may use personal data to fulfil a contract, respond to enquiries, administer our relationship with you, comply with legal obligations, improve our products and services, and provide relevant information about our products and services where permitted by law.

5. What information do we collect?

5.1. This Privacy Notice tells you what to expect when Colt collects or otherwise obtains personal data.

5.2. It applies to information we collect about:

• visitors to our websites;
• people who complete a contact form;
• people who use our web services, for example people who subscribe to our newsletter or blog or request a publication;
• people who contact us by telephone, email, SMS, letter, social media or another messaging service;
• people who request information with a view to entering into a transaction with us;
• customers and other people involved in transactions with us;
• suppliers, subcontractors and their representatives;
• people who make enquiries, complaints or exercise data protection rights; and
• other business contacts whose personal data we receive lawfully from third parties or publicly available sources.

5.3. Depending on your relationship with us, we may collect identification and contact details, company and job information, correspondence and enquiry details, transaction and account information, marketing preferences, website and device information, IP addresses, cookie identifiers and other information you choose to provide.

5.4. Where we obtain personal data from a source other than you, the source may include your employer or organisation, a customer or supplier, a referral, a publicly available source, or another third party permitted to provide it. Employee-related information may also be received from relevant Kingspan group functions for authorised HR, payroll and corporate administration purposes. Where Article 14 UKGDPR applies, we will provide the required privacy information unless an exemption applies.

6. Purposes and lawful bases for processing

6.1. The table below summarises the principal purposes for which we process personal data and the lawful bases we may rely on. The precise basis depends on the circumstances and relationship concerned.

6.2. Where we rely on legitimate interests, those interests may include operating and improving our business, managing customer and supplier relationships, responding to enquiries, maintaining network and information security, preventing fraud, conducting proportionate business-to-business marketing and sharing information within the Kingspan group for internal administrative purposes. We consider whether the processing is necessary and balance these interests against the rights and interests of the individuals concerned.

7. How we may contact you

7.1. We may contact you where:

• it is necessary to comply with a legal or regulatory obligation;
• it is necessary to perform a contract with you or take steps at your request before entering a contract;
• you have contacted us and a response or follow-up is reasonably expected;
• you have requested information, signed up for a product, newsletter, white paper or webinar, or expressed an interest in a product, property or development;
• we provide information about a project, product or service, or similar products or services, where permitted by law;
• we conduct proportionate business-to-business marketing based on our legitimate interests and applicable electronic marketing rules; or
• you have consented to marketing or another communication where consent is required.

7.2. You can opt out of marketing at any time by using an unsubscribe facility in the communication or by contacting us. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8. The Colt Life Assurance & Retirement Scheme (CLARS)

8.1. Colt will retain securely all applicable records relating to the scheme and data relating to former members of CLARS in accordance with applicable legal, regulatory and retention requirements.

8.2. The Company maintains appropriate technical and organisational measures designed to protect the confidentiality, integrity and availability of this data.

9. Visitors to our websites

9.1. Colt may collect personal information such as name, email address and company information, together with online and device information such as IP address, browser type, pages visited, referral information, search activity and interactions with the website.

9.2. You may visit parts of our website without directly identifying yourself. Where you choose to download material, submit an enquiry, or subscribe to content, we may ask you to provide relevant contact details.

9.3. When subscribing to our blog or newsletters, we may ask for your first name, last name, email address and company name, together with your communication preferences.

9.4. We may use analytics services, including Google Analytics where configured, to understand website usage. Non-essential analytics technologies will be used only where permitted by applicable cookie and electronic communications rules. Further information is provided through our cookie controls or cookie information.

9.5. Our websites may contain links to third-party websites. We do not control those websites and this Privacy Notice does not apply to their processing. You should review the privacy information provided by the relevant third party.

10. Use of cookies

10.1. Our websites use cookies and similar technologies. Some are necessary for the website to function; others may support preferences, analytics or other optional functionality.

10.2. Where consent is required for non-essential cookies or similar technologies, we will request it before those technologies are used. You can manage your choices through the cookie controls made available on the website and may withdraw consent at any time.

10.3. Browser settings can also be used to control or delete cookies, although disabling necessary cookies may affect website functionality. Cookie-specific information, including purposes and durations, should be read together with the cookie information presented on the relevant website.

11. Search engine

11.1. Where our website search functionality is provided by a third party, search queries and related technical information may be processed to deliver and improve search functionality. We will configure the service and any associated tracking in accordance with applicable privacy and cookie requirements.

12. Security and performance

12.1. The Company may use third-party services to help maintain the security, availability and performance of Colt International and subsidiary websites. These services may process technical information such as visitor IP addresses. We require service providers handling personal data on our behalf to provide appropriate security and data protection protections.

13. HubSpot

13.1. We use third-party services including HubSpot in connection with website, blog and microsite functionality. Depending on the service used, these providers may process contact details, form submissions and website activity on our behalf. Where required, optional tracking is subject to the applicable cookie consent controls. Further information about a provider’s own processing is available in its privacy information.

14. People who contact us via social media

14.1. We directly manage our social media interactions. Your use of social media platforms is also governed by the privacy and other policies of the relevant provider, for example LinkedIn, Facebook or X.

14.2. If you send us a private or direct message via social media, we will use the information to respond to your communication and will retain it only for as long as necessary in accordance with our retention requirements. It may be shared internally where necessary to handle your enquiry or complaint.

15. People who email us

15.1. We use security services, including IronPort (AntiSpam/Antivirus SMTP Gateway), to protect email traffic. Where supported by the sending and receiving systems, Transport Layer Security (TLS) may be used in transit. Email should not be assumed to provide end-to-end encryption.

15.2. Emails and attachments may be monitored or scanned for security threats, viruses or malicious software. Please ensure that information you send to us is lawful and appropriate.

16. Our suppliers and subcontractors

16.1. Information supplied for consideration and maintenance of our approved supplier list is retained on systems with access restricted to authorised personnel. Information is disclosed on a need-to-know basis and handled in accordance with applicable data protection law. Supplier records may be retained for six years where required for contractual, tax, accounting, legal or business record purposes. Records may then be archived or securely deleted in accordance with our retention policy.

16.2. If you wish to exercise a data protection right in relation to supplier information, contact dpo@uk.coltgroup.com. Some information may need to be retained despite a deletion request where there is a legal obligation or other lawful reason to retain it.

17. CCTV and vehicle dashcams

17.1. Colt operates CCTV in the yard at the factory and in reception at the Petersfield office. Dashcams are also fitted to Colt engineer vans. These systems may capture images of employees, contractors, visitors, customers, members of the public and other road users, together with vehicle and incident context.

17.2. The purposes of this recording are to help protect people and property, support site and vehicle security, promote safety, and investigate accidents, incidents, complaints, suspected misconduct or unlawful activity where necessary and proportionate. Footage will not be used for unrelated purposes without an appropriate lawful basis and further transparency information where required.

17.3. The principal lawful basis is Colt’s legitimate interests under Article 6(1)(f) UK GDPR in maintaining security, protecting people and assets, and investigating incidents. Where a specific legal obligation requires processing, Article 6(1)(c) may apply. Colt assesses necessity, proportionality and the impact on individuals through relevant legitimate interests assessments and, where required, a data protection impact assessment.

17.4. Access to recordings is restricted to authorised personnel with a genuine business need. Footage may be shared where necessary and lawful with insurers, legal advisers, relevant customers or site operators, law enforcement, regulators or other parties involved in investigating an incident. Access and disclosures are subject to appropriate safeguards.

17.5. Recordings are retained in accordance with Colt’s documented CCTV and dashcam retention arrangements and are deleted or overwritten when no longer needed, unless preserved for a specific incident, claim, investigation or legal obligation. The applicable routine retention periods should be confirmed in the CCTV/dashcam retention schedule and communicated through relevant signage or supplementary notices.

17.6. Appropriate signs and notices are provided where CCTV is in operation, and relevant drivers and staff are informed about vehicle dashcams. Individuals may contact the Data Protection Officer using the details in section 27 to exercise their data protection rights, subject to applicable exemptions and the rights of others.

18. People who make a complaint to us

18.1. When we receive a complaint, we create a record containing the information needed to investigate and respond. This normally includes the identity and contact details of the complainant and may include information about other individuals involved.

18.2. We use complaint information to investigate and resolve the complaint, monitor service levels and, where appropriate, compile anonymised or aggregated statistics.

18.3. We may need to disclose relevant information to the person or organisation the complaint concerns where this is necessary to investigate or resolve the matter. We will consider requests for confidentiality but may not always be able to investigate a complaint anonymously.

18.4. Personal information in complaint files is normally retained for two years from closure, unless a longer period is required for legal, regulatory or claims purposes. Access is restricted on a need-to know basis.

19. Complaints or queries

19.1. We aim to meet high standards when collecting and using personal data. If you believe our use of personal data is unfair, misleading, inaccurate or otherwise inappropriate, please contact us so that we can investigate your concern.

19.2. If you ask us to stop direct marketing, we will stop using your personal data for direct marketing. We may retain limited suppression information where necessary to ensure that your preference is respected.

19.3. Complaints or queries can be sent to the Data Protection Officer at dpo@uk.coltgroup.com or to the postal address in section 26.

19.4. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Information about raising a concern is available at ico.org.uk.

20. Security of your Personal Information

20.1. We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected having regard to the nature of the information, the processing and the risks involved, and may include access controls, system security, secure configurations, monitoring and staff procedures.

21. Retention of Personal Information

21.1. We retain personal data only for as long as necessary for the purposes for which it was collected and to meet applicable legal, regulatory, tax, accounting, contractual, dispute-resolution and enforcement requirements. Where a specific period is not stated in this Notice, retention is determined by reference to the nature of the information, the purpose of processing, legal requirements and the potential need to establish, exercise or defend legal claims.

21.2. At the end of the applicable retention period, personal data is securely deleted, anonymised or archived where continued retention is required by law or justified by another lawful basis.

22. Your Data Protection Rights

22.1. Depending on the circumstances and the lawful basis for processing, you may have the right to:

• request access to your personal data and information about how it is used;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• receive certain personal data in a portable format and transmit it to another controller where the right to data portability applies;
• object to processing based on legitimate interests in certain circumstances;
• object at any time to the use of your personal data for direct marketing; and
• withdraw consent at any time where processing is based on consent.

22.2. These rights are not absolute and may be subject to exemptions or conditions under applicable law. To exercise a right, contact the Data Protection Officer using the details in section 26. We may need to verify your identity before responding.

22.3. You will not normally be required to pay a fee to exercise your rights. We will respond within the timeframe required by applicable data protection law and will explain if an extension or exemption applies.

23. Kingspan group sharing and international transfers

23.1. Colt shares employee-related personal data with relevant Kingspan group companies or central functions for authorised HR and payroll administration, salary and headcount reporting, workforce planning and related financial and corporate reporting. Financial and strategic business information may also be shared; data protection law applies to it where identifiable individuals are involved. Colt does not routinely share customer or supplier personal details with Kingspan for group reporting or commercial purposes. Nevertheless, Kingspan central IT personnel have the technical ability to access Colt systems containing employee, customer and supplier personal data. Any actual access must be limited to authorised IT administration, maintenance, security monitoring, troubleshooting and support, and protected by proportionate access restrictions, confidentiality obligations and technical and organisational security measures. Technical access must not be treated as permission to use the data for unrelated purposes.

23.2. Access to Colt systems by Kingspan central IT may constitute processing of personal data even where records are not copied or routinely shared for reporting. Access from outside the UK may also amount to an international transfer, depending on the circumstances. Colt assesses the locations of authorised users, the roles of the relevant Colt and Kingspan entities, and whether UK GDPR restricted-transfer requirements apply. Where required, Colt will ensure an applicable UK adequacy regulation or valid transfer mechanism is in place, together with appropriate safeguards and any required transfer risk assessment. Access within the UK does not, by itself, constitute an international transfer. Individuals may contact the Data Protection Officer at dpo@uk.coltgroup.com for further information about relevant arrangements and safeguards.

23.3. Colt operates within Kingspan Group information technology and information security governance arrangements where applicable to Colt systems. The Kingspan IT Manual sets out group requirements concerning authorised access, information security, monitoring, vulnerability management, cloud services and the handling of personal information. These documented requirements support the technical and organisational measures used to protect personal data; they do not, by themselves, establish a legal basis for an international transfer. Colt will assess the safeguards and transfer arrangements relevant to the particular processing activity.

24. Automated decision-making and profiling

24.1. Colt does not currently use the personal data covered by this Notice to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals. If this changes, we will provide the information required by applicable data protection law, including meaningful information about the logic involved and the significance and envisaged consequences of the processing.

24.2. We may use limited information about interactions with our communications or website to understand interests and improve the relevance of our services and communications. Where this involves cookies or similar technologies requiring consent, those technologies will be controlled through the applicable consent mechanism.

25. Compelled Disclosure

25.1. We may use or disclose personal data where required or permitted by law, including where necessary to comply with a legal obligation, court order or lawful process; protect rights, property or safety; prevent or investigate fraud or security incidents; or establish, exercise or defend legal claims. Any disclosure will be limited to what is necessary and lawful in the circumstances.

26. Changes to this privacy notice

26.1. This Privacy Notice will be reviewed by the Senior Management Team on a regular basis, at least annually, and may be amended from time to time. We will update the version and date when material changes are made and, where appropriate, take reasonable steps to bring significant changes to the attention of affected individuals.

27. How to contact us

27.1. If you want to request information about this Privacy Notice, exercise a data protection right or raise a concern, you can email or write to:

Data Protection Officer
Colt International Limited
Colt House
Ridgeway Office Park
Bedford Road
Petersfield
GU32 3QF
dpo@uk.coltgroup.com

28. Author

This document was prepared by: Jamie Bennett, Quality & Compliance Manager

29. Approval

This document was approved by: Matt Hicks, UK Managing Director

30. Related Documents

Q-UK-PO01 – Data Protection

Q-UK-PO06 - Colt CCTV & Dashcam Policy (In draft)

Q-UK-FM78 - CCTV/Dashcam Legitimate Interests Assessments (LIA) (In draft)

Q-UK-FM79 - CCTV/Dashcam Data Protection Impact Assessment (DPIA) (In draft)

31. Document Control