Privacy & Data Protection Policy

1. Introduction

Surgery Premises Group Ltd ("we", "our", or "us") is committed to protecting the privacy of individuals and ensuring that personal information is processed lawfully, fairly and transparently.

As a provider of healthcare premises maintenance and facilities services, we recognise the importance of safeguarding the personal information entrusted to us by our clients, suppliers, employees and website users.

This Privacy & Data Protection Policy explains how we collect, use, store and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation.

2. Our Data Protection Principles

Surgery Premises Group Ltd is committed to ensuring that all personal data is:

• Processed lawfully, fairly and transparently.
• Collected only for specified, explicit and legitimate purposes.
• Adequate, relevant and limited to what is necessary.
• Accurate and, where necessary, kept up to date.
• Retained only for as long as necessary.
• Processed securely using appropriate technical and organisational measures.
• Protected against unauthorised access, accidental loss, destruction or damage.

We review our data protection practices regularly to ensure continued compliance with legal and regulatory requirements.

3. Information We Collect

Depending on how you interact with us, we may collect:

• Name
• Job title
• Company or GP Practice name
• Business address
• Email address
• Telephone number
• Information submitted through our website contact forms
• Details relating to enquiries, quotations and services requested
• Technical information including IP address, browser type, operating system and website usage
• Cookie information where applicable

We do not intentionally collect special category personal data through our website.

4. How We Use Your Information

We use personal information to:

• Respond to enquiries.
• Provide quotations and proposals.
• Deliver our maintenance and facilities management services.
• Manage contracts and customer relationships.
• Communicate regarding projects and service delivery.
• Meet legal, contractual and regulatory obligations.
• Improve our website and customer experience.
• Protect our business against fraud and cyber threats.

5. Lawful Basis for Processing

We process personal information under one or more of the following lawful bases:

• Performance of a contract.
• Legitimate interests.
• Compliance with a legal obligation.
• Consent, where required.

6. Sharing Personal Information

We never sell personal information.

Where necessary, we may share information with carefully selected third parties including:

• IT service providers.
• Website hosting providers.
• Cloud software providers.
• Professional advisers.
• Contractors acting on our behalf.
• Regulatory bodies or law enforcement agencies where legally required.

All third parties are expected to maintain appropriate security measures and process personal information only on our instructions.

7. Information Security

We take appropriate technical and organisational measures to protect personal information, including:

• Secure IT systems.
• Password-protected devices and accounts.
• Access controls based on business need.
• Anti-virus and malware protection.
• Regular software updates.
• Secure backup procedures.
• Staff awareness of data protection responsibilities.

Access to personal information is limited to authorised personnel who require it to perform their duties.

8. Data Retention

Personal information is retained only for as long as necessary to fulfil the purpose for which it was collected, to meet contractual obligations or to comply with legal and regulatory requirements.

When information is no longer required, it is securely deleted or destroyed.

9. Cookies

Our website may use cookies to improve functionality, analyse website performance and enhance user experience.

You may manage or disable cookies through your browser settings. Where legally required, we will request your consent before placing non-essential cookies on your device.

10. Your Rights

Under UK GDPR you have the right to:

• Request access to your personal information.
• Request correction of inaccurate information.
• Request erasure of personal information where appropriate.
• Restrict processing.
• Object to processing.
• Request data portability where applicable.
• Withdraw consent where processing relies upon consent.
• Lodge a complaint with the Information Commissioner's Office (ICO).

11. Data Protection Responsibilities

Surgery Premises Group Ltd expects all employees, contractors and anyone processing personal information on our behalf to:

• Handle personal information responsibly.
• Maintain confidentiality.
• Follow company procedures for handling data.
• Report any suspected data breaches immediately.
• Complete any required data protection or information security training.

Any suspected personal data breach will be investigated promptly and managed in accordance with our internal procedures. Where required by law, the ICO and affected individuals will be notified.

12. Contact Us

If you have any questions about this Privacy & Data Protection Policy or wish to exercise your data protection rights, please contact:

If you remain dissatisfied with how we have handled your personal information, you have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.

13. Policy Review

This policy will be reviewed periodically and updated whenever necessary to reflect changes in legislation, business operations or best practice.

Version: 1.0

Approved by: Directors, Surgery Premises Group Ltd

Review Date: July 2027