Policies & Terms
Data Protection Policy
Last updated: January 2026
Introduction
Relay Electrical Services Ltd is committed to protecting the privacy and personal data of employees, clients, suppliers and any other individuals whose information may be processed as part of the Company's business operations. This policy explains how we collect, store, use and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Scope
This policy applies to all employees, apprentices, subcontractors, temporary staff, and any person handling personal data on our behalf. It covers all personal data held by the Company, whether stored electronically or in paper form.
Data Protection Principles
We comply with the key principles of data protection law. Personal data will be: (1) Processed lawfully, fairly and transparently; (2) Collected for specified and legitimate purposes; (3) Limited to what is necessary; (4) Accurate and kept up to date; (5) Stored only for as long as necessary; (6) Processed securely to protect against unauthorised access, loss or damage.
Lawful Basis for Processing
We process personal data for legitimate business purposes including: Employment Administration (payroll, HR records, pension administration, training records); Client and Customer Records (to provide electrical services, manage projects, issue invoices, maintain business records); and Legal Obligations (HMRC reporting, health and safety records, insurance requirements).
Data Security
We take appropriate measures to ensure personal data is stored securely. Security measures include password protected computer systems, secure company servers or cloud systems, and locked filing cabinets for paper records. Employees must not leave confidential information unattended or accessible to unauthorised persons.
Data Retention
Personal data will only be retained for as long as necessary. Typical retention periods include: Employment records – up to 6 years after employment ends; Financial records – minimum 6 years; Health and safety records – as required by legislation. Data no longer required will be securely deleted or destroyed.
Data Sharing
We only share personal data where it is necessary and lawful to do so. Personal data may be shared with payroll providers, accountants, insurance providers, government authorities where legally required, and IT service providers. We ensure that any third parties receiving personal data have appropriate safeguards in place.
Data Breaches
A data breach occurs when personal data is lost, accessed without authorisation or disclosed improperly. Examples include lost or stolen devices, emails sent to the wrong person, or unauthorised access. Any suspected data breach must be reported immediately to management. Where required, we will report data breaches to the Information Commissioner's Office (ICO).
Individual Rights
Under UK GDPR, individuals have several rights relating to their personal data. These include the right to access their personal data, request correction of inaccurate information, request deletion where appropriate, restrict how their data is used, and object to certain processing activities. Requests should be submitted to the Company in writing.
Employee Responsibilities
All employees who handle personal data must ensure they follow this policy. You must: only access personal data required for your work; not share confidential information without authorisation; ensure electronic devices are secure; protect passwords and login details; and dispose of confidential information securely. Employees must not use company data for personal purposes.
Questions?
If you have any questions about our policies or terms, please don't hesitate to get in touch.
Contact Relay