GDPR Compliance

At Scope Fire Protection Ltd, we understand that protecting personal data is not just a legal obligation — it is a fundamental part of building trust with our clients, partners, and employees. We are committed to handling all personal data responsibly, transparently, and securely.

Our approach to GDPR compliance is ongoing. We regularly review our data handling practices, update our processes as legislation evolves, and train our staff to ensure personal data is always treated with the utmost care.

Scope Fire Protection Ltd acts as the data controller for personal data collected in connection with our services and website. As data controller, we determine the purposes and means of processing your personal data.

We process all personal data in accordance with the seven key principles of the UK GDPR:

We rely on the following lawful bases when processing personal data:

• Contract: Processing is necessary to perform a contract we have with you, or to take steps at your request before entering into a contract.
• Legal obligation: Processing is necessary to comply with a legal or regulatory obligation (e.g., health and safety records, accounting requirements).
• Legitimate interests: Processing is necessary for our legitimate business interests, provided your rights do not override those interests.
• Consent: Where you have given clear and freely given consent for us to process your personal data for a specific purpose (e.g., marketing communications).

We never sell personal data to third parties, and we do not use it for automated decision-making or profiling.

As a data subject, you have the following rights. You can exercise these at any time by contacting us using the details below:

We will respond to all requests within 30 days. We will never charge a fee for exercising your rights, unless requests are manifestly unfounded or excessive.

We implement appropriate technical and organisational measures to protect personal data, including:

• Secure access controls and password policies
• Encryption of data in transit and at rest where appropriate
• Regular staff training on data protection
• Documented data handling and incident response procedures
• Regular review of our security practices

In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware, as required by UK GDPR. Where the breach is likely to result in a high risk to individuals, we will also notify affected data subjects without undue delay.

We maintain an internal register of all data breaches, regardless of whether they require notification.

We may share personal data with third-party service providers (data processors) who act on our behalf, including IT service providers and sub-contractors. All data processors are subject to appropriate data processing agreements and are required to handle data securely and in compliance with UK GDPR.

We do not transfer personal data outside the United Kingdom without appropriate safeguards in place.

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Client and contract records: 7 years after contract end
• Enquiry and marketing data: 2 years from last contact
• Employee records: as required by employment law
• Health and safety records: as required by relevant legislation

This page should be read alongside our other policies:

For any queries, concerns, or requests relating to your personal data, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.