Privacy policy

01Who we are

We are Sygma (Fire, Security & Electrical) Ltd (“we”, “us”, “our” or “Sygma”), company number 04412042. Our registered office is at Unit K Blois Meadow Business Centre, Steeple Bumpstead, Suffolk, CB9 7BN.

We are the data controller for the personal data described in this policy. That means we decide how and why it is used, and we are responsible for it under UK data protection law, including the UK GDPR and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office under number ZA309041.

This policy applies to everyone whose personal data we handle, including the businesses and organisations we work for and their staff and site contacts, people who enquire with us, job applicants and visitors to our website.

02Where your details come from

Most of the personal data we hold comes from you: through our quote form, by email or phone, or while we carry out work for you.

The names and contact details of staff, site contacts and keyholders usually come from the business or organisation we work for, which gives them to us so we can carry out the work. If your employer or a customer of ours gave us your details, this policy explains how we use them, and you can contact us at any time to ask what we hold.

03What we collect

Enquiries

When you send our quote form, we collect your name, email address, phone number, company, the service you are interested in, your site address and your message. We also record the date, your IP address, your browser and the page you sent the form from, including the advert campaign if you reached us through one of our adverts. Each enquiry is stored on our website and emailed to our team. If you email or phone us, we keep the details you give us so we can deal with your enquiry.

Customers and site contacts

When we quote for or carry out work, we hold the names, phone numbers and email addresses of your contacts, your site addresses and records of the work we do, including service visits and certificates. These are kept in our email and job management systems, which are run for us by established providers under data protection terms.

Certificates

When we install a security system, our SSAIB certification requires us to issue a Certificate of Conformity. It includes the name and address of the site, and we pass it to SSAIB.

Monitored systems

If your system is monitored, the Alarm Receiving Centre (ARC) holds your site and keyholder details. If the system has a police Unique Reference Number (URN), those details are also shared with the local police force so it can respond.

Job applicants

If you apply for a job with us, we collect your CV, covering letter and any other details you send us.

Website visitors, before you choose

Until you accept cookies in our banner, and if you refuse them, Google Analytics, Google Ads, Microsoft Clarity and Mailchimp do not collect anything about you, and no statistics or marketing cookies are set. Clarity’s script loads but stays switched off. Google reCAPTCHA loads with our quote forms whatever your choice: it checks information about your browser, device and how you use the page to tell a person from a bot.

Website visitors who accept statistics cookies

Microsoft Clarity records how pages are used, such as clicks and scrolling, as session recordings and heatmaps.

Website visitors who accept marketing cookies

Google’s tag on our site serves both Google Analytics and Google Ads, so it only loads once you accept marketing cookies. Google Analytics then records how you use our website. Google Ads records whether you reached us through one of our adverts, and may add your browser to an audience so our adverts can be shown to you on other websites (remarketing). When you send our quote form, Google’s tag may also send Google a hashed (scrambled) copy of the email address and phone number you entered, so Google can match the enquiry to an advert click. Mailchimp’s script runs a Mailchimp sign-up form on our website: it keeps a count of your visits and page views in your browser so the form appears at the right time, and if you fill the form in, the details you enter go to our Mailchimp account.

Our cookie policy lists every cookie and how long it lasts.

04How we use it, and our legal basis

The law requires us to have a legal basis for each way we use personal data. Where we rely on legitimate interests, the interest is stated.

Replying to your enquiry and preparing a quote

If you enquire for yourself or as a sole trader, taking the steps you ask for before entering into a contract. If you enquire for a business, our legitimate interest in responding to business enquiries.

Carrying out, invoicing and supporting work

If you are our customer yourself, performing our contract with you. If you are a contact at a customer business, our legitimate interest in carrying out our contract with that business.

Issuing certificates and keeping service records

Our legitimate interest in meeting our certification scheme requirements and our contracts, and in showing that work was done properly.

Reissuing lost certificates and dealing with enquiries and complaints about an installation

Our legitimate interest in supporting the systems we install.

Emailing contacts at our business customers about related services

Our legitimate interest in keeping customers informed about services similar to those we provide them. You can opt out at any time.

Emailing anyone who ticked the marketing box on our form

Your consent, which you can withdraw at any time.

Assessing job applications

Taking steps at your request before a possible contract of employment, and our legitimate interest in recruiting the right people.

Website statistics, session recordings, advert measurement and remarketing

Your consent, given through our cookie banner.

Protecting our forms from spam

Our legitimate interest in keeping our website secure.

Keeping legal, accounting and tax records

To comply with our legal obligations.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

If we need to use your personal data for an unrelated purpose, we will tell you and explain the legal basis that allows us to do so.

05Marketing

We may email contacts at businesses we already work for about services similar to the ones we provide them. If you are a sole trader or in a partnership, we only send you marketing emails if you have asked for them, for example by ticking the marketing box on our quote form.

Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing info@sygma.co.uk. We never sell your personal data.

06Who we share it with

We only share your personal data:

• with service providers who run our website, email and business systems for us, who may only use it on our instructions;
• with Google, which processes Google Analytics, reCAPTCHA and enhanced conversions data on our behalf under its data processing terms, and acts as an independent controller for the rest of Google Ads;
• with Microsoft, which processes Clarity data on our behalf, and with Mailchimp, which runs our email marketing and our website sign-up form;
• with SSAIB, when we issue a Certificate of Conformity;
• with the Alarm Receiving Centre and the police, where your system is monitored and has a URN;
• where we are under a duty to disclose or share it to comply with a legal obligation, or to enforce or apply our terms;
• if our business enters a joint venture with, or is sold to or merged with, another business, in which case we may share it with our new business partners or owners.

07Where we store it

We hold personal data in the UK wherever possible. Three of our providers are in the United States: Google LLC (Google Analytics, Google Ads and reCAPTCHA), Microsoft Corporation (Clarity) and The Rocket Science Group LLC, which trades as Mailchimp and is part of Intuit. Each states that it is certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection, and each provider’s terms also include standard contractual clauses as a fallback. We check these arrangements whenever we review this policy. Our other service providers hold data under their own data protection terms.

08How long we keep it

We keep personal data only for as long as we need it:

Enquiries that do not lead to work, including website form entries

2 years from our last contact.

Customer, site contact and job records

6 years after our last work for you, to meet accounting, tax and legal requirements.

Certificates and service records

For as long as we maintain the system, then 6 years.

Keyholder details for monitored systems

For as long as the system is monitored.

Job applications that are not successful

6 months after we tell you the outcome.

Marketing contacts

Until you unsubscribe.

Cookies

As listed in our cookie policy.

09How we keep it secure

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process it on our instructions and are subject to a duty of confidentiality.

We have procedures to deal with any suspected data security breach, and we will notify you and any applicable regulator of a breach where we are legally required to do so.

10Your rights

Under certain circumstances, you have the right by law to:

• Access your personal data (a “data subject access request”), so you receive a copy of the data we hold about you and can check we are processing it lawfully.
• Have it corrected if anything we hold about you is incomplete or inaccurate.
• Have it erased where there is no good reason for us to keep processing it, or where you have objected to processing.
• Object to processing where we rely on a legitimate interest and something about your situation makes you object, and at any time to direct marketing.
• Restrict processing, for example while we check its accuracy or our reason for using it.
• Transfer it to another party.
• Withdraw your consent at any time, where we rely on consent.

To use any of these rights, email info@sygma.co.uk or write to us at Unit K Blois Meadow Business Centre, Steeple Bumpstead, Suffolk, CB9 7BN.

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee, or refuse to comply, if a request is clearly unfounded or excessive.

11Cookies

Statistics and marketing cookies are only set if you accept them in our cookie banner, and you can change your choice at any time. Every cookie we use, and how long it lasts, is listed in our cookie policy.

12Complaints

If you are unhappy with the way we handle your personal data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection: call 0303 123 1113 (Monday to Friday, 9am to 5pm) or visit ico.org.uk.

13Contact us

If you have any questions about this policy or how we handle your personal data, get in touch. We may update this policy from time to time, and the date at the top shows when it last changed.