Privacy Policy

1. About this notice

This notice explains how Unitrust Protection Services (UK) Ltd ("Unitrust", "we", "us" or "our") collects and uses personal information about people who interact with us outside the employment and recruitment relationship. This includes clients and prospective clients, client contacts, suppliers and contractors, website visitors, people who make enquiries or complaints, visitors to premises and other business contacts.

Separate privacy information applies to employees/workers and job applicants. CCTV and body-worn video (BWV) processing may also be subject to specific signage, site information and documented assessments.

2. Who is responsible for your information?

Unitrust Protection Services (UK) Ltd is the controller where it determines why and how personal information is used. At some client sites, a client or another organisation may be the controller for particular systems or activities, such as client-controlled CCTV. Controller responsibilities are determined by the actual purposes and means of processing, not simply by whose staff appear in the information.

Questions about this notice or our use of personal information can be sent to the Director of People & Culture / Director of Compliance at Unitrust House, Heather Park Drive, Wembley, Middlesex HA0 1SS; info@unitrust.co.uk; 020-8903-8303.

3. Personal information we may collect

Identity and contact details, such as name, job title, organisation, business address, telephone number and email address.
Business relationship information, including enquiries, proposals, contracts, service records, meeting notes and correspondence.
Supplier and contractor information, including contact, payment, insurance, qualification, compliance and due-diligence information.
Visitor and premises information, such as visitor records, access-control information and security incident records.
Images or recordings from Unitrust-controlled CCTV or BWV where applicable and lawfully operated.
Information contained in complaints, incidents, investigations, insurance matters, claims or legal correspondence.
Website and communications information, such as information submitted through online forms and technical information collected through lawful website technologies. Further information about cookies and similar technologies is provided in our Website Cookie and Storage & Access Technologies Policy and through the website Cookie Settings facility.
Any other personal information you choose to provide to us or that we lawfully obtain in connection with our services.

4. Special category and criminal offence information

Our services can sometimes involve information that receives additional legal protection, for example health information arising from an accident or emergency, or information relating to alleged or suspected criminal activity in a security incident. We process this information only where it is necessary, proportionate and supported by an applicable UK GDPR condition and, where required, a condition or authority under the Data Protection Act 2018. Our Appropriate Policy Document sets out additional safeguards for relevant processing.

5. Why we use personal information and our lawful bases

Depending on the circumstances, we may use personal information for the following purposes and lawful bases:

To respond to enquiries, prepare proposals, enter into and administer contracts, and provide security services - performance of a contract or steps requested before a contract, and/or our legitimate interests in managing our business and services.
To manage client, supplier and contractor relationships - contract, legal obligation and/or legitimate interests in effective business administration.
To protect people, premises and property; manage security incidents; and prevent or investigate crime -legitimate interests and, where the statutory conditions are met, recognised legitimate interests. Additional conditions apply to special category or criminal offence information.
To maintain records, financial administration, taxation and regulatory compliance -legal obligation, contract and/or legitimate interests.
To establish, exercise or defend legal claims and manage complaints, insurance and disputes - legitimate interests and applicable special-category/criminal-offence conditions where relevant.
To maintain the security of our systems, information and services -legitimate interests and legal obligations where applicable.
To manage necessary business communications with clients, prospective clients, suppliers, contractors and other business contacts - contract and/or legitimate interests in administering our business relationships and responding to requests. Unitrust does not currently undertake electronic direct marketing.
To respond to requests from police, regulators, courts or other public bodies - legal obligation, legitimate interests, public-task-related disclosure provisions or recognised legitimate interests where the statutory criteria are satisfied.

Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against the rights and freedoms of the people affected. Recognised legitimate interests is a separate lawful basis introduced into the UK GDPR; we use it only where a statutory recognised condition applies and the processing is necessary. We remain responsible for transparency and all other applicable data protection requirements.

6. Where we obtain personal information

Directly from you, including through enquiries, meetings, contracts, correspondence and our website.
From your employer or organisation where you act as its contact or representative.
From clients, suppliers, contractors and professional advisers.
From security systems, incident reports and authorised personnel where relevant.
From public authorities, regulators, police or other bodies where disclosure to us is lawful.
From publicly available professional or business sources where relevant and lawful

7. Who we may share information with

Authorised Unitrust personnel who need the information for their work.
Clients and prospective clients where necessary for service delivery, assurance, incident management or contractual administration.
Suppliers and processors that provide IT, hosting, communications, professional, screening, security or administrative services to us.
Insurers, auditors, lawyers and other professional advisers.
Police, emergency services, courts, regulators and public authorities where required or permitted by law.
Other parties where necessary in connection with a legal claim, corporate transaction or protection of people, property or legal rights.

We do not share personal information merely because it is requested. We consider the controller role, lawful basis, necessity, proportionality and any applicable restrictions before disclosure.

8. CCTV and body-worn video

Where Unitrust controls CCTV or BWV, we use it only for documented and proportionate security, safety and evidential purposes. Normal retention for Unitrust-controlled CCTV and BWV is generally between 1 and 3 months depending on the system, site and purpose, unless relevant footage needs to be preserved for an incident, complaint, investigation, police matter, insurance claim, legal proceedings, rights request or other documented requirement. We do not use facial recognition or biometric identification.

Where a client owns and controls CCTV or another surveillance system and determines its purposes and means, the client may be the controller. In those circumstances, the client’s privacy information should explain its processing.

9. How long we keep information

We keep personal information only for as long as necessary for the purpose for which it was collected, including applicable contractual, regulatory, accounting, insurance and legal requirements. Retention is governed by our retention arrangements and any documented legal hold. Information that is no longer required is securely deleted or destroyed. CCTV and BWV retention is described above.

10. International transfers

Some of the service providers and technology platforms we use operate internationally or use group companies, infrastructure or sub-processors located outside the United Kingdom. This means that personal information may, in some circumstances, be transferred to or accessed from countries outside the UK.

Our service providers include cloud, communications, workforce management, accounting, business management and website service providers, including providers such as Microsoft, TEAM Software/WorkWave (Timegate), Sage, monday.com and Wix.

Where personal information is transferred outside the UK, we take appropriate steps to ensure that the transfer complies with UK data protection law. Depending on the circumstances, a restricted transfer may be covered by UK adequacy regulations; appropriate safeguards under Article 46 of the UK GDPR, such as the UK International Data Transfer Agreement (IDTA) or the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum; or, where applicable, an exception permitted by UK data protection law.

Where we rely on an Article 46 appropriate safeguard, we complete a transfer risk assessment (also referred to in UK legislation as a data protection test) and put in place any additional contractual, technical or organisational measures required to ensure that the standard of protection for personal information is not materially lower after the transfer.

We undertake appropriate due diligence on service providers that process personal information on our behalf and periodically review relevant processing locations, sub-processors and international transfer arrangements. Further information about the safeguards used for a particular international transfer can be requested from the Director of People & Culture / Director of Compliance using the contact details in this notice.

11. Security

We use appropriate organisational and technical measures designed to protect personal information against accidental or unlawful loss, alteration, unauthorised disclosure or access. Access is limited according to role and business need, and relevant suppliers are subject to contractual and security controls.

12. Your data protection rights

Depending on the circumstances, you may have rights to:

ask for access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to erase information in certain circumstances;
ask us to restrict processing in certain circumstances;
object to processing based on legitimate interests or recognised legitimate interests;
receive certain information in a portable format where the legal requirements apply; and
withdraw consent where consent is the basis for processing, without affecting earlier lawful processing.

A request does not need to quote data protection law or use a particular form. We may need information to confirm identity or clarify a request where reasonably required. For subject access requests, the law requires reasonable and proportionate searches for relevant personal information.

13. Data protection complaints

If you are concerned about how we have used your personal information, please contact the Director of People & Culture / Director of Compliance using the details in section 2. We will facilitate data protection complaints, acknowledge a complaint within 30 days, take appropriate steps to investigate it, keep you informed of progress where appropriate and provide the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Further information is available at www.ico.org.uk. We would welcome the opportunity to consider your concern directly first, but this does not affect your right to contact the ICO.

14. Cookies and website technologies

Our website uses cookies and similar storage/access technologies. Some technologies are necessary to operate or secure the website, while others may be used for purposes such as functionality and understanding how visitors use the website. Where consent is required under the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, the relevant technology will only be used after an appropriate choice has been made through our consent mechanism. Certain limited uses may be made without consent where a PECR exception applies, including qualifying statistical or appearance/functionality uses, subject to the applicable conditions and objection mechanism.

Further details about the technologies used, their purposes, providers, duration and how to manage choices are provided in our Website Cookie and Storage & Access Technologies Policy. Where consent is relied upon, choices can be changed or withdrawn using the Cookie Settings facility on our website.

15. Changes to this notice

We may update this notice where our processing, services, suppliers or the law changes. The current version should be made readily available, including on the Unitrust website where appropriate. Material changes should be communicated where required.

16. Legal framework

This notice is designed around the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, together with PECR where applicable. It should be read alongside other relevant Unitrust privacy information and data protection procedures

Privacy Policy 1. About this notice