PRIVACY POLICY
Majestic Construction
Trading as Majestic Site Management Ltd
Effective Date: 13 August 2026 | Last Reviewed: 13 August 2026 | Next Review Date: August 2027
Version 2.2
Majestic Construction, trading as Majestic Site Management Ltd (“we”, “us”, “our” or “Majestic”), is committed to protecting the privacy and security of personal information.
This Privacy Policy explains how we collect, use, store and protect personal information when you:
We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as applicable.
This Privacy Policy also explains how we may process business contact information obtained from third-party sources, including information obtained from industry, accreditation and business databases.
We may update this Privacy Policy from time to time. The latest version will be made available on our website.
The website and services are operated by:
Majestic Construction
Trading as Majestic Site Management Ltd
Our principal place of business is:
Unit 10 Queens Square Business Park, Honley, Holmfirth, England, HD9 6QZ
Telephone: 01484 426302
For privacy and data protection enquiries, you can contact us using the details above or the contact details published on our website.
Majestic Site Management Ltd is the organisation responsible for determining how and why personal information is processed for the purposes described in this Privacy Policy.
Depending on your relationship with us, we may collect and process the following categories of personal information.
This may include:
Where you are a customer, potential customer, contractor, subcontractor, supplier or business contact, we may process information relating to:
When you use our website, we may collect technical information such as:
Some of this information may be collected through cookies or similar technologies.
Where you contact us, we may retain:
We may collect personal information:
Where we receive personal information from a source other than the individual concerned, we will take appropriate steps to ensure that the information is processed lawfully, fairly and transparently.
We may obtain business contact information from third-party sources where the information has been made available for legitimate business purposes or where we have another lawful basis for obtaining and using it.
Third-party sources may include:
The information obtained may include:
We will not assume that information being publicly available or held by a third party automatically means that it can be used for any purpose.
Before using third-party business contact information, we will consider the circumstances in which the information was obtained, the purpose for which it was made available, the nature of the information, the reasonable expectations of the individual and the applicable data protection and electronic marketing requirements.
Where required by applicable data protection legislation, we will provide appropriate privacy information to individuals whose personal information we have obtained from a third party.
We may use personal information for the following purposes:
We will only process personal information where we have a lawful basis for doing so.
Depending on the circumstances, the lawful basis may include the following.
We may process personal information where this is necessary to enter into or perform a contract with you or your organisation.
For example, we may need your contact details to provide a quotation, arrange services, manage a project or administer payments.
We may process personal information where this is necessary for us to comply with a legal or regulatory obligation.
This may include obligations relating to:
We may process personal information where this is necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms.
Our legitimate interests may include:
Where we rely upon legitimate interests, we will consider whether the processing is necessary and whether our interests are appropriately balanced against the individual’s rights and expectations.
Where appropriate, we may rely on your consent to process personal information.
Where we rely on consent, you have the right to withdraw your consent at any time.
Withdrawal of consent will not affect processing that took place before consent was withdrawn.
We may use business contact information to communicate with businesses and business contacts about services that we believe may be relevant to their organisation.
Our services may include:
Where appropriate, our lawful basis for processing personal information for business-to-business marketing will be legitimate interests.
When considering whether to use legitimate interests for marketing, we will take into account:
We will comply with applicable requirements under PECR when sending direct marketing communications by electronic means or making direct marketing calls.
The requirements may differ depending on whether we are contacting:
We will not treat all business contacts as being subject to identical marketing rules.
You have the right to object to direct marketing at any time.
If you do not wish to receive marketing communications from us, you can:
Where you object to direct marketing, we will take appropriate steps to ensure that your information is no longer used for direct marketing.
We may retain limited information on a suppression or do-not-contact list where necessary to ensure that we respect your objection and do not inadvertently contact you again.
An objection to marketing will not necessarily require us to delete all personal information we hold about you where we have another lawful reason for retaining it.
Where Majestic obtains business contact information from a health and safety accreditation or prequalification scheme, or another third-party business database, we will only use that information to identify relevant business contacts and organisations that may benefit from our services where doing so is permitted under the terms on which we access that database and under applicable data protection and electronic marketing law.
We do not treat access to a third-party database as, by itself, giving us a general right to use the information it contains for our own marketing. Many accreditation and compliance platforms restrict how the information they hold may be used by their members, and we will have regard to those restrictions, in addition to applicable law, before using any information obtained in this way for business communications.
We will consider:
Where required, we will provide individuals with information about the source of their personal information and how we are using it.
If an individual asks where we obtained their information, we will provide appropriate information about the source, subject to any applicable legal restrictions.
Where we send marketing emails, we will comply with applicable data protection and electronic marketing requirements.
Marketing emails may contain:
Where required, appropriate consent will be obtained before sending electronic marketing communications.
Every marketing email will provide an appropriate means of opting out.
We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy.
This may include sharing information with:
We will only share personal information where there is a lawful basis for doing so.
We do not sell personal information to third parties.
We may use third-party organisations to provide services on our behalf.
These may include providers of:
Where a third party processes personal information on our behalf, we will take reasonable steps to ensure that appropriate contractual and security arrangements are in place.
Some of our service providers may process or store personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place in accordance with applicable data protection legislation.
We take reasonable technical and organisational measures to protect personal information against:
Access to personal information will be restricted to people who need access for legitimate business purposes.
We will take reasonable steps to ensure that personal information is stored securely.
However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.
We will not keep personal information for longer than is reasonably necessary for the purpose for which it was collected.
The length of time information is retained will depend upon:
Where personal information is no longer required, it will be securely deleted, destroyed or anonymised where appropriate.
To give effect to the principles above, we apply the following indicative retention periods. These periods are a general guide; the actual period applied to a specific record may vary where a longer or shorter period is justified by the circumstances, and may be extended where a relevant legal claim, investigation or dispute is ongoing.
|
Record / Information Type |
Retention Period |
Basis for Period |
Action on Expiry |
|
Enquiry and quotation records (no contract concluded) |
12 months from last contact |
Legitimate interests – reasonable commercial window to follow up; no ongoing lawful basis beyond this |
Securely delete or anonymise |
|
Customer contracts and project records |
6 years from end of contract / project completion |
Limitation Act 1980 – standard limitation period for contract claims (England & Wales) |
Securely delete or archive-then-delete |
|
Invoices, payments and accounting records |
6 years from end of the financial year to which they relate |
Companies Act 2006 / HMRC record-keeping requirements |
Securely delete |
|
Contractor and subcontractor records (incl. CIS records) |
6 years from end of engagement or relevant tax year |
HMRC CIS record-keeping requirements; Limitation Act 1980 |
Securely delete |
|
Health and safety records (general) |
3 years minimum from date of record |
Health and Safety at Work etc. Act 1974 and supporting regulations |
Review; delete unless subject to extended retention below |
|
Health and safety records – accident/incident (RIDDOR) |
3 years from date of incident (longer if involving a child, or a claim is live) |
RIDDOR 2013; potential personal injury limitation period (3 years, extendable) |
Review with legal advice before deletion |
|
Records relevant to exposure to hazardous substances (e.g. asbestos, noise, vibration, hazardous dust) |
40 years from date of last exposure, where applicable |
Control of Substances Hazardous to Health Regulations 2002 (COSHH) and related industrial disease guidance |
Retain per COSHH; do not delete without specialist advice |
|
Accreditation and compliance records (e.g. health and safety accreditation and prequalification schemes) |
Duration of accreditation plus 2 years |
Legitimate interests – evidencing compliance history if challenged |
Securely delete once superseded and outside retention |
|
Training and competency records |
Duration of employment/engagement plus 6 years |
Legitimate interests; potential employment tribunal or negligence claims |
Securely delete |
|
Insurance records and correspondence |
As required by insurer, typically up to 6 years after policy expiry (longer for public/employer’s liability, see below) |
Contractual requirement with insurer; potential future claims |
Securely delete once insurer confirms no longer required |
|
Employer’s liability insurance certificates |
40 years from policy expiry |
Employers’ Liability (Compulsory Insurance) Regulations 1998 guidance |
Retain in archive; do not delete without advice |
|
Marketing contact records (B2B) – active |
Until objection, opt-out, or no engagement for 24 months |
Legitimate interests; PECR |
Move to suppression list or delete |
|
Marketing suppression / do-not-contact list |
Indefinite, or until no longer needed to honour the objection |
Legitimate interests – necessary to respect the individual’s objection |
Retain minimal data only (identifier sufficient to suppress) |
|
Website analytics and cookie data |
As set out in the applicable cookie’s own expiry (typically 14–26 months for analytics cookies) |
Consent / legitimate interests, per cookie category |
Automatic expiry per cookie settings |
|
General correspondence and complaint records |
3 years from resolution of the matter |
Legitimate interests – handling any follow-up query or complaint |
Securely delete |
|
Records relevant to a legal claim or dispute |
Until the claim is concluded, plus the applicable limitation period |
Necessary for establishing, exercising or defending legal claims |
Review with legal advice before deletion |
This retention schedule is reviewed alongside this Privacy Policy and may be updated to reflect changes in legislation, regulatory guidance or our business practices.
Subject to certain legal exemptions and restrictions, you may have the right to:
These rights are subject to applicable legal requirements and exemptions.
For example, there may be circumstances where we are legally entitled or required to retain certain information even if you ask us to delete it.
You have the right to request access to the personal information we hold about you.
A Subject Access Request (SAR) can be made verbally or in writing.
You do not need to use a specific form or wording to make a valid request.
We will normally respond to a SAR without undue delay and within one calendar month of receiving the request, subject to applicable legal provisions.
Where a request is complex or where we have received a number of requests from the same individual, the applicable legal time limit may be extended where permitted by law. If an extension is required, we will explain this to you.
We will not normally charge a fee for dealing with a SAR.
In limited circumstances, where permitted by law, we may charge a reasonable fee or refuse to act on a request where it is manifestly unfounded or excessive.
We may need to request reasonable information to confirm your identity before providing personal information.
When responding to a SAR, we may also provide information about:
We aim to ensure that the personal information we hold is accurate and up to date.
If you believe that information we hold about you is incorrect or incomplete, you can contact us and request that it is corrected.
We will consider the request and take appropriate action where necessary.
You may have the right to request that we delete your personal information.
This is sometimes referred to as the “right to be forgotten”.
The right is not absolute and does not apply in every circumstance.
For example, we may need to retain certain information where this is necessary to:
Where we are able to delete information, we will do so within a reasonable period.
You may have the right to request that we restrict the processing of your personal information in certain circumstances.
Where processing is restricted, we may continue to store your information but will generally not process it further unless permitted by law.
You may have the right to object to certain processing of your personal information.
You have an absolute right to object to the processing of your personal information for direct marketing purposes.
If you object to direct marketing, we will stop using your personal information for direct marketing purposes, subject to any necessary processing required to maintain a suppression or do-not-contact record.
If you have concerns about how we have handled your personal information, please contact us in the first instance.
We will consider your complaint and take appropriate action.
You also have the right to complain to the Information Commissioner’s Office (ICO).
The ICO can be contacted through its website: https://ico.org.uk/
We would encourage you to contact us first so that we have the opportunity to investigate and resolve your concern.
Our website may use cookies and similar technologies.
Cookies are small files stored on your device that allow a website to recognise your device or remember certain information.
We may use cookies for purposes including:
Where cookies or similar technologies are not strictly necessary for the operation of the website, we will seek consent where required by applicable law.
Simply continuing to browse our website will not necessarily constitute consent to non-essential cookies.
You may manage or disable cookies through your browser settings and, where provided, through our website cookie consent mechanism.
We may use Google Analytics or similar analytics services to understand how visitors use our website and to help us improve its performance.
Analytics information may include:
Where analytics cookies or similar technologies require consent, we will seek the appropriate consent before using them.
Our website may contain links to third-party websites.
This Privacy Policy applies only to Majestic’s website and the personal information processed by Majestic.
We are not responsible for the privacy practices, content or security of third-party websites.
You should review the privacy policy of any third-party website that you visit.
Our website and services are primarily intended for businesses and adults.
We do not knowingly collect personal information from children for marketing purposes.
If you believe that we have collected personal information relating to a child without appropriate authority, please contact us.
We do not currently use personal information to make decisions about individuals solely through automated decision-making that produces legal or similarly significant effects.
We may use basic information about businesses and business contacts to help us determine which organisations may be relevant to our services.
This does not normally result in a decision about an individual’s legal rights or similarly significant circumstances.
If our use of automated decision-making or profiling changes materially, we will update this Privacy Policy where required.
We take reasonable steps to protect personal information against loss, misuse and unauthorised access.
If we become aware of a personal data breach, we will assess the breach and take appropriate action in accordance with applicable data protection legislation.
Where a breach is required to be reported to the Information Commissioner’s Office or affected individuals, we will make the appropriate notification within the applicable legal timescales.
We may update this Privacy Policy from time to time to reflect:
The latest version will be published on our website.
We recommend checking this page periodically for any changes.
If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, wish to opt out of marketing or have a concern about how we use your personal information, please contact us.
Majestic Construction
Trading as Majestic Site Management Ltd
Address: Unit 10 Queens Square Business Park, Honley, Holmfirth, England, HD9 6QZ
Telephone: 01484 426302
You may also contact us using the email address or contact form published on our website.
This Privacy Policy will be reviewed at least annually and sooner where there are significant changes to:
Policy owner: Majestic Construction / Majestic Site Management Ltd
Effective date: 13 August 2026
Review date: August 2027
Version: 2.2 (retention schedule added in v2.1; third-party database references generalised and use restricted to terms of access in v2.2, as part of scheduled policy review)
