Privacy Policy

Arinite Limited is a health and safety consultancy providing audits, inspections, fire risk assessments, DSE and workstation assessments, training, incident investigation and related advisory services to clients across the UK and internationally.

We are registered with the Information Commissioner's Office (ICO) as a data controller, under number ZB366235. Our registered address is:

Arinite acts in two capacities depending on the context:

• As a Controller – when we process personal data for our own internal business purposes, such as managing client relationships, engaging consultants, recruiting and handling enquiries. This Privacy Notice covers these activities.
• As a Processor – when we process personal data on behalf of our clients during the delivery of health and safety services (for example, storing DSE assessments or accident reports in our systems on a client's instruction). In those cases, the client is the Controller, and their own privacy notice will apply to the individuals whose data is involved.

This Privacy Notice covers only the activities where Arinite acts as Controller. It does not cover employee and worker data, which is addressed in a separate Employee Privacy Notice.

You have rights in respect of our processing of your personal data. Subject to certain conditions, these are:

• Right to be informed – to be told about how and why we collect and use your personal data (which is the purpose of this notice).
• Right of access – to request a copy of the personal data we hold about you and details of how we use it.
• Right to rectification – to ask us to correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure – to ask us to delete your personal data where there is no compelling reason for us to continue holding it.
• Right to restriction – to ask us to pause processing your personal data in certain circumstances, for example whilst we verify its accuracy.
• Right to object – to ask us to stop processing your personal data where we are relying on legitimate interests as our lawful basis, if something about your particular situation gives you grounds to object.
• Right to data portability – in certain circumstances, to request that we transfer your data to you or another organisation in a structured, commonly used, machine-readable format.
• Right not to be subject to automated decision-making, using special category data – to object to decisions being made about you solely by automated means without human involvement.

To exercise any of these rights, please contact us at DPO@arinite.com.

If you are not satisfied with how we handle your data or your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). Please note, prior to lodging a complaint with the ICO please contact Arinite using DPO@arinite.com.

Arinite will acknowledge your complaint within the statutory timeframe of 30 days and attempt to resolve your complaint at the earliest opportunity.

If you remain unsatisfied with our response, you are able to lodge a complaint with the ICO via the following link: https://ico.org.uk/make-a-complaint/

We only share personal data where it is necessary and proportionate. We may share data with:

• Service providers and processors – companies that provide tools and services we rely on (see the notices below for specifics by audience type). We have Data Processing Agreements in place with all processors.
• Professional advisers – accountants, lawyers and auditors where required.
• Statutory and regulatory bodies – where we are legally required to disclose information, for example HMRC or the ICO.
• Prospective buyers – if Arinite is involved in a merger, acquisition or sale, personal data may be transferred as part of that transaction. We will notify you in advance if this happens.

Some of the tools and systems we use are hosted or operated by companies based outside the UK or EEA. Where personal data is transferred internationally, we ensure appropriate safeguards are in place. These may include:

• Adequacy decisions – where the destination country has been recognised by the UK as providing an equivalent level of data protection.
• Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Agreement (IDTA) – contractual safeguards approved for use in international transfers.

We carry out due diligence and transfer impact assessments where appropriate to ensure your data remains protected. The specific tools that may involve international transfers are identified in the audience-specific notices below.

Arinite takes the security of your personal data seriously. We have put in place appropriate technical and organisational measures to protect your data against accidental loss, unauthorised access, alteration or disclosure. These include:

• Access controls limiting who can view personal data to those with a business need.
• Secure cloud-based systems with encryption in transit and at rest.
• Confidentiality obligations on all staff and contractors.
• Procedures for detecting, reporting and investigating data breaches.

Where we share data with processors and other third parties, we require them to implement equivalent security measures and to process data only in accordance with our instructions.

We do not use your personal data in any automated process to make decisions about you that produce legal or similarly significant effects without human involvement.

We may update this Privacy Notice from time to time, for example if our processing activities change or if there are updates to the law. When we make significant changes, we will publish an updated version on our website and, where appropriate, contact you directly to let you know.

The date at the top of this notice shows when it was last reviewed.

If you have any questions about this notice or about how we handle your personal data, please contact our Data Protection contact at DPO@arinite.com or write to us at the address in section 1.