Name: Darren Powney
Address: CCL Solutions Group, 34-36 Cygnet Court, Timothy’s Bridge Road, Stratford upon Avon, Warwickshire, CV37 9NW
Phone Number: 01789 261 200
E-mail: hr@cclsolutionsgroup.com
Contents
1. Who we are and what we do
2. The type of personal information we collect
3. How we get the personal information and why we have it
4. Our Legal Basis to process data
5. Sharing your personal data
6. How we store your personal information
7. Artificial Intelligence
8. Data Retention
9. Your data protection rights
10. How to complain
This is the Privacy Notice of CCL Group which represents CCL’s group of companies and applies to CCL’s use of all client, supplier and third-party personal data including that of recruitment candidates. Our handling of personal data relating to employees, contractors, agency and temporary staff working for the CCL Group of companies is set out in our Group Staff Privacy Notice.
We provide a range of data analytics, digital forensics, consultancy, data governance and cyber security services to a range of clients (the ‘Services’). This means that in our core business we will often act as a data processor for our clients in relation to data they will provide to us to undertake these Services and our client will remain the controller of the personal data involved.
In order to do this for them, we will collect personal information as a controller relating to our contact with clients, potential clients, suppliers and relevant third parties such as visitors in relation to the provision of these Services.
To the extent that we act as a data controller under Data Privacy Laws, this notice aims to meet requirements to provide information to third parties about how we deal with their personal data.
We understand the importance of the careful handling of personal information and we are committed to protecting and respecting your privacy. Please read the following carefully to understand our practices regarding your Information.
Sometimes we may process your information in a way not described by this Notice. If that is the case, then we will aim to inform you specifically as quickly as we reasonably can.
This Notice meets the standards of the UK GDPR and Data Protection Act 2018, the Data Use and Access Act 2025 and is applicable for individuals within the EEA.
References in this Privacy Policy to “we”, “our” or “us” (or similar) are references to the CCL group of companies who are:
We are registered at 36 Cygnet Court, Timothy’s Bridge Road, Stratford-upon-Avon, CV37 9NW. References to “user” or “you” (or similar) are references to you as an individual or legal entity as the case may be.
Personal information is anything that identifies you or relates to you, directly or indirectly, on its own or when combined with other information we process. We describe this information in this Notice in categories as a way of describing what we do.
What information we collect and how we categorise it
The information we collect will depend on our relationship with you. For example, while we will collect contact information in relation to a client, in relation to a recruitment candidate we will collect significantly more personal information, including information relating to health and safety.
Most information that we collect relating to you will be provided by you or your company, if we are also interacting with it. However, depending on the nature of our relationship with you, we may collect it from you or from another source, for example; where you are one of or represent our clients, other individuals, our contracted partners, other third parties or from other freely available platforms. In limited cases we may obtain suitably curated and consented contact details which we may use for market analysis or potential contact and marketing.
We use this information in order to:
Under the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018, we have to have lawful bases on which to process your data. These are variously:
Where we rely on legitimate interests as a reason for processing data, we have considered whether or not those interests are overridden by the rights and freedoms of individuals and have concluded that they are not.
Where we process special categories of personal data, this is done under an additional basis for processing:
In the course of processing your datathis, we may share relevant information with trusted and approved third parties, such as:
We may also disclose your personal information to third parties:
Your personal data is stored either in hard copy, held securely or via database(s) located at or accessible from our head office and controlled by our administrative staff which can be accessed by them. We have in place security measures to ensure the confidentiality of information held electronically or in hard copy such as via restricted access, data retention policies, two factor authentication or password controlled. These measures will, overtime, be reviewed and upgraded in line with legal and technical developments. Access to your personal data and sensitive personal data is restricted to a limited number of authorised staff only.
Your information is stored primarily in the UK and in the European Economic Area (EEA). However, your data may be transferred outside of the EEA, and processed by staff and organisations outside of the UK and EEA such as some systems providers. Countries outside of the UK and EEA may not provide the same level of legal protection when it comes to your personal information.
Therefore, any transfers we make outside of the UK and EEA will be made in accordance with UK data protection law, by our ensuring that equivalent protections apply through, for example, the use of the standard data protection clauses for transfer of personal data to countries outside of the UK and EEA.
From time to time we will ask you to review and update the personal data we hold relating to you (although you are welcome to review and update the information more or less frequently as you wish). We will hold this information for no longer than necessary, including to comply with any legal obligation.
Artificial Intelligence (AI) is emerging as a transformative force in our landscape, revolutionising our sector with its wide-ranging applications. However, ensuring the acceptable and controlled use of AI is vital to maintain quality of output, ethical standards and most importantly our trust with you, our clients.
We will only use Artificial Intelligence (AI) to make our services better and more efficient for you. As a team we are committed to using AI responsibly and protecting your privacy every step of the way and as we all learn to navigate these new technologies we make the following commitment to you:
We will only keep your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
Please contact us at HR@cclsolutionsgroup.com, Tel: 01789 261 200 or HR Department, CCL (Solutions) Group Limited, 34-36 Cygnet Court, Timothy’s Bridge Road, Stratford-upon-Avon, CV37 9NW if you wish to make a request.
Further information about our retention of data can be obtained by contacting us at HR@cclsolutionsgroup.com, Tel: 01789 261 200 or HR Department, CCL (Solutions) Group Limited, 34-36 Cygnet Court, Stratford upon Avon, Warwickshire, CV37 9NW if you wish to make a request.
Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.
Your right of access - You have the right to ask us for copies of your personal information. You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances. These include where you have made a challenge on the accuracy of your data, an objection to the use of your data or where you want to limit the use of your data rather than delete it if the organisation processed your data unlawfully but you do not want it deleted, or the organisation no longer needs your data but you want the organisation to keep it in order to create, exercise or defend legal claims.
Your right to object to processing - You have the the right to object to the processing of your personal information where we are undertaking processing in our legitimate interests.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
You can read more about these rights by going to the ICO’s website.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. For the purposes of confidentiality and personal data protection, we may need to identify you in order to respond to your request. You will be asked to include a copy of two official pieces of identification, such as a driver’s licence or passport, along with your request.
Please contact us at HR@cclsolutionsgroup.com, Tel: 01789 261 200 or HR Department, CCL (Solutions) Group Limited, 34-36 Cygnet Court, Timothy’s Bridge Road, Stratford-upon-Avon, CV37 9NW
if you wish to make a request.
If you are unhappy with how we collect, use, or protect your personal data, you have the right to make a complaint. In the first instance, please get in touch with us using the contact details below so that we can investigate and try to resolve your concern.
Note: where we provide a service to, or work on behalf of an organisation it is likely that we are a data processor and the contracting organisation is the data controller. It is likely that the data controller will be best placed to help you in the first instance. As a data processor, we have a legal obligation to assist the data controller with the investigation of any complaints.
Please contact us at HR@cclsolutionsgroup.com, Tel: 01789 261 200 or HR Department, CCL (Solutions) Group Limited, 34-36 Cygnet Court, Timothy’s Bridge Road, Stratford-upon-Avon, CV37 9NW.
Please include your name, contact details, and sufficient information about your complaint to help us respond promptly. We may ask for additional information to allow us to confirm your identity and to enable us to effectively investigate your complaint.
We recognise that you have the right to contact us through any media eg. Post, telephone, email and social media. However, in line with guidance provide by the Information Commissioners Office (ICO), we will not respond to complaints via social media as this is not a secure way of providing information. Instead, we would ask that you contact us through one of the routes outlined below.
We will acknowledge your complaint within 3 days and look to resolve the complaint within 30 days of receipt of your communication. Whilst we investigate your complaint, we will keep you informed of progress and explain the outcome of our investigations.
If you remain dissatisfied, or if you prefer not to raise your concern with us directly, you have the right to lodge a complaint with the UK’s supervisory authority for data protection, the Information Commissioner’s Office (ICO), who is the regulatory authority which oversees data protection compliance in the UK.
We have included details of how to contact them below. This process is in line with your rights under applicable data protection law, including the Data (Use and Access) Act 2025, and does not affect your right to seek a judicial remedy.
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Issue Date: June 2026
Issue No: 9
