Privacy policy

This policy explains how Saqib Engineering Ltd handles personal data collected through this website, the lawful bases we rely on, how long we keep it, the measures we take to protect it, and your rights. It applies to visitors, people who make an enquiry, and people who apply for a role with us.

1. Who we are and how to contact us

Saqib Engineering Ltd ("we", "us", "our") is a power engineering consultancy registered in England and Wales, company number 15866031, VAT number GB 491767937, with its registered office at Office 17b Bradmarsh Business Park, Bow Bridge Close, Rotherham S60 1BY. We are the data controller for the personal data described in this policy, and we are registered with the Information Commissioner's Office (ICO) under registration reference ZC196542.

Responsibility for data protection sits with Saqib Shah, Managing Director. We are not required to appoint a Data Protection Officer, but you can raise any privacy matter with us at [email protected] or by post to the registered office above, marked for the attention of the Managing Director.

We aim to acknowledge privacy enquiries and requests within five working days and to resolve any formal request within one calendar month, in accordance with UK GDPR. Where a request is complex or we receive a number of requests from you, we may extend this by up to two further months and will tell you if we do.

2. Our role under UK GDPR

We act only as a data controller for the personal data collected through this website: website enquiries, job applications, related correspondence and technical data. We decide why and how that data is processed.

We do not act as a data processor through this website, and we do not process our clients' personal data on their behalf through it. Where a project involves personal data as part of an engagement, that is governed separately by the contract agreed for the engagement, not by this policy.

3. The personal data we collect

• Project enquiries. When you use the enquiry form or contact us about a project, we collect your name, company, email address, phone number, the project type, voltage level, service required, project location, timescale, the details you provide, and any documents you choose to attach.
• Job applications. When you apply for a role or send a speculative application, we collect your name, email address, phone number, the role applied for, your message, your CV and any supporting files you attach.
• Direct correspondence. If you email or call us, we collect the contact details and content of that correspondence.
• Technical and log data. Our hosting provider, Cloudflare, Inc., processes visitors' IP addresses and request data in short-lived server logs to deliver the site securely and defend it against attack. We do not use analytics or tracking cookies by default; where cookieless analytics is enabled, it does not identify individual visitors. See our cookies policy for detail.

4. Special category data

We do not ask for special category data (for example information revealing health, disability, ethnicity, religion, or similar). Please do not include it in an enquiry, a CV or a covering message unless it is genuinely relevant to your application.

Where you choose to provide special category data, we process it with your explicit consent (Article 9(2)(a)). Where we need it to meet an employment-law obligation, such as making reasonable adjustments during recruitment, we rely on Article 9(2)(b) and the conditions in Schedule 1 of the Data Protection Act 2018.

5. Lawful bases for processing

Under Article 6 of UK GDPR, we rely on the following lawful bases:

• Project enquiries. Steps taken at your request before entering into a contract (Article 6(1)(b)) and our legitimate interests in responding to and managing business enquiries (Article 6(1)(f)).
• Job applications. Steps taken at your request prior to a possible employment contract (Article 6(1)(b)) and our legitimate interests in assessing candidates (Article 6(1)(f)). If you ask us to keep your details for future roles, we rely on your consent (Article 6(1)(a)).
• Correspondence. Our legitimate interests in communicating with clients, suppliers, candidates and other business contacts and in running our business (Article 6(1)(f)).
• Technical and security data. Our legitimate interests in operating a secure, reliable website (Article 6(1)(f)).
• Legal and accounting records. Compliance with our legal obligations (Article 6(1)(c)), for example tax and accounting duties.
• Marketing. Your consent (Article 6(1)(a)), or the PECR soft opt-in described in section 9. We do not currently send marketing communications.

Where we rely on legitimate interests, we have considered your rights and freedoms and concluded that our processing does not override them. You can object to legitimate-interests processing at any time (see section 13).

6. How we use your personal data

• To respond to your enquiry and scope, prepare and manage engineering work.
• To assess job applications and manage recruitment.
• To communicate with you and keep records of our dealings.
• To operate, secure and improve the website.
• To meet our legal, accounting and regulatory obligations.

We do not sell personal data, and we do not use enquiry or application data for advertising.

7. Job applicants

When you apply for a role, we process the personal data in your application to assess your suitability and, if relevant, to take steps towards an employment contract. Applications are seen only by the engineers and staff involved in recruitment.

Please avoid including special category data unless it is relevant, as described in section 4. We keep unsuccessful applications for six months after a recruitment decision, then delete them. If you ask us to keep your details on file for future roles, we retain them for up to twelve months before asking you again or deleting them, and you can withdraw that consent at any time by emailing [email protected].

8. Automated decision-making and profiling

We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects, and we do not carry out profiling of that kind. Enquiries and applications are reviewed by people.

9. Marketing communications and PECR

We do not currently send marketing communications. If we introduce them, we will only send marketing by electronic means where you have given consent, or where you are an existing client receiving information about services similar to those we have already provided to you and you have not opted out (the PECR "soft opt-in").

You can opt out of marketing at any time by emailing [email protected], or by using the unsubscribe link in any marketing message. We will action opt-out requests within five working days and suppress your details from marketing thereafter.

10. Data sharing and processors

We do not sell or rent personal data. We share it only in the following ways:

• Cloudflare, Inc. acts as our processor for website hosting, DNS and form handling. Enquiry and application submissions pass through Cloudflare's infrastructure.
• Resend, Inc. acts as our processor for email delivery, forwarding form submissions to our own inboxes.
• Professional advisers and authorities. We may disclose personal data to our accountants, insurers or legal advisers, or to a regulator, court or law enforcement body, where we are required or permitted to do so by law.

Both Cloudflare and Resend act under written terms that require them to process personal data only on our instructions and to apply appropriate technical and organisational measures. We do not use a separate email marketing platform.

11. International transfers

Cloudflare, Inc. and Resend, Inc. may process personal data in the United States. Where personal data is transferred outside the UK, the transfer is protected by the provider's data-processing agreement incorporating the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and, where the provider holds a valid certification, the UK Extension to the EU-US Data Privacy Framework. You can request details of the safeguards that apply by emailing [email protected].

12. Data retention

We keep personal data only for as long as we need it, and we apply the following periods:

• Enquiry records. Retained for up to 24 months from our last meaningful contact, then deleted or anonymised. Where an engagement results, the associated records are kept for the duration of the engagement and for six years afterwards for contractual, legal and accounting purposes.
• Job applications (unsuccessful). Retained for six months after a recruitment decision, then deleted, unless you have asked us to keep them (see section 7).
• Talent-pool applications. Retained for up to twelve months from your consent, then deleted or re-confirmed.
• Correspondence. Retained for up to 24 months from our last contact, unless it forms part of a record we must keep for longer.
• Technical and server logs. Retained by our hosting provider for a short period, typically up to 30 days, then deleted.
• Accounting and tax records. Retained for six years, as required by law.

13. Your rights under UK GDPR

Subject to the conditions in UK GDPR, you have the right to:

• be informed about how we use your personal data (this policy);
• access a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict our processing in certain circumstances;
• object to processing based on our legitimate interests;
• data portability, where processing is based on consent or contract and is carried out by automated means; and
• withdraw consent at any time, where we rely on consent, without affecting earlier processing.

To exercise any right, email [email protected]. We will respond within the timescales in section 1. There is normally no charge, and we may ask you to confirm your identity before we act.

14. Security

We take appropriate technical and organisational measures to protect personal data, as required by Article 32 of UK GDPR. These include:

• serving the website and all form submissions over HTTPS using TLS 1.2 or higher, with HTTP Strict Transport Security enabled;
• a Content-Security-Policy and related security headers, self-hosted fonts and scripts, and no third-party tracking cookies;
• data minimisation: form submissions are delivered to us by email and are not stored in a database on this website;
• restricting access to the inboxes that receive enquiries and applications to the personnel who need it, protected by multi-factor authentication;
• engaging our processors under written terms that require appropriate security measures;
• protection of the site against common web attacks by our hosting provider; and
• periodic review of these arrangements.

No transmission or storage of data can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO without undue delay and, where required, within 72 hours, and we will inform affected individuals where the risk to them is high.

15. Children's data

This website is aimed at businesses and professionals and is not directed at children. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has provided us with personal data, contact us and we will delete it.

16. Third-party links

The site may link to third-party websites, including OpsWork and mapping services. We are not responsible for the privacy practices or content of those sites, and the inclusion of a link is not an endorsement. You should review the privacy policy of any third-party service before sharing personal data with it.

17. Complaints, changes and how to contact us

If you are unhappy with how we have handled your personal data, please contact [email protected] first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We may update this policy from time to time. The version and date at the top of the page show when it was last changed. Where a change is material, we will place a notice on this page for at least 30 days.