Privacy policy

Last updated September 2026

Who we are and how to contact us

RSA Electrical Solutions Ltd is the data controller for the personal data described in this notice. We are an electrical and instrumentation contractor management company, registered in England and Wales under company number 16607672.

For anything to do with your personal data, including a request for a copy of it or a request to delete it, email enquiries@rsaelectrical.co.uk. The Director is responsible for data protection within the company and handles these requests personally.

We are not required to appoint a Data Protection Officer and have not appointed one.

Who this notice covers

This notice applies to four groups of people.

• Visitors and clients. You can read the website, send us a question through the contact form, or request a quote. You do not need an account and we do not create one for you.
• Sub-contractors. Vetted firms and sole traders who take work through us. Sub-contractors are the only people who hold accounts on this website.
• People who work for our clients. Site contacts, engineers and managers whose details reach us in the course of a job.
• Our own staff. Staff use a private admin area that is never linked from the public website.

Information we collect

If you use the contact form

Your name, your email address, your telephone number if you choose to give it, and the question you ask.

If you request a quote

The form has two steps and collects your name, email address, telephone number, your company name if you give it, the nearest town to the site, the dates you need someone on site, and a description of the scope of work.

It also requires three drawings: an electrical layout, schematics and wiring diagrams. You can attach further files if they help us price the work.

We ask for the nearest town rather than the full site address. We do not need the exact address to price a job, and not asking for it means we are not holding it before there is any work to do.

Your quote request and its attachments are sent to our enquiries inbox.

If you apply to become a sub-contractor

The sign-up form has three steps.

Step one, about your business. Your company name if you have one, your main contact name, your work email address, your telephone number, your date of birth (to confirm you are 18 or over), your trade, the size of your team, your years in the trade, the town you are based in, how far you are willing to travel, whether you take work abroad, and a description of your recent work.

Step two, your accreditation. All six of the following are required, each with its reference or card number, an expiry date where one applies, and an uploaded copy of the document as a PDF or a photograph of up to 10 MB:

• public liability insurance, including the provider and the amount of cover
• your ECS card
• your IPAF certification, including the categories you hold
• your CompEx certification
• your City and Guilds 2391 qualification
• a safety card, being CSCS, CCNSG or SSSTS

Step three, your commercial and payment details. Your hourly or day rate, your weekend and bank holiday rates if you set them, your trade status for the Construction Industry Scheme, your VAT status and number, your bank account name, sort code and account number, and a password.

If you trade through a limited company we also collect the registered company name, the company number and the company UTR. If you are a sole trader within the Construction Industry Scheme we collect your full legal name, your trading name if you use one, your personal UTR and your National Insurance number.

While you hold a sub-contractor account

We hold the records you create and update through the account: your cards and certificates and their expiry dates, the days you are not available to work, your rates, your trade and bank details, your contact details including your business address and base town, and your password.

We also hold your messages with us, your questions about jobs and any file you attach to them, and the prices and start dates you give us for jobs.

If you change your business name, the account requires you to re-enter all of your company, Construction Industry Scheme, VAT and bank details, so that what we hold matches the business we are paying.

If you work for one of our clients

Your name, your role and your contact details, so that we can reach you about the job.

If you are a member of our staff

Your username and the email address your password resets are sent to. A password reset is only ever sent to the address already held on the account.

The name given to each phone linked for two-step sign-in. Each sign-in is emailed to the account with its time, its approximate location and the browser used, so that a sign-in nobody recognises is noticed.

If you visit the website

We count visits to our public pages with Vercel Web Analytics, provided by Vercel, which hosts the website. It records the page visited, the website that sent you, and your approximate country, device type and browser. It sets no cookies and stores nothing on your device. It does not keep your IP address: visits are grouped using a code that changes every day, which cannot identify you or follow you across other websites. Sign-in pages, your account and our staff area are never counted. We use it, under our legitimate interest in running a website that works, to see which pages are read and which are not.

How we protect your most sensitive details

Some of what we collect would cause real harm in the wrong hands, so it is handled differently from everything else.

Your National Insurance number, your UTRs, your sort code and your account number are masked once saved. From that point the account shows only the last four characters. They are never written to our logs, never placed in a web address, and never sent by email.

If you change your bank details, we place payments to you on hold until a member of our staff has confirmed the change with you by telephone, using the number already on your account. This is deliberate friction. It is the single most effective defence against someone who has gained access to your email and wants our payments redirected.

If you change your trade details, your account returns to HMRC verification before any further payment is made.

Files you upload are held in private storage. They cannot be opened by a direct web address, and they are not published or indexed. When someone entitled to see a file opens it, the system issues a temporary link that expires shortly afterwards, so a link that is copied or forwarded stops working.

Why we use your information, and our lawful basis

UK GDPR requires us to have a lawful basis for everything we do with personal data. One distinction runs through the table below. Where you are an individual contracting in your own name, such as a sole trader sub-contractor, you are a party to the contract and we rely on the contract basis. Where our contract is with a company and you are its employee, its officer or its contact, you are not personally a party to that contract, so the contract basis does not apply to your data and we rely on our legitimate interests instead.

Where we rely on legitimate interests, we have assessed whether our interest is outweighed by the effect on you and concluded that it is not. You can ask us for that assessment, and you can object to the processing. The section on your rights explains how.

We do not use automated decision making or profiling. A person decides which sub-contractor is offered a job, and a person decides whether an application is approved.

Special category data

We do not ask for special category data, and you should not send it to us.

One exception arises in practice. An accident, incident or near-miss record will normally describe an injury, and that is health data. Where we hold it, we hold it only because we are required to keep those records. We rely on the condition in Article 9(2)(b) of the UK GDPR, read with paragraph 1 of Schedule 1 to the Data Protection Act 2018, for employment and health and safety purposes, or on Article 9(2)(f) where we need the record to defend a legal claim. It is kept apart from the rest of the job file, with access limited to the Director.

Keeping clients and sub-contractors apart

We sit between our clients and our sub-contractors, and as a matter of course we keep them separate.

A job brief given to a sub-contractor does not name the client. A client is not told which sub-contractor is carrying out the work. Neither is given the other’s contact details, and the account area is built so that a sub-contractor can only reach the jobs assigned to them.

This is not absolute, and it depends on the job. There are situations where an identity has to be shared, including where:

• you ask us to make an introduction;
• a site cannot be attended safely or lawfully without it, for example where access depends on being expected by name, or where a permit, an induction or a security clearance is issued in the individual’s name;
• our client requires us to disclose who will attend their site before granting access, which is common on industrial and regulated sites;
• the law, a regulator or an insurer requires it.

Where we do share an identity, we share only what the situation requires, and we tell you.

Who we share your information with

We do not sell your data and we do not share it for anyone else’s marketing.

Our service providers. These companies process data on our instructions and are not permitted to use it for their own purposes.

We do not use a payment processor, because we do not take or process payments on this website.

Others we share with, and only as far as each needs it.

• Approved sub-contractors, who receive the job brief, the site location and the drawings needed to carry out the work.
• HMRC, for Construction Industry Scheme verification, deductions and returns.
• Our accountants, our insurers and our insurance brokers, and our legal advisers where we need advice or have to defend a claim.
• Principal contractors and site operators, where we work under another contractor and they require a record of who attended their site.
• Regulators, including the Health and Safety Executive and the Information Commissioner’s Office, where we are required by law to provide information.

If our business or part of it is sold or transferred, your data may pass to the buyer. We will tell you if that happens.

Where your data is stored, and sending it abroad

We select the United Kingdom region wherever a service offers one, so your data is held in the UK. Our email provider has no UK region, so the emails the website sends are held in Ireland, in the EU. UK law recognises the EU as giving an adequate level of protection, so no further safeguard is needed for that.

The companies providing those services are based outside the UK, and we carry out work internationally, so your data may still be transferred outside the UK, for example when a provider’s support or engineering staff need access to resolve a fault. Where it goes to a country the UK Government has not decided offers an adequate level of protection, we rely on the International Data Transfer Agreement, or on the UK Addendum to the European Commission’s standard contractual clauses, which form part of our agreement with each provider.

Where a job is on an international site, the personal data needed for that job may be shared with people in that country, including for site access and customs purposes. We keep that to what the job requires.

You can ask us which providers are involved and which safeguard applies to each, and we will tell you.

How long we keep your information

Where two periods apply to the same record, the longer one applies. Where a claim, complaint or investigation is live, or we reasonably expect one, we keep the records relating to it until it is finally resolved.

Deleting your account and your data

If you hold a sub-contractor account

You can delete your account yourself, at any time, from your account settings. You will be asked to type DELETE to confirm, because it cannot be undone.

Deleting your account removes your business details, your rates, your bank details, your certificates and the files you uploaded, your availability, your messages and your job replies from the account area. Signing up again creates a new account rather than restoring the old one.

If you are part-way through a live job, tell us before you delete the account so the work can be handed over safely.

What deletion does not remove

Some records we are required by law to keep, and deleting your account does not remove them. When you delete your account we keep the following, held outside the account area with access limited to the Director:

• your Construction Industry Scheme records, including payment and deduction statements and the tax details they rest on
• our accounting record of what we paid you
• our record of the checks we carried out before offering you work, and the certificates that evidenced them
• the job records, test results and certification for work you carried out

Each is kept for the period shown in the table above and no longer. We keep them because the law requires it, and because they are the evidence that the work was done by someone competent and insured. Everything else goes, and we confirm to you in writing what has been deleted and what has been kept.

Emails

Emails that have already been delivered to an inbox are outside the reach of the website. If you want the copies we hold in our own inbox deleted, email enquiries@rsaelectrical.co.uk and ask, and we will delete the ones we are not required to keep.

If you are a visitor or a client

You have no account, so there is nothing to delete on the website. Email enquiries@rsaelectrical.co.uk and we will delete the enquiry, quote request and drawings we hold for you, other than anything we are required to keep under the table above.

Backups

Deleting a record removes it from our live systems immediately. Backup copies are overwritten in the normal course of our providers’ backup cycle. We do not use a backup to restore personal data that has been deleted, unless a court or the law requires us to. Nothing is kept in a backup for longer than the period shown in the table above, or longer than the law requires.

Your rights

All of these are free to use. We acknowledge your request within 24 hours and respond in full within one month. If your request is complex, or you have made several, we may extend that by up to two further months and will tell you within the first month if we do.

• Access. Ask for a copy of the personal data we hold about you, and an explanation of how we use it.
• Deletion. Ask us to delete your data, as described above.
• Correction. Have inaccurate data corrected and incomplete data completed. Most of your details can be corrected yourself in your account.
• Restriction. Ask us to stop using your data while a dispute about its accuracy, or about our basis for holding it, is resolved.
• Objection. Object to anything we do on the basis of legitimate interests. We will stop unless we can show compelling grounds to continue.
• Portability. Where we hold data you gave us and process it by automated means on the basis of consent or a contract, ask for it in a machine readable format.
• Direct marketing. Tell us to stop at any time. This is an absolute right and we will stop.
• Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect anything we did beforehand.

To use any of these, email enquiries@rsaelectrical.co.uk. We may ask you to confirm your identity first, so that we do not release your data to someone else.

If we refuse part of a request, we will tell you why, and that you can complain to the Information Commissioner’s Office or apply to a court.

Keeping your information secure

Access to the account area requires a password and a valid session. Sessions expire after 8 hours.

Uploaded files are held in private storage and are reachable only by those given access to them through the account.

The database enforces who can see what. A sub-contractor account can only reach its own records and the job briefs assigned to it, and cannot reach another sub-contractor’s records, whatever a page or a request asks for.

Your most sensitive details are masked after saving, never logged, never placed in a web address and never emailed, as described above.

Our staff use a private admin area that is not linked from the public website, and password resets are only ever sent to the address already held on the account.

No system is completely secure. Information you send us over the internet travels at your own risk, and we cannot guarantee the security of data in transit to us. Once we have it, we protect it with the measures above.

If something goes wrong

If a breach happens, we assess and contain it promptly. Where it is likely to result in a risk to your rights and freedoms, we report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. Where it is likely to result in a high risk to you, we tell you as well, without undue delay.

Cookies

Our cookie policy sets out what we store on your device. In short, we use two sign-in cookies and two form drafts, all of them strictly necessary, and no advertising or tracking of any kind. Our visitor statistics set no cookies. That is why the site shows no cookie banner.

Complaints and changes

If you are unhappy with how we have handled your data, tell us first. Email enquiries@rsaelectrical.co.uk and we will look into it and respond.

You can also complain to the Information Commissioner’s Office, which is the UK regulator for data protection. It can be reached at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to complain to us first, although it usually resolves matters faster.

We review this notice at least once a year, and update it when our systems or our providers change. The current version is always published at rsaelectrical.co.uk/privacy. Where a change materially affects how we use data we already hold about you, we will tell you directly.