Privacy notice
Who we are
Security Risk Systems (“SRS”, “we”, “us”) is a security risk management consultancy based in Sheffield, United Kingdom. It is run by Richard Housley, who is the data controller for the personal information described in this notice.
Contact: info@securityrisksystems.co.uk
This website
This website does not set cookies, does not use analytics or advertising tools, and has no forms. Its fonts are stored on the site itself, so your browser does not contact any other company when you visit. Our website host, Porkbun, may record technical information such as your IP address in server logs to keep the site secure and working.
What we collect and why
| Information | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|
| Your name, organisation, email address, phone number and message when you contact us | To reply to your enquiry and arrange a call | Legitimate interests (responding to enquiries), or steps you ask us to take before entering a contract |
| Business contact details: name, job title, work email address and phone number, organisation, and information about the premises or events it runs | To contact organisations that may need help preparing for Martyn’s Law or with wider security planning | Legitimate interests (telling organisations about services relevant to their work) |
| Contact and billing details for clients | To deliver our services, invoice and keep accounts | Contract; legal obligation (accounting and tax records) |
If we contacted you first
We may email or call people in their work role about our services. We find business contact details in public sources, such as organisations’ own websites and public registers (for example Companies House, the Charity Commission and the Food Standards Agency’s food hygiene ratings). We only contact you about matters relevant to your work.
Every email we send offers a simple way to opt out. If you reply “no thanks” or ask us to stop, we will not contact you again. We keep a short record of your name, organisation and email address so that we do not contact you by mistake in future.
Who we share it with
We do not sell personal information. We use a small number of service providers who process it on our behalf:
- Google (Google Workspace), for email, calendar and documents
- HubSpot, for keeping a record of our contacts and conversations
- Porkbun, for hosting this website
When we appoint an accountant, they will see client and billing records. Some of these providers store information outside the UK. Where they do, we rely on safeguards recognised under UK law, such as UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum.
How long we keep it
- Enquiries that do not lead to work: 12 months after our last contact.
- Business contacts we have approached: 24 months after our last contact, unless you become a client or ask us to delete your details sooner.
- Opt-out records: for as long as we need them to make sure we do not contact you again.
- Client records and invoices: 6 years after the end of the financial year they relate to, for tax purposes.
Your rights
You have the right to ask for a copy of your personal information, to have it corrected or deleted, to restrict or object to how we use it (including an absolute right to object to direct marketing), and to data portability where it applies. To make a request, email info@securityrisksystems.co.uk. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
Changes to this notice
We will update this notice if how we use personal information changes, for example if we add a contact form, a booking tool or analytics. The version and date at the top show the current notice.