Privacy Notice - AsherLodge

Introduction

AsherLodge Ltd (“AsherLodge”, “we”, “us” or “our”) is a cleaning and facilities management company. We take the protection of personal data seriously. This privacy notice explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have. It applies to our customers and their staff and site contacts, people who enquire about our services, visitors to our website, our suppliers and business contacts, and job applicants and staff.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), each as amended from time to time, including by the Data (Use and Access) Act 2025 (DUAA). The DUAA amendments are being brought into force in stages; where this notice refers to them, it reflects them as they apply to us.

Where we collect personal data directly from you, we will normally give you this notice (or a link to it) at that time. Where we obtain your personal data from someone else (for example, from your employer when you are a contact at one of our customer sites), we will provide this information within a reasonable period and at the latest within one month, or when we first contact you, unless an exemption applies.

If you have any questions about this notice, please contact us using the details in section 3.

Definitions

This notice uses the terms defined in Article 4 of the UK GDPR. In plain English:

Personal data: any information relating to an identified or identifiable living individual, for example a name, an identification number, location data, an online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Data subject: the individual the personal data is about (“you”).
Processing: anything done with personal data, whether or not by automated means, such as collecting, recording, organising, storing, adapting, retrieving, consulting, using, disclosing, combining, restricting, erasing or destroying it.
Controller: the person or organisation that, alone or jointly with others, decides why and how personal data is processed. AsherLodge is the controller of the personal data described in this notice.
Processor: a person or organisation that processes personal data on behalf of a controller (for example, an IT or payroll service provider acting on our instructions).
Recipient: a person or organisation to whom personal data is disclosed, whether a third party or not. Public authorities that receive personal data as part of a particular inquiry in accordance with law are not regarded as recipients.
Third party: anyone other than you, us, our processors and people authorised to process personal data under our or our processors’ direct authority.
Special category data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data used to identify a person; data concerning health; and data concerning a person’s sex life or sexual orientation.
Criminal offence data: personal data relating to criminal convictions and offences or related security measures.
Restriction of processing: marking stored personal data so that its future processing is limited.
Profiling: any automated processing of personal data to evaluate personal aspects of an individual, in particular to analyse or predict their performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Consent: any freely given, specific, informed and unambiguous indication of your wishes, by a statement or clear affirmative action, by which you agree to the processing of your personal data.

Name and Address of Controller

The controller is:

AsherLodge Ltd
Company number: 13867143 (registered in England and Wales)
Registered office: 13 Newmarket Drive, Preston PR4 0FB
Email: info@asherlodge.uk
Website: https://www.asherlodge.uk

Data Protection Officer

AsherLodge is a small organisation. We are not a public authority, and our core activities do not involve regular and systematic monitoring of individuals on a large scale or large-scale processing of special category or criminal offence data. We are therefore not legally required to appoint a Data Protection Officer (DPO) under Article 37 of the UK GDPR, and we have not appointed one.

For any data protection question, or to exercise your rights, please contact us at info@asherlodge.uk or by post to our registered office address (see section 3), marked “Data Protection”.

Name and Address of Supervisory Authority

The UK supervisory authority for data protection is the Information Commission. Its contact details are:

Information Commission
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester M1 7BL
Helpline: 0303 123 1113
Website: https://ico.org.uk

Please see section 18 for how to make a complaint, including asking us to put things right first.

Cookies

Our website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit a website. Some are needed for the website to work; others help us understand how the website is used or remember your preferences.

Under PECR (as amended by the DUAA), we must ask for your consent before placing cookies on your device unless an exemption applies. Exemptions include cookies that are:

strictly necessary to provide the website or a service you have requested, or for security or fraud prevention;
used only to collect statistical (analytics) information about how our website is used so that we can improve it, provided we give you clear information about them and a simple, free way to object (opt out);
used only to adapt the appearance or functionality of the website to your preferences, or to remember choices you have made, again provided you are given clear information and a simple way to object.

We will ask for your consent before setting any other non-essential cookies (for example, advertising or third-party tracking cookies). You can withdraw your consent or object at any time via cookie settings link/banner. You can also block or delete cookies through your browser settings; if you do, some parts of the website may not work properly.

Details of the cookies we use, their purpose and how long they last are set out in our Cookie Notice. You can also contact us at info@asherlodge.uk.

Reasons/purposes for processing information

We process personal data so that we can provide cleaning and facilities management services to our customers, respond to enquiries, promote our services, manage our suppliers, keep our accounts and records, meet our legal obligations, and recruit, employ and manage our staff. The specific lawful basis for each purpose is set out in section 9.

Whose personal data we process

Customers, and staff, site contacts and key-holders at customer premises
People who enquire about our services, and complainants
Website visitors
Suppliers, subcontractors and their staff
Professional advisers and other business contacts
Job applicants, current and former employees and workers/contractors

Types of personal data we process

Identity and contact details (e.g. name, job title, address, email address, telephone number)
Information about the services we provide, including site addresses, access arrangements and service records [and key-holding/alarm code information – confirm if applicable]
Financial and payment details (e.g. invoices, bank details for suppliers and staff)
Correspondence and records of enquiries and complaints
Technical information when you visit our website (e.g. IP address, browser type and operating system), subject to section 6
For job applicants and staff: application and CV details, references, qualifications and training records, right-to-work documents, employment and payroll records, absence records and performance information

Special category and criminal offence data

We only process special category data or criminal offence data where it is necessary and the law allows it. This may include [health information about staff, e.g. sickness absence, fitness for work and reasonable adjustments] [and criminal record (DBS) check information where a role requires it, e.g. work at certain customer sites – confirm if applicable]. See section 9 for the conditions we rely on.

Where we get personal data from

Directly from you (e.g. when you complete a form, email or call us, or apply for a job)
From your employer or organisation (e.g. where you are a site contact or key-holder at a customer, or a contact at a supplier)
Automatically when you use our website (e.g. IP address and device information), subject to section 6
From publicly available sources (e.g. Companies House and organisations’ websites)
From professional social media (e.g. LinkedIn) [confirm if applicable]
For job applicants: from recruitment agencies, referees, previous employers [and the Disclosure and Barring Service, where applicable]

Who we share personal data with

We only share personal data where necessary and lawful. Where we use processors, they act on our instructions under a written contract that meets the requirements of Article 28 UK GDPR. Recipients may include:

Our customers (e.g. names of cleaning staff attending a site, where needed for site access and security)
Subcontractors and suppliers who help us deliver our services
IT, software, cloud storage and communications providers
Our accountants, payroll provider, pension provider, insurers, banks and legal and professional advisers
HMRC, the police, courts, regulators and other public authorities, where we are required or permitted by law to share information
A prospective buyer or successor of our business, if the business (or part of it) is sold or reorganised, subject to confidentiality safeguards

We do not sell personal data.

Rights of the data subject

Under the UK GDPR you have the following rights. Some rights apply only in certain circumstances and are subject to exemptions in the DPA 2018. To exercise any right, contact us at info@asherlodge.uk or write to us at our registered office address (see section 3).

Right to be informed: to receive clear information about how we use your personal data. This notice is part of how we meet that right.
Right of access (subject access request): to confirm whether we process your personal data and to receive a copy of it, together with information about how it is used, who it is shared with, how long it is kept, where it came from, and the safeguards for any international transfer.
Right to rectification: to have inaccurate personal data corrected and incomplete data completed, including by providing a supplementary statement.
Right to erasure (“right to be forgotten”): to have your personal data erased where, for example, it is no longer needed, you withdraw consent, or you successfully object. This right does not apply where we need to keep the data, for example to comply with a legal obligation or to establish, exercise or defend legal claims.
Right to restriction of processing: to ask us to limit how we use your personal data, for example while we check its accuracy or consider an objection.
Right to data portability: to receive personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means.
Right to object: to object, on grounds relating to your particular situation, to processing based on legitimate interests (including recognised legitimate interests). We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for legal claims. You have an absolute right to object to direct marketing, at any time and free of charge.
Rights relating to automated decision-making: where a significant decision about you is based solely on automated processing, you have the right to information about it, to make representations, to obtain human intervention and to contest the decision (see section 16).
Right to withdraw consent: where we rely on your consent, you may withdraw it at any time by contacting us at info@asherlodge.uk [or by using the unsubscribe link in our emails]. This does not affect the lawfulness of processing before withdrawal.
Right to complain: to complain to us and to the Information Commission (see section 18).

How we handle your requests

We will respond without undue delay and within one month of receiving your request. We may extend this by up to two further months if a request is complex or you have made a number of requests; if so, we will tell you within the first month and explain why.
We may need to ask you for information to confirm your identity. The time limit starts when we receive that information.
If we reasonably need more information to identify the information or processing your request relates to (for example, if we hold a large amount of information about you), we may ask you to clarify your request. The time limit is paused until we receive your clarification (“stopping the clock”).
When responding to a subject access request, we will carry out reasonable and proportionate searches for your personal data.
We do not normally charge a fee. If a request is manifestly unfounded or excessive (for example, repetitive), we may charge a reasonable fee based on our administrative costs or refuse to act on the request; if so, we will explain why and tell you about your right to complain.
We may withhold some information where an exemption in the DPA 2018 applies (for example, where disclosure would reveal information about another person, or information covered by legal professional privilege). We will tell you if we do so, unless that would undermine the purpose of the exemption.

Legal basis for processing

We must have a lawful basis under Article 6 UK GDPR for each use of personal data. The bases we rely on are:

Contract (Art 6(1)(b)): processing is necessary for a contract with you, or to take steps at your request before entering into a contract.
Legal obligation (Art 6(1)(c)): processing is necessary to comply with the law (e.g. tax, employment, health and safety and right-to-work rules).
Legitimate interests (Art 6(1)(f)): processing is necessary for our (or a third party’s) legitimate interests, and those interests are not overridden by your interests, rights and freedoms (see section 10).
Recognised legitimate interests (Art 6(1)(ea)): processing is necessary for one of the specific purposes listed in Annex 1 to the UK GDPR, such as responding to an emergency, detecting, investigating or preventing crime, or safeguarding vulnerable individuals (see section 10).
Consent (Art 6(1)(a)): you have given consent for a specific purpose, e.g. certain marketing emails or non-essential cookies.
Vital interests (Art 6(1)(d)): rarely, processing is necessary to protect someone’s life, e.g. in a medical emergency.

We do not carry out tasks in the public interest or in the exercise of official authority, so we do not rely on Article 6(1)(e).

Purpose	Examples of personal data	Lawful basis
Providing cleaning and facilities management services, including site access and service records	Contact details of customers and site contacts; site and access information	Contract (where the customer is an individual); legitimate interests (where you are a contact at a business customer): to deliver and manage our services
Responding to enquiries and preparing quotes	Name, contact details, details of the enquiry	Steps prior to a contract; legitimate interests: to respond to business enquiries
Invoicing, payments, accounts and tax	Name, contact and financial details	Contract; legal obligation (tax and company law)
Managing suppliers and subcontractors	Contact details of supplier staff, payment details	Contract; legitimate interests: to manage our supply chain
Marketing our services	Name, business contact details, marketing preferences	Legitimate interests (business contacts and existing customers, subject to PECR); consent where PECR requires it
Running our website, including analytics	IP address, device information, cookie data	Legitimate interests; consent for non-essential cookies (see section 6)
Handling complaints and data protection requests	Contact details, correspondence	Legal obligation; legitimate interests: to resolve complaints
Recruitment	CV, application details, references, right-to-work documents	Steps prior to a contract; legal obligation (right-to-work checks); legitimate interests: to select suitable candidates
Employing and managing staff, payroll and pensions	Employment, payroll, absence and training records	Contract; legal obligation (e.g. tax, national minimum wage, pension auto-enrolment, health and safety)
IT and information security	Device and access logs	Legitimate interests: keeping our systems secure
Establishing, exercising or defending legal claims; insurance	Relevant records	Legitimate interests; legal obligation where applicable
Disclosures to the police or other authorities for crime prevention or detection, safeguarding or emergencies	Relevant records	Recognised legitimate interests (Art 6(1)(ea)); legal obligation where we are legally required to disclose

Special category and criminal offence data: where we process this data, we also rely on a condition in Article 9 UK GDPR (for special category data) or Article 10 UK GDPR (for criminal offence data), together with a condition in Schedule 1 to the DPA 2018 – for example, where processing is necessary to meet our obligations in employment law, or for establishing, exercising or defending legal claims. Where the DPA 2018 requires it, we keep an appropriate policy document.

The Legitimate interests pursued by the Controller or by a Third Party

Where we rely on legitimate interests (Art 6(1)(f)), our interests are: running and developing our cleaning and facilities management business; delivering and managing services for our customers; communicating with business contacts; marketing our services; managing our suppliers; keeping our systems and premises secure; and establishing, exercising or defending legal claims. The UK GDPR (as amended by the DUAA) recognises that direct marketing, sharing data within a group of businesses for internal administrative purposes, and ensuring the security of network and information systems are examples of processing that may be carried out for legitimate interests. In each case we weigh our interests against your interests, rights and freedoms and only proceed where our interests are not overridden. You can ask us for more information about this balancing assessment.

Recognised legitimate interests (Art 6(1)(ea)): the DUAA introduced a set of “recognised legitimate interests” listed in Annex 1 to the UK GDPR. For these purposes, the law does not require us to carry out the usual balancing test. They include disclosures needed to respond to a request from a public body for its public tasks, for national security, public security or defence, for responding to emergencies, for detecting, investigating or preventing crime (or apprehending or prosecuting offenders), and for safeguarding vulnerable individuals. Relying on a recognised legitimate interest is optional: we may use it only where it genuinely applies, and we may instead rely on another lawful basis. Where we rely on it, processing must still be necessary for that purpose and comply with all other data protection requirements, and you keep your right to object.

Using Personal Data for New Purposes

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose that is compatible with the original one. When deciding whether a new purpose is compatible, we consider factors such as the link between the purposes, the context in which the data was collected, the nature of the data, the possible consequences for you and the safeguards in place.

Under the UK GDPR (as amended by the DUAA), some further purposes are treated as compatible, for example where processing is necessary to comply with a legal obligation, to respond to an emergency, to protect someone’s vital interests, to detect, investigate or prevent crime, or for safeguarding purposes. We may also use your personal data for a new purpose where you have consented.

If we intend to use your personal data for a new purpose, we will tell you about it beforehand where the law requires us to do so.

Security of Processing

We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include password-protected devices and accounts, multi-factor authentication, access controls limiting data to staff who need it, secure storage and staff training. Our processors must also keep personal data secure.

No method of transmission or storage is completely secure. If you have concerns about sending us information by a particular method (for example, email), please contact us and we will try to offer an alternative. If a personal data breach occurs, we will act in line with our legal obligations, including notifying the Information Commission and you where required.

Transfers

[We do not normally transfer personal data outside the UK.] Some of our service providers (for example, IT and cloud storage providers) may store or access personal data outside the UK. [Confirm whether any providers are based or store data outside the UK, and where.]

Where personal data is transferred outside the UK, we will make sure it is protected in accordance with Chapter V of the UK GDPR, by:

transferring it to a country or organisation that the UK Government has approved as providing an adequate level of protection (for example, the European Economic Area, or US organisations certified under the UK Extension to the EU-US Data Privacy Framework); or
using appropriate safeguards, such as the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, together with any additional measures needed; or
relying on a specific exception allowed by law, where appropriate.

You can contact us for more information about the safeguards we use, or to obtain a copy of them.

Personal Data Retention Periods

We keep personal data for no longer than is necessary for the purposes for which we collected it. How long we keep it depends on those purposes and on any legal or contractual requirements, for example tax, accounting and employment record-keeping rules, our contracts with customers and suppliers, and the time limits for bringing or defending legal claims (limitation periods). When deciding how long to keep data, we also consider its amount, nature and sensitivity and the risk of harm from unauthorised use or disclosure.

At the end of the relevant period, we securely delete or destroy the data or anonymise it so that it can no longer identify you. Details of our retention periods are available on request by emailing info@asherlodge.uk.

Contractual or statutory requirement to provide personal data, and the consequences of not providing it

Some of the personal data we ask for is required by law (for example, information needed for tax, payroll and right-to-work checks), and some is needed to enter into or perform a contract (for example, contact and site details needed to deliver our services). We will tell you when information is mandatory. If you do not provide it, we may not be able to enter into or perform a contract with you (or your organisation), employ you, or comply with our legal obligations. Where information is optional, not providing it will not affect our services to you.

Automated decision-making & Profiling

We do not currently make decisions about you based solely on automated processing (that is, without meaningful human involvement), including profiling, that have legal or similarly significant effects on you.

If this changes, we will tell you beforehand and will only do so where the UK GDPR (as amended by the DUAA) allows it. We will put safeguards in place, including giving you information about the decision, and enabling you to make representations, to obtain human intervention and to contest the decision. Such decisions based on special category data will only be made with your explicit consent or where another strict legal condition applies.

Data protection for Employment & Recruitment Procedures

We collect and process the personal data of job applicants to manage our recruitment process. This may be done electronically, for example where an application is submitted by email or through a form on our website. Our lawful bases are taking steps at your request before entering into an employment contract, our legal obligations (including checking your right to work in the UK) and our legitimate interest in selecting suitable candidates.

If we offer you a job and you accept, the data you provided will become part of your personnel record and will be used to manage your employment.

If your application is unsuccessful, we will keep your application data for 3 months after we tell you of our decision, so that we can respond to any questions or legal claims (for example, under the Equality Act 2010), and then securely delete it. If we would like to keep your details on file for future vacancies, we will ask for your consent.

Complaints

If you are unhappy with how we have handled your personal data, or think we have not complied with data protection law, please tell us first so that we can try to put things right. You can complain to us:

by email to info@asherlodge.uk

We will acknowledge your complaint within 30 days of receiving it. We will then, without undue delay, look into it, keep you informed of progress and tell you the outcome.

If you are not satisfied with our response, or if we do not respond, you can complain to the Information Commission, using the contact details in section 5 or online at https://ico.org.uk/make-a-complaint. The Information Commission will usually expect you to have raised your complaint with us first. You may also have the right to seek a remedy through the courts.

Changes to this notice

We keep this notice under regular review and will update it to reflect changes in the law or in how we process personal data. The latest version will always be available on our website/on request. Where changes are significant, we will take reasonable steps to tell you. If we plan to use your personal data for a new purpose, we will act in line with section 11.

This notice was last updated: October 2026