Privacy Policy

1. Introduction

Highly Tactical British Security Ltd ("HTBS", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website at www.highlytactical.co.uk or engage our security services.

HTBS is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) and take our obligations under data protection law seriously.

Please read this policy carefully. If you have any questions about how we handle your data, please contact us using the details at the end of this document.

2. Information We Collect

Personal Data You Provide to Us

We may collect the following categories of personal information when you enquire about or engage our services:

• Full name, job title, and company name
• Contact details: email address, phone number, and postal address
• Identity documents for staff vetting and DBS check processes
• Employment history, references, and professional qualifications (for personnel records)
• Financial information for billing and contract administration
• Security-related information necessary for site assessments and service delivery
• Communications you send to us, including enquiry forms and correspondence

Technical Data Collected Automatically

When you visit our website, we may automatically collect:

• Your IP address and approximate geographical location
• Browser type, version, and operating system
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers (see our Cookie Policy for details)
• Device information and screen resolution

3. How We Use Your Information

We use the personal data we collect for the following purposes:

• Delivering and managing our security services under contract
• Responding to your enquiries, quotes, and service requests
• Conducting security vetting and DBS checks for personnel
• Fulfilling our legal and regulatory obligations as an SIA Approved Contractor
• Processing payments and managing billing relationships
• Sending service-related communications and operational updates
• Improving our website and service offerings through analytics
• Marketing our services to you where you have consented or where we have a legitimate interest
• Maintaining records required for insurance, compliance, and audit purposes

4. Legal Basis for Processing

We rely on the following lawful bases under UK GDPR Article 6 for processing your personal data:

• Contractual necessity — processing required to perform our security services contract with you
• Legal obligation — processing required to comply with SIA regulatory requirements, GDPR, employment law, and other applicable legislation
• Legitimate interests — processing for our legitimate business interests, including security monitoring, fraud prevention, and service improvement, where these are not overridden by your rights
• Consent — where you have given explicit consent, for example for marketing communications or optional cookies

For special category data (such as DBS check results), we rely on UK GDPR Article 9(2)(b) — processing necessary for employment law obligations — and Article 9(2)(g) — substantial public interest.

5. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We may share your data with trusted third parties only where necessary and under appropriate data processing agreements, including:

• Staff vetting and background check agencies (for DBS and identity verification)
• The Security Industry Authority (SIA) for regulatory compliance purposes
• Insurance providers for the administration of our professional liability policies
• IT service providers, cloud hosting providers, and our website platform (all UK/EEA-based or with adequate safeguards)
• Professional advisers including solicitors and accountants
• Law enforcement agencies or regulatory authorities where required by law or court order

All third-party processors are required to handle your data securely and in accordance with our instructions and applicable data protection law.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Our standard retention periods are:

• Client and contract data: 7 years following the end of the contractual relationship
• CCTV footage: 31 days as standard, unless required for an ongoing investigation
• Employee and personnel records: 6 years following the end of employment
• Enquiry and website contact data: 2 years from the date of enquiry
• Financial and billing records: 7 years in accordance with HMRC requirements
• Marketing consent records: Until consent is withdrawn

After the applicable retention period, data is securely deleted or anonymised in accordance with our data destruction procedures.

7. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your data (the "right to be forgotten") in certain circumstances
• Right to restriction — to request that we restrict processing of your data in certain circumstances
• Right to data portability — to receive your data in a structured, commonly used format
• Right to object — to object to processing based on legitimate interests or direct marketing
• Right to withdraw consent — to withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact our Data Protection Officer at dpo@highlytactical.co.uk or call +44 7743 038934. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk if you believe your data has been processed unlawfully.

8. Cookies

Our website uses cookies to improve your browsing experience and analyse site performance. For full information about the cookies we use, how we use them, and how to manage your preferences, please see our Cookie Policy.

9. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These include:

• AES-256 encryption for data at rest and TLS for data in transit
• Role-based access controls and multi-factor authentication
• Regular penetration testing and security audits by independent third parties
• Staff training on data protection and information security
• Physical security controls for premises and equipment
• Documented incident response and data breach notification procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you without undue delay.

10. International Transfers

We do not routinely transfer your personal data outside the United Kingdom or the European Economic Area. In the event that any transfer is necessary, we will only do so where adequate safeguards are in place, such as the use of standard contractual clauses approved by the ICO, or where the destination country has been deemed to provide an adequate level of data protection.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page. We may also notify you directly where required by law. We encourage you to review this policy periodically.

12. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact: