---

How We Use Your Information

We will only use information you provide us as necessary for the purposes of the services we provide to you and to keep our own records up to date. We treat all personal information we hold about our clients or prospective clients as private and confidential.

We do not send mailouts to clients and we will never pass client personal details onto third parties nor reveal details concerning your accounts with us to anyone not connected with Martin Structural Engineers Limited unless:

• You ask us to reveal the information, or we have your permission to do so; or
• We are required or permitted to do so by law and where the appropriate court order or warrant has been provided; or
• It is required by law enforcement, fraud prevention or similar agencies who have provided the appropriate court order or warrant; or
• There is a duty to the public to reveal the information (e.g., to government bodies, tax authorities, or regulatory bodies).

If you give us information about another person, you need to confirm that you have been appointed to act on behalf of that other person. This includes providing consent to process that other person’s data.

We primarily process data within the UK. If personal data is transferred outside the UK or the European Economic Area (EEA), we ensure appropriate safeguards (such as Standard Contractual Clauses or UK International Data Transfer Agreements) are put in place in compliance with UK GDPR requirements.

Card payments are processed using Stripe’s online portal. Credit and/or debit card details are not written down, and any details taken will be immediately destroyed once processed. We do not hold financial details for longer than necessary.

We will only hold personal data which is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. We will only collect, hold, and process personal data that is needed to provide our services to you. Any personal data which is no longer needed will be archived in secure storage or deleted in accordance with company guidelines.

Our company guidelines include policies and procedures to ensure personal data is kept confidential, archived securely, and deleted after a reasonable time from completion of the services provided (typically retaining client records for up to 6 to 12 years to comply with legal, accounting, and professional indemnity insurance requirements), unless the law requires such data to be kept for a different timeframe.

Your Data Subject Rights

Under the UK GDPR, you have several rights regarding your personal data:

• Right to Information & Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): You can request the deletion of your data where there is no legal requirement for us to retain it.
• Right to Restrict Processing & Object: You may object to or request restrictions on how we process your personal data.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used format.

Supervisory Authority

You have the right to lodge a complaint at any time with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.