Company Policies 

Data Protection and Privacy Policy (June 2022)

Here at Gallyon Gun and Rifle Makers Ltd [Gallyon] we take the privacy of our clients, contacts, and employees very seriously. We are also committed to maintaining the trust and confidence of our visitors to our website. The Company is committed to being transparent about how it collects and uses data and to meeting its GDPR and data protection obligations. We want you to know that we are not in the business of selling, renting, or trading email lists with other companies and businesses for marketing purposes.

Do read on for more detail and of course please contact us if anything is unclear, or if you have a specific query about the detail of the data we hold.

Introduction: This policy (“Privacy Policy”) applies to information collected and used by Gallyon relating to our existing and potential clients, employed staff and contract workers. This Privacy Policy assures you that no information is given to any third-party without your express permission. Any information we collect is confidential and by agreeing to our terms of business or employment contracts you are accepting the terms described in this Privacy Policy.

Please take a moment to familiarise yourself with our privacy practices and please contact Gallyon if you have any questions.

Types of Information: We Collect Client Information, and we collect information to deliver the services that our clients request. Some information that we collect can be used to identify you or can be reasonably used in connection with other information to identify you. This information is called “personal information” and may include your name, postal address, email address, phone number.

Employee Information: Statutory and operational information regarding employees is kept as outlined in Appendix 1 below, which should be read in detail by anyone seeking or currently employed by Gallyon.

Digital contacts: Gallyon Ltd only collects information about website users through forms that you fill in requesting a response from us and so it is presumed that this information is given with your consent in line with this policy.

When someone visits our website, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts / pages of the website. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

Our website uses cookies, Cookies are small text files that are placed on your machine to help the site provide a better user experience. Our cookies do not gather personal information but may store an identifying piece of information such as an IP address.

In general, cookies are used to retain user preferences, store information for things like shopping baskets, and provide anonymised tracking data to third party applications like Google Analytics. As a rule, cookies will make your browsing experience better. However, you may prefer to disable cookies on our website. The most effective way to do this is to disable cookies in your browser. We suggest consulting the Help section of your internet browser with this action.

How We Use Your Information: Gallyon uses the personal information that we collect about you or that you provide in conversation or meetings to inform the delivery of our work and to maintain contact with you regarding specific projects or pieces of work we undertake with you. We will also make occasional contact with you supplying information that we consider will be relevant and useful to you and to meet out regulatory obligations as a service provider, a limited company, and a responsible employer.

Information Sharing: Gallyon does not sell your personal information to third parties. However, we will disclose some of the personal information that we collect with your permission which are relevant to the delivery of agreed projects and business activity.

Your personal information may also be disclosed to comply with any court order, law or legal process, or government or regulatory request, or if we believe that disclosure is necessary or appropriate to protect the rights, property, or safety of Gallyon, our clients or staff.

On occasions we may be asked by a client to engage with contacts that they provide to us. In this circumstance, the information will only be used for the client’s express purposes, and it is deemed that we are acting on their behalf with consent to make contact. Any such contact will include an “opt-out” link if you would prefer not to be contacted again.

Accessing Your Information: At any time, you can review and change your personal information by emailing adam.anthony@gallyon.com.

Information other than that which we must collect under statutory and regulatory duties, can also be deleted on request.

Information Security: Gallyon has implemented measures designed to secure your personal information from accidental loss and from unauthorised access, use, alteration, and disclosure. Gallyon stores and processes your personal information on its computers and servers in the United Kingdom. We protect your personal information by maintaining physical, electronic, and procedural safeguards in compliance with applicable UK and EU regulations. Gallyon also uses computer safeguards such as firewalls to protect your information. Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee the absolute security of your information.

Social Media Advertising: Gallyon use our own website, Facebook, Instagram, LinkedIn, and Twitter to maintain a business profile and will identify clients on occasion unless specifically requested not to in writing. Images and names of employees may be used, with the consent of employees. Third Party Links: The Gallyon website may contain links to other websites that are Trusted Partners but not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly recommend that you review the Privacy Policy of each site you visit. Gallyon does not control, and assumes no responsibility for the content, privacy policies or practices of any third-party sites or services.

Email Communications: As part of Gallyon’s general communication process we produce and distribute an e-newsletter to tell you about issues relevant to your relationship with us; to contact you if we need to obtain or provide additional information; to check our records are right and to check every now and then that you’re happy and satisfied. We don’t rent or trade email lists with other organisations and businesses and you can choose to opt out of receiving this type of occasional email.

Gallyon use a third-party provider, Hubspot, to deliver our newsletter. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our enewsletter.

For more information, please see Hubspot privacy notice. You can unsubscribe to general mailings at any time of the day or night by clicking the unsubscribe link at the bottom of any of our emails or by emailing adam.anthony@gallyon.com

Gallyon does not knowingly collect or maintain personal information from, children under the age of 16. If we learn that we have collected or received personal information from a child under the age of 16 without verification of parental consent, we will delete that information.

Changes to This Privacy Policy: This Privacy Policy is subject to change and the updated Privacy Policy will be posted on our website. This Privacy Policy was last updated as of the date provided above [June 2022]. Continued use of Gallyon services after a revised Privacy Policy signifies your acceptance of the revised Privacy Policy. Please check back frequently and review the Privacy Policy for any updated terms or changes.

Contact Us: If you have any questions or comments regarding this Privacy Policy, please do not hesitate to contact Gallyon. adam.anthony@gallyon.com

Appendix 1 Additional Information for Employees

What information does the Company keep relating to employees

The Company collects and processes a range of information about you.

This includes:

• your name, address, and contact details, including email address and telephone number, date of birth and gender.

• the terms and conditions of your employment.

• details of your qualifications, skills, experience, and employment history, including start and end dates, with previous employers and with the Company.

• information about your remuneration, including entitlement to benefits such as pensions or insurance cover.

• details of your bank account and national insurance number.

• information about your marital status, next of kin, dependants, and emergency contacts.

• information about your nationality and entitlement to work in the UK.

• information about your criminal record.

• details of your schedule (days of work and working hours) and attendance at work.

• information relation to any flexible working requests you have made, including notes of meetings and all related correspondence.

• details of periods of leave taken by you, including holiday, sickness absence, family leave, jury service and sabbaticals, and the reasons for the leave.

• details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence.

• assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence.

• information about medical or health conditions, including whether you have a disability for which the Company needs to make reasonable adjustments; and

• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

The Company collects this information in a variety of ways. For example, data is collected through application forms, CVs, or resumes, and as obtained from your passport or other identity documents such as your driving licence, or forms completed by you at the start of or during employment (such as benefit nomination forms), and from correspondence with you or through interviews, meetings or other assessments.

In some cases, the Company collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from criminal records checks permitted by law.

Data is stored in a range of different places, including in your personnel file, in the Company's HR management systems and in other IT systems (including the Company's email system).

Why does the Company process personal data?

The Company needs to process data to enter an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer any benefits, pension, and insurance entitlements.

In some cases, the Company needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question.

In other cases, the Company has a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows the Company to list the appropriate points and expand on them as necessary:

• run recruitment and selection and other promotion processes.

• maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights.

• operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace.

• operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes.

• operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled.

• obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled.

• operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the Company complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled.

• ensure effective general HR and business administration • provide references on request for current or former employees.

• respond to and defend against legal claims; and

• maintain and promote equality in the workplace.

Where the Company relies on legitimate interests as a reason for processing data, it has considered whether those interests are overridden by the rights and freedoms of employees or workers and has concluded that they are not.

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities and for health and safety purposes).

Where the Company processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring.

Who has access to employee data? Your information will be shared internally, including with those involved in recruitment on behalf of the Company, the Head of Company, your line manager, and other managers, HR staff/advisors, and IT staff/advisors. The information will only be shared with these people where access to the data is necessary for performance of their roles. The Company shares your data with third parties to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain any further employment checks. The Company may also share your data with third parties in the context of a sale of some or all its business. In those circumstances the data will be subject to confidentiality arrangements.

The Company also shares your data with third parties that process data on its behalf, in connection with payroll, the provision of benefits and/or pensions and the provision of occupational health services. The Company will not transfer your data to countries outside the European Economic Area

For how long does the Company keep employee data?

The Company will hold your personal data for the duration of your employment. The periods for which your data is held after the end of employment are set out in the Company’s Data Protection Policy. Your rights As a data subject, you have several rights.

You can:

• access and obtain a copy of your data on request.

• require the Company to change incorrect or incomplete data.

• require the Company to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing.

• object to the processing of your data where the Company is relying on its legitimate interests as the legal ground for processing; and

• ask the Company to stop processing data for a period if data is inaccurate or there is a dispute about whether your interests override the Company's legitimate grounds for processing data. If you would like to exercise any of these rights, please contact Adam Anthony – adam.anthony@gallyon.com

If you believe that the Company has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You have obligations under your employment contract to provide the Company with data.

You are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the Company with data to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details, must be provided to enable the Company to enter a contract of employment with you. If you do not provide other information, this will hinder the Company's ability to administer the rights and obligations arising because of the employment relationship efficiently.

Automated decision-making

Employment decisions are not based solely on automated decision-making.