This notice explains how Varma Construction Logistics Ltd (“Varma”, “we”, “us”) collects and uses personal data when you visit varma-logistics.co.uk, send us a project enquiry or register to work with us. We are the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Varma Construction Logistics Ltd is a company registered in England and Wales, company number 13805919. Our registered office is Amber House, Upper Boat Business Centre, Pontypridd, CF37 5BP.
Our data protection contact is Ed Dobbs: ed@varma-logistics.co.uk or 07919 483 558.
What we collect
- Project enquiry form (on our home page): your name, company and email address, and — if you choose to give them — your phone number, the site or location, a preferred start date and your message.
- Worker registration form (our “Register for work” page): your first and last name, date of birth, National Insurance number, phone number, home address and postcode, and job title or trade; your email address and start date if you give them; your emergency contact’s name, relationship and phone number(s); your CSCS card number and expiry date and any other certifications you list; and the acknowledgements and declarations you tick.
- Documents you send after registering: photos of your passport or birth certificate, proof of your National Insurance number, and your CSCS card or qualifications. These come to us by WhatsApp or email, not through this website.
- When you browse: our host keeps standard server logs (IP address, browser, pages requested and time) for security. This website does not use analytics or tracking — see our cookie notice.
If you give us an emergency contact’s details, please let them know. We only use them to reach that person if you are hurt or unwell on site.
We do not ask for health information or other special category data through this website. Your passport or birth certificate shows your nationality and photograph; we use it only for right-to-work checks.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Replying to your project enquiry | Legitimate interests — answering businesses that contact us (Art 6(1)(f)) |
| Quoting for and delivering work for your company | Contract, or steps before one (Art 6(1)(b)) |
| Registering you for work and managing your assignment, site access and conduct | Steps before, and performance of, the arrangement under which you work with us (Art 6(1)(b)); legitimate interests in running safe, well-managed sites (Art 6(1)(f)) |
| Right-to-work checks, health and safety, and our other legal duties | Legal obligation (Art 6(1)(c)) |
| Contacting your emergency contact | Legitimate interests (Art 6(1)(f)), or vital interests in an emergency (Art 6(1)(d)) |
| Keeping accounts and invoices | Legal obligation (Art 6(1)(c)) |
We do not sell your data, and we do not use it for advertising or marketing.
Who we share it with
Only the organisations below, and only what each needs. Service providers act on our instructions.
- Studio 72 Cardiff Ltd — our web developer, which builds and hosts this website for us.
- Vercel Inc. — website hosting and server logs.
- FormSubmit (formsubmit.co, operated by Devro LABS) — forwards what you type into our enquiry and registration forms to our inbox by email.
- Microsoft (Microsoft 365) — our email service, where enquiries, registrations and emailed documents arrive.
- Google (Google Fonts) — delivers the typeface this website uses; your browser fetches it from Google, which receives your IP address.
- WhatsApp (Meta) — only if you choose to send us your documents by WhatsApp.
- Rise Contracting Services Ltd — if you work with us, Rise handles your contract, pay, tax and payroll and receives the details it needs to do that. Rise is responsible for that processing.
- Our workforce compliance system — we keep the compliance records of people who work with us in a system run for us by Studio 72 Cardiff Ltd. It has its own privacy notice.
- Public bodies, such as the Home Office or HMRC, where the law requires it.
International transfers
Some of these providers process data outside the UK, mainly in the USA. Where they do, we rely on the UK–US data bridge, UK adequacy regulations or the ICO’s international data transfer agreement or addendum to keep it protected to UK standards.
How long we keep it
- Project enquiries that don’t become work: 2 years from our last contact, then deleted.
- Registrations from people who don’t go on to work with us: 2 years from our last contact, then deleted.
- If you work with us: for as long as you work with us and for a period after you leave, as right-to-work rules and our other legal duties require.
- Client records and invoices: 6 years after the end of the financial year they relate to, as HMRC requires.
- Server logs: kept by our host for a short period for security.
Your rights
You can ask us to: see the data we hold about you; correct it; delete it; restrict or object to how we use it; and give it to you in a portable format. Email ed@varma-logistics.co.uk — we reply within one month.
No decisions are made about you by automated means.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes
We’ll update this notice when how we use data changes. The date at the top shows the latest version. See also our cookie notice.