Privacy Statement

Introduction

Sentinel Construction Compliance (Jersey) Ltd (known as 'Sentinel ') is the data controller for your personal information. We are registered with the Jersey Office of the Information Commissioner under registration number 71166. This privacy notice explains how we collect, use, and protect your personal data in accordance with the Data Protection (Jersey) Law 2018.

The Data Protection Manager ("DPM")

We have appointed a Data Protection Manager to oversee our compliance with data protection law and to assist with any data protection queries or concerns you may have.

Data Protection Manager
Email: dataprotection@trilliumgroup.je

You can contact the DPM at any time if you have questions about how we handle your personal data or if you wish to exercise any of your rights.

The Kind of Information We Hold About You

Sentinel collects and processes personal data about individuals in connection with the delivery of our services. This includes data about clients, contacts at client organisations, site personnel, and other individuals with whom we interact in the course of our business.

We only collect the information necessary to provide our services, meet our contractual obligations, and comply with legal and regulatory requirements.

How Is Your Personal Information Collected?

We collect your personal information in a number of ways:

• Directly from you, when you contact us, request our services, or complete forms or applications
• From your employer or organisation, when they engage us to provide various services
• From third parties such as regulatory bodies, health and safety authorities, or other professional advisers
• Automatically through your use of our website or systems (for example, via cookies or server logs)
• From publicly available sources, where this is necessary to verify information or to comply with legal obligations

What Information Do We Collect About You?

The categories of personal data we collect depend on the nature of our relationship with you and the services we provide. The table below sets out the main categories of information we hold:

Special Category Data

When providing our services, we may process sensitive information, including health, medical, injury and occupational health information, photographs of injuries and details contained in accident or incident records.

We will only process this information where we have a lawful basis and an applicable condition for processing special category data under the Data Protection (Jersey) Law 2018. We will only collect what is necessary and apply appropriate safeguards.

How We Will Use Information About You

We use your personal information for the following purposes. We rely on different lawful bases under the Data Protection (Jersey) Law 2018 (Schedule 2, Part 1) depending on the circumstances:

To provide services under a contract with you or your organisation
Where you have entered into a contract with us to provide services, we use your personal information to perform that contract. This includes; taking payment and processing refunds, delivering the services you have requested, responding to your customer service enquiries.

For our legitimate business interests (Lawful basis: Legitimate interests)
We process your information where it is necessary to pursue our legitimate interests in running and developing our business efficiently and securely. This includes maintaining accurate records of clients and contacts, verifying information, managing our business operations, and improving our services. For example, we may use your contact details to send you relevant updates about changes to compliance requirements or to inform you of new services we offer.

Where you have given us permission (Lawful basis: Consent)
Where we cannot rely on one of the lawful bases above, or where we wish to carry out processing beyond what you would reasonably expect, we will ask for your explicit consent. For example, we may ask your consent before using your email address to add you to a mailing list for compliance updates or marketing.

Change of Purpose

We'll only use your personal information for the reasons stated in this notice, or for closely related reasons. If we ever want to use it for something new and unrelated, we'll tell you first and get your consent (or make sure we have proper legal grounds) before doing so. If we're relying on legitimate interests as our legal basis, we'll also check that the new use doesn't unfairly affect your rights.

Data Sharing

We share your personal data with carefully selected third parties (called "processors") who help us deliver our services, manage our operations, and meet our legal obligations. These processors act on our instructions and are contractually bound to protect your data in accordance with the Data Protection (Jersey) Law 2018. We may also disclose your personal data if required by law, court order, or other legal process, or where we have a legitimate interest to do so.

(List of processors on Index 1)

Marketing

Sentinel is a highly reputable provider of services across various sectors in Jersey, Guernsey, and parts of the UK. We want to share with everyone what we do.

We promote our services through our website and company social media pages, including LinkedIn. You may choose to follow or interact with these pages.

We do not currently operate a general marketing mailing list or email newsletter. We may contact existing clients and business contacts about services relevant to our relationship with them where it is lawful to do so.

You can also contact us or our DPM to withdraw your consent at any time

Use of Social Media

We may publish photographs or videos of our work on platforms such as Facebook, Instagram and LinkedIn. These may include identifiable people, vehicle registration numbers, properties or locations.

We may also respond to any reviews you place on social media regarding our business. We will only use the information you have provided and will not disclose any additional personal details that you have already disclosed during this process. If you have any concerns about this, please reach out to the Data Protection Manager through email at dataprotection@trilliumgroup.je

International Data Transfers

Your personal data may be transferred to recipients located outside Jersey. Where we do transfer your data internationally, we ensure that appropriate safeguards are in place to protect your information in accordance with the Data Protection (Jersey) Law 2018.

Data Security

We take data security seriously. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, secure authentication, regular security testing, and staff training.

However, no method of data transmission or storage is completely secure. Whilst we work hard to protect your personal data, we cannot guarantee absolute security. You are responsible for keeping any passwords or authentication credentials you use to access our systems confidential.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. This includes meeting our contractual obligations, legal and regulatory requirements, accounting requirements, and reporting obligations.

The specific retention periods for different categories of personal data are set out in our Data Retention Schedule. You can request a copy of this schedule from our Data Protection Manager using the contact dataprotection@trilliumgroup.je

When personal data is no longer needed, we securely dispose of it or anonymise it in accordance with the Data Protection (Jersey) Law 2018. Anonymised data may be retained and used indefinitely.

Rights of Access, Correction, Erasure and Restriction

Under the Data Protection (Jersey) Law 2018, you have the following rights:

• Right of access: You have the right to request confirmation of whether we hold your personal data and, if we do, to obtain a copy of that data in a commonly used electronic format. This allows you to understand how and why we are processing your information.
• Right to rectification: You have the right to request that we correct any personal data that is inaccurate or incomplete.
• Right to erasure: You have the right to request erasure of your personal data in certain circumstances, such as where the data is no longer necessary for the purposes for which it was collected or where you withdraw consent on which processing is based.
• Right to restrict processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, for example whilst we verify the accuracy of disputed information.
• Right to data portability: Where we process your personal data on the basis of contract or consent, you have the right to request that we provide your data in a structured, commonly used, machine-readable format and, where technically feasible, transmit it directly to another controller.
• Right to object: You have the right to object to processing of your personal data for direct marketing purposes or where we rely on our legitimate interests as the lawful basis for processing.

We will cease the processing unless we can demonstrate compelling legitimate grounds.

How to Request Your Information

To exercise any of your rights listed above, please contact us using the details provided at the end of this notice.

We will respond to your request within four weeks of receipt. If your request is complex or if you have made multiple requests, we may extend this period by a further eight weeks. We will inform you of any extension within the original four-week period and explain why the extension is necessary.

We may ask you to provide information to verify your identity before we can process your request. This helps us ensure that personal data is only disclosed to authorised individuals.

We will not charge you for responding to a rights request unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to respond.

Right to Withdraw Consent

Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing that took place before you withdrew it.

To withdraw your consent, please contact us using the details provided at the end of this notice.

Automated Decision-Making

We do not use automated decision-making or profiling in relation to your personal information.

Changes to this Privacy Notice

We may update this privacy notice from time to time to reflect changes in our processing activities, legal requirements, or other relevant circumstances. When we make material changes, we will notify you by updating the date at the top of this notice and, where appropriate, by posting a notice on our website or sending you a direct communication.

Your continued use of our services following any changes to this notice constitutes your acceptance of the updated terms. We encourage you to review this notice periodically to stay informed about how we protect your personal data.

Complaints

If you are unhappy with how we have handled your personal data or believe we have breached the Data Protection (Jersey) Law 2018, you may lodge a complaint with us.

Sentinel Construction:
Data Protection Manager dataprotection@trilliumgroup.je
6 New Street, St. Helier, JE2 3RA, Jersey

You also have the right to lodge a complaint with the Jersey Office of the Information Commissioner (JOIC), which is the independent supervisory authority for data protection in Jersey.

Jersey Office of the Information Commissioner:
2nd Floor, 5 Castle Street, St Helier, Jersey JE2 3BT
Tel:+44 (0) 1534 716530 Email:enquiries@jerseyoic.org
jerseyoic.org

You can lodge a complaint with JOIC at any time. You do not need to exhaust our internal complaint process first, although we would welcome the opportunity to resolve your concerns directly.

List of Third-party Processors

Index 1