Privacy Policy

---

Last updated: February 2026

RJ Cross Ltd ("we", "us", "our") is committed to protecting your privacy and handling your personal information responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (as amended).

This Privacy Notice explains how we collect, use, share and protect personal information when:

• You contact us, request a quote, or engage our asbestos consulting services (surveys, air testing, management plans, removal project management, etc.);
• You visit our website [insert your website URL];
• We interact with you as a client, potential client, supplier, contractor, or other business contact.

1. Who we are

RJ Cross Ltd is a UK-based asbestos consulting company providing asbestos surveys, sampling, analysis management, compliance advice, and related services.

Data controller: RJ Cross Ltd Registered address: [Insert your full registered office address] Company number: [Insert your Companies House number] Contact for data protection matters: [Insert name / position, e.g. "Managing Director"] Email: [Insert your privacy/contact email, e.g. info@rjcrossltd.co.uk] Telephone: [Insert phone number]

2. What personal information we collect

We typically collect the following types of personal information:

• Identity & contact data: name, job title, company name, business address, email address, telephone number(s).
• Service-related data: details about the property/site (address, access arrangements), your requirements, site plans or drawings you provide (which may incidentally contain personal data), project correspondence.
• Financial & transactional data: payment details, invoicing address, purchase orders (usually business-related but may include contact names).
• Communication data: emails, call notes, enquiry forms, meeting records.
• Technical data (website visitors): IP address, browser type, pages visited, time/date of visit, referral source (via cookies/analytics — see our separate Cookie Notice if applicable).
• Other: any personal data you voluntarily provide (e.g. in emails or during site discussions).

We do not generally collect special category data (health, ethnicity, etc.) or criminal conviction data. If such data is incidentally provided (e.g. health & safety records mentioning individuals), we will only process it where strictly necessary and lawful.

3. How we collect your personal information

• Directly from you (enquiry forms, emails, phone calls, contracts, site meetings).
• From third parties (e.g. referring consultants, main contractors, duty holders passing on contact details to arrange surveys).
• Automatically via website technologies (cookies, server logs — see separate Cookie Notice).
• From public sources (e.g. Companies House, property records) where relevant to asbestos compliance obligations.

4. How and why we use your personal information

We only process personal information where we have a lawful basis under UK GDPR. Our main bases are:

• Performance of a contract (Art 6(1)(b)) — to provide asbestos consulting services, issue quotes, arrange site access, deliver reports, manage projects, invoice.
• Legitimate interests (Art 6(1)(f)) — running our business (e.g. record-keeping, health & safety compliance, fraud prevention, improving services, direct business communications that are relevant to asbestos management).
• Legal obligation (Art 6(1)(c)) — complying with asbestos regulations (e.g. Control of Asbestos Regulations 2012), tax/VAT laws, record-keeping duties.
• Consent (Art 6(1)(a)) — only where we rely on it (e.g. optional marketing emails; you can withdraw consent at any time).

We do not use automated decision-making or profiling.

5. Who we share your personal information with

We may share personal information with:

• Our professional advisers (accountants, lawyers, insurers).
• Sub-contractors / lab analysts (e.g. UKAS-accredited laboratories for sample analysis — they act as processors).
• IT/service providers (cloud storage, email, accounting software, CRM — all under written processor agreements).
• Regulators/enforcement bodies (HSE, local authorities, UK courts) when required by law.
• Other parties involved in your project (with your agreement, e.g. main contractor, building owner).

We do not sell personal data. International transfers only occur to countries with adequate protection or under appropriate safeguards (e.g. UK International Data Transfer Agreement or IDTA).

6. How long we keep your personal information

We keep personal data only as long as necessary:

• Client/project files: typically 6–40 years depending on type of survey/report (often aligned with asbestos management/review cycles and limitation periods).
• General business correspondence/quotes (not proceeded): 2–6 years.
• Financial records: 6 years (HMRC requirement).
• Website logs: usually 12–26 months.

We review data periodically and securely delete or anonymise when no longer needed.

7. Security

We use appropriate technical and organisational measures to protect personal data (e.g. encryption, access controls, secure cloud providers, staff training). However, no method is 100% secure.

8. Your rights under UK GDPR

You have the right to:

• Access your personal data
• Correct inaccurate/incomplete data
• Erase data (in certain circumstances)
• Restrict processing
• Object to processing (e.g. legitimate interests or direct marketing)
• Data portability (limited situations)
• Withdraw consent (where we rely on it)

To exercise any right, contact us at the details above. We usually respond within one month (free of charge unless requests are excessive).

You also have the right to complain to the Information Commissioner's Office (ICO): Website: https://ico.org.uk/make-a-complaint Helpline: 0303 123 1113

9. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last revised. Please check back periodically.

10. Contact us

If you have any questions about this Privacy Notice or our data practices, please contact:

[Insert name/position] Email: [privacy or general email] Telephone: [number] Post: [your address]

Thank you for trusting RJ Cross Ltd with your information.