Legal information
Privacy Notice
Last updated: 30 July 2026
Forge Solutions customer privacy notice
This privacy notice tells you what to expect us to do with your personal information.
Contact details
Telephone: 07904 818817
Email: lewis@forge-solutions.co.uk
What information we collect, use, and why
Providing and improving products and services for clients
- Names and contact details
- Addresses
- Gender
- Pronoun preferences
- Occupation
- Date of birth
- Marital status
- Payment details, including card or bank information for transfers and direct debits
- Financial data, including income and expenditure
- Transaction data, including details about payments to and from you and details of products and services you have purchased
- Usage data, including information about how you interact with and use our website, products and services
- Employment details, including salary, sick pay and length of service
- Information relating to compliments or complaints
- Account access information
- Website user information
Operating client or customer accounts
- Names and contact details
- Addresses
- Purchase or service history
- Account information, including registration details
Preventing, detecting, investigating or prosecuting crimes
- Names and contact information
- Client accounts and records
- Financial information, for example for fraud prevention or detection
Information updates or marketing
- Names and contact details
- Addresses
- Profile information
- Marketing preferences
- Purchase or account history
- Website and app user journey information
- IP addresses
Complying with legal requirements
- Name
- Contact information
- Identification documents
- Client account information
- Any other personal information required to comply with legal obligations
- Safeguarding information
- Criminal offence data
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights. These rights are set out briefly below. Exemptions may apply.
- Your right of access: you can ask us for copies of your personal information and details about where it came from and who it is shared with.
- Your right to rectification: you can ask us to correct or complete personal information you think is inaccurate or incomplete.
- Your right to erasure: you can ask us to delete your personal information.
- Your right to restriction of processing: you can ask us to limit how we use your personal information.
- Your right to object to processing: you can object to the processing of your personal information.
- Your right to data portability: you can ask us to transfer personal information you gave us to you or another organisation.
- Your right to withdraw consent: where we rely on consent, you can withdraw it at any time.
If you make a request, we must respond without undue delay and in any event within one month. To make a data protection rights request, use the contact details above.
Our lawful bases for collecting and using your data
Providing and improving products and services
- Consent: we have your permission after giving you the relevant information.
- Contract: we need the information to enter into or carry out a contract with you.
- Legal obligation: we need the information to comply with the law.
- Recognised legitimate interests: we may need to share information with a public authority or another organisation for its public tasks or official functions—the public task disclosure response condition.
Operating client or customer accounts
- Consent
- Contract
- Legal obligation
- Recognised legitimate interests: the public task disclosure response condition described above.
Preventing, detecting, investigating or prosecuting crimes
- Consent
- Contract
- Legal obligation
Information updates or marketing
- Consent: you have given permission after receiving the relevant information and may withdraw it at any time.
Complying with legal requirements
- Contract
- Legal obligation
Where we get personal information from
- Directly from you
How long we keep information
| Record category | Examples | Retention period | Legal or business basis | Disposal method |
|---|---|---|---|---|
| Employee personnel files | Contracts, appraisals, disciplinary records | 6 years after employment ends | Limitation Act 1980; employment claims | Secure deletion or shredding |
| Payroll records | Salary, tax and pension records | 6 years from end of tax year | HMRC requirements | Secure deletion |
| Recruitment records—unsuccessful | CVs and interview notes | 6 months after recruitment closes | Equality Act claims; legitimate interests | Secure deletion |
| Recruitment records—successful | Application forms | Transfer to personnel file | Employment administration | Not applicable |
| Right to work checks | Passport copies and visas | Employment duration plus 2 years | Immigration legislation | Secure deletion |
| Health and safety records | Accident books | Minimum 3 years; longer for specific incidents | Health and safety legislation | Secure deletion |
| Occupational health records | Medical assessments | Up to 40 years where legally required | COSHH and health legislation | Secure deletion |
| Customer records | Contracts and correspondence | 6 years after contract ends | Contract and limitation periods | Secure deletion |
| Marketing contacts | Mailing lists | Until consent is withdrawn or 2 years after last meaningful engagement | UK GDPR and PECR | Delete or anonymise |
| Supplier records | Contracts and invoices | 6 years after contract ends | Accounting and contractual obligations | Secure deletion |
| Financial records | Accounts, invoices and VAT | 6 years | HMRC requirements | Secure deletion |
| CCTV footage | Security recordings | Normally 30 days unless required for investigation | Legitimate interests | Automatic overwrite |
| Website logs | Server logs | 12 months | Security monitoring | Automatic deletion |
| Email correspondence | Routine business emails | 2 years unless retained as a business record | Business need | Secure deletion |
| Complaints records | Customer complaints | 6 years after resolution | Legal defence | Secure deletion |
| Subject access requests | Request and response records | 3 years after closure | Accountability under UK GDPR | Secure deletion |
| Data breach records | Incident reports | 6 years | Accountability | Secure deletion |
| Consent records | Marketing consent evidence | Duration of consent plus 6 years after withdrawal | Accountability | Secure deletion |
| Cookies and analytics data | Website analytics | 14–26 months, depending on configuration | Legitimate interests or consent | Automatic deletion |
| Visitor logs | Reception sign-in | 12 months | Security | Secure destruction |
For more information about how long we store your personal information, or the criteria we use to determine this, please contact us using the details above.
Who we share information with
- Regulatory authorities
- Organisations we are legally obliged to share personal information with
How to complain
If you have concerns about our use of your personal information, email us at lewis@forge-solutions.co.uk.
If you remain unhappy after raising a complaint with us, you can also complain to the Information Commissioner’s Office:
Information Commissioner’s OfficeWycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk/make-a-complaint