Privacy Policy

WellSpace Ergonomics Ltd

PRIVACY POLICY & PRIVACY NOTICE

Document Reference: WSE-DP-003

Version: 2.0

Effective Date: 8 October 2026

Next Review Date: 7 October 2027

Policy Owner: WellSpace Ergonomics Ltd

Overall Responsibility: Director, WellSpace Ergonomics Ltd

1. PURPOSE

WellSpace Ergonomics Ltd (“WellSpace”, “we”, “us” or “our”) is committed to protecting the

privacy and personal data of individuals whose information we collect or process in the course

of operating our business.

This Privacy Policy & Privacy Notice explains how WellSpace collects, uses, stores, protects and

shares personal data and the rights individuals may have in relation to their personal

information.

WellSpace aims to comply with applicable UK data protection legislation, including the UK

General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable

guidance issued by the Information Commissioner's Office (ICO).

This document is intended to operate as WellSpace's principal privacy policy and privacy

notice.

2. SCOPE

This policy applies to personal data processed by WellSpace in connection with:

• customers and prospective customers;

• customer employees and contractors;

• individuals undertaking DSE or ergonomic assessments;

• suppliers and supplier contacts;

• business contacts and prospects;

• individuals who contact WellSpace;

• individuals whose information is provided to WellSpace by a customer; and

• other individuals whose personal data WellSpace processes in the course of its

business activities.

This policy should be read alongside WellSpace's internal Data Protection and Information

Management Procedure, Data Retention Schedule and Direct Marketing and Prospecting

Procedure.

3. DATA CONTROLLER

For personal data that WellSpace processes for its own business purposes, WellSpace

Ergonomics Ltd is the data controller.

WellSpace determines the purposes for which such personal data is processed and the manner

in which it is handled.

Where WellSpace provides services to a corporate customer and processes personal data on

that customer's behalf, the precise responsibilities of WellSpace and the customer will depend

upon the nature of the services and processing involved.

Where appropriate, contractual arrangements or a data processing agreement may be put in

place to clarify the respective responsibilities of the parties.

4. DATA PROTECTION PRINCIPLES

WellSpace will seek to ensure that personal data is:

• processed lawfully, fairly and transparently;

• collected for specified, explicit and legitimate purposes;

• adequate, relevant and limited to what is necessary;

• accurate and kept up to date where necessary;

• retained for no longer than necessary; and

• protected against unauthorised or unlawful processing and against accidental loss,

destruction or damage.

WellSpace will also seek to ensure that personal data is handled confidentially and only

accessed where there is a legitimate business or legal reason to do so.

5. INFORMATION WE MAY COLLECT

The information collected will depend upon the nature of the relationship with WellSpace and

the services provided.

5.1 Corporate and Contact Information

This may include:

• name;

• job title or role;

• employer or organisation;

• business email address;

• business telephone number;

• business address;

• correspondence and communications;

• appointment information; and

• information relating to the customer or business relationship.

5.2 Quotations, Orders and Financial Information

This may include:

• quotation information;

• order information;

• purchase order information;

• invoice information;

• billing details;

• payment and transaction records;

• delivery information; and

• information required for accounting, taxation and VAT purposes.

5.3 Delivery and Installation Information

Where equipment is supplied, delivered or installed, WellSpace may process information

necessary to arrange and complete the service, including:

• delivery address;

• site contact information;

• access instructions;

• delivery preferences;

• appointment information; and

• information relating to the location and installation of equipment.

Where delivery is requested to an employee's home or another residential address, this may

include the relevant residential address and contact information.

Such information will only be used for legitimate business purposes and will be retained only for

as long as reasonably necessary.

5.4 DSE and Ergonomic Assessment Information

Where WellSpace conducts a DSE or ergonomic assessment, information may be recorded

relating to:

• workstation configuration;

• desk and chair dimensions or adjustments;

• screen and monitor positioning;

• keyboard and mouse positioning;

• working practices;

• workstation environment;

• lighting and other environmental factors;

• reported comfort or discomfort;

• equipment requirements; and

• recommendations arising from the assessment.

Where an individual voluntarily provides information relating to a physical condition, injury,

disability or other health-related matter, that information may constitute special category

personal data under the UK GDPR.

WellSpace will not request unnecessary medical information as part of a standard DSE

assessment.

Where health-related information is provided and WellSpace needs to process it, an

appropriate lawful basis and, where required, an applicable condition for processing special

category data will be identified.

6. HOW PERSONAL DATA IS OBTAINED

WellSpace may obtain personal data:

• directly from the individual;

• from an employer or organisation instructing WellSpace to provide services;

• through telephone, email, online forms or other communications;

• when an enquiry or quotation is requested;

• when an order is placed;

• when delivery or installation is arranged;

• during a DSE or ergonomic assessment;

• from suppliers or service providers where necessary to fulfil an order;

• from publicly available business information;

• through legitimate business networking and prospecting activities;

• through exhibitions, events and business introductions; and

• from other lawful sources where appropriate.

Where personal data is obtained from a source other than the individual, WellSpace will seek to

comply with applicable transparency and information requirements.

7. HOW WELLSPACE USES PERSONAL DATA

WellSpace may use personal data for purposes including:

• responding to enquiries;

• preparing quotations;

• taking steps towards entering into contracts;

• performing contracts;

• providing DSE and ergonomic assessment services;

• preparing assessment reports and recommendations;

• supplying goods and equipment;

• arranging delivery and installation;

• managing appointments;

• communicating with customers and relevant individuals;

• processing orders and payments;

• issuing invoices and maintaining financial records;

• managing customer and supplier relationships;

• dealing with complaints, queries and disputes;

• maintaining appropriate business records;

• protecting business systems and information;

• preventing fraud, misuse or unlawful activity;

• complying with legal and regulatory obligations;

• managing insurance matters or potential claims;

• establishing, exercising or defending legal claims; and

• sending appropriate information about WellSpace's own products and services where

permitted by law.

WellSpace will not use personal data for purposes incompatible with the purpose for which it

was originally collected unless an appropriate lawful basis exists.

8. LAWFUL BASIS FOR PROCESSING

Depending upon the circumstances, WellSpace may rely upon one or more of the following

lawful bases under the UK GDPR.

8.1 Contract

Processing may be necessary to perform a contract or to take steps at an individual's request

before entering into a contract.

Examples include:

• fulfilling an order;

• arranging delivery;

• arranging installation;

• conducting an agreed assessment; and

• providing requested services.

8.2 Legal Obligation

Personal data may be processed where necessary to comply with a legal obligation.

This may include accounting, taxation, VAT, financial record keeping and other legal or

regulatory requirements.

8.3 Legitimate Interests

WellSpace may process personal data where it is necessary for the legitimate interests of

WellSpace or a third party, provided those interests are not overridden by the individual's rights

and interests.

This may include:

• managing customer relationships;

• responding to business enquiries;

• maintaining business records;

• managing suppliers;

• protecting WellSpace's business and systems;

• dealing with complaints and disputes;

• maintaining appropriate records of services provided;

• business-to-business marketing where permitted;

• managing insurance matters; and

• establishing, exercising or defending legal claims.

Where WellSpace relies upon legitimate interests, the necessity and proportionality of the

processing will be considered.

8.4 Consent

Where consent is the appropriate lawful basis, WellSpace will seek consent in a clear and

appropriate manner.

Where processing relies upon consent, the individual may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent

was withdrawn.

9. DSE AND HEALTH-RELATED INFORMATION

WellSpace's DSE and ergonomic assessments are intended to support workplace health,

safety, comfort and ergonomic risk management.

WellSpace seeks to minimise the amount of personal and health-related information collected

during an assessment.

Where health-related information is voluntarily provided, it will be treated confidentially and

appropriate safeguards will be applied.

WellSpace's assessors do not provide medical diagnosis or clinical treatment and do not

ordinarily maintain medical records as part of the standard DSE assessment service.

Where an assessment identifies circumstances that may require medical, occupational health

or other specialist advice, WellSpace may recommend that the individual or customer seeks

appropriate professional assistance.

WellSpace will not use information obtained during a DSE assessment for unrelated purposes

without an appropriate lawful basis.

10. SHARING PERSONAL DATA

WellSpace does not sell or trade personal data.

Personal data may be shared with appropriate third parties where reasonably necessary to

provide goods or services, operate the business, comply with legal obligations or protect

legitimate business interests.

These third parties may include:

• manufacturers;

• wholesalers and suppliers;

• delivery and courier providers;

• installation partners;

• professional advisers;

• accountants;

• insurers and insurance advisers;

• IT and technology service providers;

• CRM, accounting, booking, form and communication providers; and

• other service providers acting on behalf of WellSpace.

Information shared with third parties will be limited to what is reasonably necessary for the

relevant purpose.

For example, where equipment is being delivered to an individual's home, a delivery provider

may receive the individual's name, address and contact information necessary to complete the

delivery.

Where third parties process personal data on behalf of WellSpace, appropriate contractual and

data protection arrangements will be sought where required.

11. BUSINESS SYSTEMS AND SERVICE PROVIDERS

WellSpace uses business systems and technology services to operate its business.

These may include systems used for:

• accounting and financial records;

• customer relationship management;

• appointment and booking management;

• enquiry and online form management;

• email and communications;

• document storage;

• business administration; and

• other operational requirements.

Personal data may therefore be processed through these systems where necessary for

legitimate business purposes.

WellSpace will seek to use appropriate and reputable service providers and will take reasonable

steps to ensure that appropriate data protection and security arrangements are in place.

The specific systems and providers used by WellSpace may change as the business develops.

12. DIRECT MARKETING

WellSpace may contact businesses and business contacts about its own products and services

where permitted by applicable data protection and electronic marketing legislation.

Marketing activities may include:

• business email;

• telephone contact;

• post;

• LinkedIn and other professional social media;

• business networking;

• exhibitions and events; and

• follow-up communications following an enquiry or business interaction.

WellSpace will take account of the requirements of the Privacy and Electronic Communications

Regulations (PECR) and applicable UK data protection legislation.

Where consent is required, appropriate consent will be obtained.

Where another lawful route is available, such as legitimate interests, WellSpace will consider

whether the relevant requirements are satisfied before carrying out the marketing activity.

Individuals may object to direct marketing at any time.

Where an individual objects to direct marketing, WellSpace will stop sending such marketing

communications and, where necessary, retain limited information on a suppression or do-not-

contact list to ensure that the objection continues to be respected.

WellSpace's internal approach to marketing and prospecting is set out in WSE-MKT-001 Direct

Marketing and Prospecting Procedure.

13. DATA SECURITY

WellSpace will take reasonable technical and organisational measures to protect personal data

against:

• unauthorised access;

• accidental loss;

• destruction;

• alteration;

• unauthorised disclosure;

• misuse; and

• other unlawful or unauthorised processing.

Depending upon the circumstances, measures may include:

• appropriate password protection;

• device security;

• access controls;

• secure cloud-based systems;

• software and security updates;

• restricted access to personal information;

• secure disposal of information;

• appropriate handling of physical documents; and

• care when sending personal information by email or other communication methods.

No method of storing or transmitting information can be guaranteed to be completely secure.

WellSpace will nevertheless take reasonable steps appropriate to the nature and sensitivity of

the information involved.

14. CUSTOMER IT SYSTEMS AND NETWORKS

Where WellSpace provides physical delivery, assembly or installation services, its activities are

generally limited to the physical handling, assembly and positioning of equipment.

Unless expressly agreed otherwise, WellSpace does not ordinarily:

• access customer servers;

• access customer cloud systems;

• configure customer software;

• access customer databases;

• obtain customer network passwords;

• connect to customer internal networks; or

• access or modify customer digital files.

Physical installation services therefore do not ordinarily require access to a customer's internal

IT environment.

This does not remove WellSpace's responsibility for protecting personal data that it

independently holds or processes in connection with its own services.

15. DATA RETENTION

WellSpace will retain personal data only for as long as reasonably necessary for the purpose for

which it was collected, unless a longer period is required or permitted by law.

Different categories of information may therefore be retained for different periods.

Examples include:

• quotations and orders may be retained for appropriate contractual, legal, accounting

and business purposes;

• invoices and financial records will be retained in accordance with applicable

accounting, tax and VAT requirements;

• DSE assessment records may be retained for an appropriate period to provide the

service, manage the customer relationship, demonstrate what was provided and deal

with potential queries or disputes;

• delivery information collected solely to facilitate a particular delivery will be removed or

securely deleted when no longer reasonably required, subject to legal, contractual or

dispute-related requirements;

• complaints and incident records may be retained for an appropriate period depending

upon their nature;

• marketing information will be retained only for as long as reasonably necessary for the

relevant marketing purpose; and

• information relating to marketing objections may be retained where necessary to ensure

that the objection continues to be respected.

WellSpace maintains a separate Data Retention Schedule (WSE-DP-002).

Where a dispute, complaint, investigation or potential legal claim is reasonably anticipated,

relevant information may need to be retained for longer.

16. INTERNATIONAL DATA TRANSFERS

Some of WellSpace's service providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, WellSpace will take appropriate steps to

ensure that the transfer complies with applicable UK data protection legislation.

Depending upon the circumstances, this may include reliance upon:

• an applicable adequacy decision;

• appropriate contractual safeguards; or

• another lawful transfer mechanism recognised under applicable legislation.

17. INDIVIDUAL RIGHTS

Subject to applicable legal conditions and exemptions, individuals may have the right to:

• request access to personal information held about them;

• request correction of inaccurate or incomplete information;

• request erasure of personal information;

• request restriction of processing;

• object to certain processing;

• request data portability in certain circumstances; and

• withdraw consent where processing is based upon consent.

Individuals have an absolute right to object to direct marketing.

These rights are not necessarily absolute and may be subject to legal or regulatory exemptions.

For example, WellSpace may be required to retain certain financial, contractual or business

records and may therefore be unable to delete information immediately where a legal or

legitimate retention requirement applies.

18. MAKING A DATA PROTECTION REQUEST

Individuals who wish to exercise their data protection rights, raise a privacy concern or request

further information about the handling of their personal data should contact:

WellSpace Ergonomics Ltd

Privacy Contact: enquiries@wellspaceergonomics.co.uk

WellSpace may need to request sufficient information to verify the identity of the person making

a request before releasing, correcting or deleting personal information.

Requests will be handled in accordance with applicable statutory requirements.

19. PERSONAL DATA BREACHES

WellSpace maintains internal procedures for identifying, assessing, recording and responding

to personal data breaches.

Where a personal data breach occurs, WellSpace will:

• take reasonable steps to contain the breach;

• assess the nature and potential impact of the breach;

• determine whether notification to the ICO is required;

• determine whether affected individuals need to be informed;

• record the breach and actions taken where appropriate; and

• take reasonable steps to prevent recurrence.

Where notification is legally required, WellSpace will comply with the applicable statutory

requirements and timescales.

The internal process is supported by the Personal Data Breach Record maintained by

WellSpace.

20. AUTOMATED DECISION-MAKING AND PROFILING

WellSpace does not currently use personal data to make solely automated decisions that

produce legal effects or similarly significant effects on individuals.

WellSpace will review this position if its business practices or systems change.

21. THIRD-PARTY WEBSITES AND SERVICES

Where WellSpace's communications or website contain links to third-party websites or

services, those organisations operate under their own privacy policies.

WellSpace is not responsible for the privacy practices, content or security of third-party

websites or services that it does not control.

22. COOKIES AND WEBSITE TECHNOLOGIES

WellSpace operates the website www.wellspaceergonomics.co.uk, providing information about our products and services and allowing visitors to submit enquiries.

Website enquiries are processed using our hosting infrastructure and Microsoft 365 email services. Personal information submitted through our contact form is handled in accordance with this Privacy Policy.

We review the cookies and similar technologies used by our website. Information about their purposes and any applicable consent requirements is provided in our Cookie Policy.

Before introducing additional technologies, including analytics or marketing tools, we will review the relevant privacy and cookie requirements.

23. COMPLAINTS

If an individual has concerns about how WellSpace has handled their personal data, they

should contact WellSpace in the first instance so that the matter can be investigated.

Individuals also have the right to raise a concern with the Information Commissioner's Office

(ICO) if they believe their personal data has not been handled in accordance with applicable

data protection legislation.

WellSpace will cooperate appropriately with any legitimate regulatory enquiry.

24. POLICY REVIEW

WellSpace will review this Privacy Policy & Privacy Notice periodically and may update it where

necessary to reflect:

• changes in legislation;

• changes in ICO guidance;

• changes to business practices;

• changes to services provided;

• changes to technology or systems; or

• other relevant developments.

The latest approved version will apply from the stated effective date.

25. APPROVAL

This Privacy Policy & Privacy Notice has been approved by WellSpace Ergonomics Ltd.

Signed: ______________________________

Name: Director, WellSpace Ergonomics Ltd

Date: ______________________________08/10/2026

Review Date: 7 October 2027