Privacy notice
This notice explains how Blueray Automations Solutions (UK) Limited ("we", "us") collects and uses personal data when you visit this website, make an enquiry, or engage us as a supplier. We are the data controller for the processing described here.
1. Who we are
Blueray Automations Solutions (UK) Limited, a private company limited by shares registered in England and Wales under company number 17452289. Registered office: Suite 116 Lovell House, Birchwood Park, Warrington, Cheshire, WA3 6FW, United Kingdom.
Contact for data protection matters: info@blueraygb.com. Registration with the Information Commissioner's Office is being completed and the registration reference will be published in this section once issued.
We have not appointed a statutory Data Protection Officer, because we are not required to do so under Article 37 of the UK GDPR. Data protection matters are handled by the contact above.
2. What personal data we collect
- Enquiry data. Name, work email address, organisation, enquiry subject and the content of your message, submitted through the contact form or by email.
- Client and supplier contact data. Names, job titles, business contact details and correspondence of individuals at client and supplier organisations.
- Contract and billing data. Purchase orders, invoices, payment references and records of services supplied.
- Technical data. Server log data generated when you request a page, which may include your IP address, the time of the request, the page requested and your browser's user agent string. This is generated by the hosting provider for security and service integrity.
We do not collect special category personal data through this website and ask that you do not submit it through the contact form.
3. Why we process it and our lawful basis
| Responding to enquiries | Legitimate interests (Article 6(1)(f)): responding to a person who has approached us about our services. Where you are an individual rather than a business contact, steps taken at your request prior to entering a contract (Article 6(1)(b)). |
|---|---|
| Delivering services | Performance of a contract (Article 6(1)(b)), or legitimate interests where the contract is with your employer rather than with you personally. |
| Invoicing, accounting and tax | Legal obligation (Article 6(1)(c)) under the Companies Act 2006 and UK tax legislation. |
| Website security and availability | Legitimate interests (Article 6(1)(f)): keeping the site available and protecting it from abuse. |
| Responding to legal claims and regulators | Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)). |
Where we rely on legitimate interests, we have considered the impact on your rights and are satisfied that the processing is proportionate and that you would reasonably expect it. You may object at any time using the details in section 9.
4. Processing on behalf of clients
When we build or operate systems for a client, any personal data held in those systems is processed on the client's instructions and the client is the controller. In that role we act as a processor under a written data processing agreement made under Article 28 of the UK GDPR, which sets out the subject matter, duration, nature and purpose of the processing, the types of data and categories of data subject, and the security measures applied. If your data is held in a client's system, that client's privacy notice applies and you should contact them directly.
5. Marketing
We do not send marketing emails to individuals who have not asked to hear from us. We do not sell, rent or share contact details with third parties for their own marketing. If we introduce a mailing list, it will operate on an opt-in basis with an unsubscribe link in every message, in line with the Privacy and Electronic Communications Regulations 2003.
6. Who we share it with
We share personal data only where necessary, with the following categories of recipient. The current providers in each category are named on request.
- No form processor. The contact form on this site opens a message in your own email application. Nothing you type into it is transmitted to a third party by this website.
- Our hosting and infrastructure provider, which stores the site and generates the server logs described in section 2.
- Our email and productivity provider, through which correspondence is sent, received and stored.
- Our accountants and, where required, our professional advisers.
- Regulators, law enforcement or a court, where we are required to disclose by law.
Each processor is engaged under a written contract containing the terms required by Article 28 of the UK GDPR.
7. International transfers
Our records and correspondence are held on services whose primary storage region is the United Kingdom or the European Economic Area. Where a provider processes personal data outside the United Kingdom, we rely on UK adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.
Where we subcontract delivery work outside the United Kingdom on a client engagement, the arrangement and the processing location are disclosed to the client in writing before contracts are signed.
8. How long we keep it
- Enquiries that do not become engagements. Twenty-four months from the date of last contact, then deleted.
- Client records and contracts. For the duration of the engagement and then for six years from the end of the relevant financial year, to meet limitation and tax record requirements.
- Accounting records. Six years from the end of the financial year to which they relate, in line with the Companies Act 2006.
- Server logs. Ninety days, after which they are overwritten by the hosting provider.
9. Your rights
Subject to the conditions in the UK GDPR, you have the right to be informed, the right of access, and the rights to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such automated decision-making.
To exercise a right, contact info@blueraygb.com. We will respond within one month. We may ask for information to verify your identity. There is normally no charge.
10. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, by telephone on 0303 123 1113, or at ico.org.uk.
11. Security
We apply technical and organisational measures appropriate to the risk, including transport encryption on this website, access control on internal systems, multi-factor authentication on administrative accounts, and a documented process for handling personal data breaches. Reportable breaches are notified to the Information Commissioner's Office within 72 hours of becoming aware of them, and to affected individuals where the risk to their rights and freedoms is high.
12. Cookies
See our cookie statement. This website sets no non-essential cookies and loads no third-party trackers.
13. Changes to this notice
We review this notice at least annually and when our processing changes. The version and effective date are shown at the top of the page. Material changes affecting existing clients are notified directly.