Privacy Policy - The FSC Group

1. Introduction

FSC Group Limited, trading as The FSC Group (“FSC”, “we”, “us”, “our”), is committed to protecting the privacy and security of personal data belonging to our employees, workers, contractors, job applicants, customers and visitors to our website. FSC is the controller of the personal data described in this policy. This policy explains what personal data we collect, how and why we use it, who we share it with, and the rights you have over it.

This policy has been updated to reflect the Data (Use and Access) Act 2025 (“DUAA”), which amends the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (“PECR”). The DUAA’s data protection reforms were introduced in stages between June 2025 and 19 June 2026, and this policy reflects the position now that all provisions are in force.

This policy applies alongside, and does not replace, our internal HR policies (including our Recruitment, Employee Records, and Data Retention procedures). If you are an employee or worker and have questions about how your data is used in a specific process, please speak to your line manager or the HR team in the first instance.

2. The personal data we collect

Depending on your relationship with us, we may collect and use the following categories of personal data:

Identity and contact details – such as your name, job title, employer, postal address, email address and telephone number.
Recruitment data – such as your CV, application, qualifications, employment history and interview notes.
Employment data – such as your contract, employee records, and the bank details needed to pay you and provide certain benefits.
Communications – such as queries, complaints and correspondence with us, and recordings of calls to and from our customer service and sales lines (see Section 6).
CCTV images – recorded at our premises and car parks.
Website and device data – such as your IP address, browser and device characteristics, the pages you visit and how you reached our website, collected through cookies and similar technologies (see Section 7).
Special category data – such as health information, only where necessary and permitted by law, for example to meet our obligations as an employer.

We collect most of this data directly from you. We may also receive it from recruitment agencies, job boards and professional networking sites, and from the technologies used on our website.

3. How and why we use your personal data

We collect and use personal data to run our business responsibly, to meet our obligations as an employer, and to provide a good experience for our customers, candidates and website visitors. We only use your data where we have a valid legal basis to do so, and we will always tell you if we intend to use it for a materially different purpose than the one for which it was collected.

If you choose not to share certain personal data, or you withdraw a permission you have previously given us, we may not be able to provide the related service. For example, we cannot progress a job application without your CV, or process certain payroll benefits without your bank details.

3.1 The legal bases we rely on

Depending on the activity, we rely on one or more of the following legal bases under Article 6 UK GDPR:

Contract – to perform your contract of employment, or a contract for goods or services.
Legal obligation – to comply with employment, tax, health and safety, or other legal requirements.
Legitimate interests – where our need to use the data (or a third party’s) is not overridden by your rights and interests, for example to manage our business, protect our premises, and improve our services.
Recognised legitimate interests – the DUAA introduced a defined list of “recognised legitimate interests” (Annex 1, UK GDPR) covering matters such as safeguarding vulnerable people, preventing crime, and responding to requests from public bodies. Where processing falls within one of these categories, we are not required to carry out a full legitimate interests balancing test, though we still only process data that is necessary for the purpose.
Consent – for example, where you have agreed to receive marketing communications, to us holding your speculative CV, or to non-essential cookies on our website. You can withdraw consent at any time.
Vital interests – in rare cases, to protect someone’s life, for example in a medical emergency.

3.2 What we use your data for

To respond to queries, complaints, and refund requests, and to keep a record of how we have communicated with you, on the basis of our legitimate interest in providing a good service and improving it over time.
To operate CCTV at our premises and car parks, to protect our people, customers, premises and assets, on the basis of our legitimate business interests.
With your consent, to consider a CV or application you send to us directly or through a recruitment agency for current or future vacancies. You may withdraw this consent at any time.
Where we find your profile on a job board or professional networking site, to contact you about a relevant vacancy, on the basis of our legitimate interest in recruiting suitable candidates. We will tell you how we found your details when we first contact you, and you can ask us to stop at any time.
To send you relevant communications by post relating to employment contracts, company information, or responses to a complaint, on the basis of our legitimate business interest. You may opt out of postal communications at any time.
To send communications required by law, or necessary to tell you about changes to a service, for example changes to this policy or product recall notices. These do not include promotional content and do not require prior consent when sent by email or text.
To comply with a legal or contractual obligation to share data with law enforcement, for example in response to a court order.
To send survey and feedback requests to help us improve our services, on the basis of our legitimate interest in understanding and improving the customer and employee experience. These do not include promotional content.
With your consent, to understand how visitors use our website and to measure the effectiveness of our LinkedIn activity (see Section 7).

4. Automated decision-making

We may use automated tools to support decisions that affect you, for example initial screening of job applications. The DUAA has replaced the previous blanket restriction on solely automated decision-making with a “permission-plus-safeguards” model (Articles 22A–22D UK GDPR). This means automated decisions can be made in a wider range of circumstances, provided we put in place appropriate safeguards. Where a decision is made about you without meaningful human involvement, you have the right to:

be informed that an automated decision has been made about you;
obtain meaningful information about the logic involved;
request human review of the decision, and contest it if you disagree.

Decisions based on special category data (such as health information) remain subject to stricter conditions, and we do not use automated tools to make final decisions of this kind without human oversight.

5. How we protect your personal data

We know data security matters to our employees, customers and website visitors, and we take appropriate technical and organisational measures to protect the personal data we hold.

Access to personal data is restricted and password-protected, on a need-to-know basis.
Sensitive data, such as payment card information, is encrypted and tokenised.
We regularly monitor our systems for vulnerabilities, and our IT support provider carries out penetration testing to identify and address weaknesses.
We maintain incident response procedures so that any data breach is contained, assessed, and reported to the Information Commissioner’s Office (ICO) and affected individuals where required, within the statutory timescales.

6. Call recording

We record calls to and from our customer service and sales lines for training, quality assurance, and to help resolve queries or disputes. Recording is carried out in line with the Investigatory Powers Act 2016 and the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. These permit business call recording for these purposes without requiring the caller’s separate consent, provided callers are told the call may be recorded.

What we record: calls to and from customer service and sales telephone lines.
Why: staff training and coaching, quality assurance, and as evidence in the event of a dispute or complaint.
Legal basis: our legitimate interests in maintaining service standards and resolving disputes fairly.
Notification: callers are told at the start of the call that it may be recorded, and are given the option to raise their query in writing instead if they would prefer not to be recorded.
Retention: recordings are kept for 30 Days before secure deletion, in line with Section 9, unless a recording is needed for longer as evidence in an ongoing complaint, dispute, or investigation.
Access: recordings can only be accessed by line managers, IT and the quality team on a need-to-know basis.

If you would like to request a copy of, or the deletion of, a call recording that features you, you can do so via the process set out in Section 11.

7. Cookies and similar technologies on our website

Our website uses cookies and similar technologies (such as tags, pixels and scripts) that store or access information on your device. Under PECR (as amended by the DUAA), we only use these without your consent where they are strictly necessary for the website to work. No other cookies are set until you give your consent through the cookie banner, which appears when you first visit.

We group these technologies into three categories:

Strictly necessary – required for the website to work, for example to remember your cookie choices. These cannot be switched off.
Analytics – with your consent, we use Google Analytics to understand how visitors use our website, so that we can improve it. These cookies are provided by Google.
Marketing – with your consent, we use the LinkedIn Insight Tag, described in Section 7.1.

7.1 LinkedIn Insight Tag

With your consent, we use the LinkedIn Insight Tag, provided by LinkedIn Ireland Unlimited Company, to measure how our LinkedIn activity drives visits to our website and to understand the professional make-up of our audience.

The tag places cookies and a pseudonymous identifier on your browser. It sends LinkedIn the page URL, the referring page, your IP address (truncated or hashed), your device and browser characteristics, and the time of your visit.

LinkedIn does not share information with us that identifies you; we receive aggregated reports only. LinkedIn removes direct identifiers within seven days and deletes the remaining pseudonymised data within 180 days. The data is stored on LinkedIn’s servers in the United States, and LinkedIn relies on recognised transfer mechanisms for UK data, as described in its privacy policy.

Legal basis: consent (Article 6(1)(a) UK GDPR). The tag does not load unless you accept marketing cookies.

If you have a LinkedIn account, you can also control how LinkedIn uses your data for advertising in your LinkedIn account settings. For more detail, see LinkedIn’s Privacy Policy and Cookie Policy.

7.2 Google Analytics

With your consent, Google Analytics collects information about how you use our website, such as the pages you visit, how long you stay, and the device and browser you use. We use this information in aggregate to improve our website. Google may process this data outside the UK, as described in its privacy policy.

Legal basis: consent (Article 6(1)(a) UK GDPR). Analytics cookies are not set unless you accept them.

7.3 Managing your choices

You can change or withdraw your consent at any time using the Manage consent button in the bottom corner of every page of our website. Withdrawing consent stops further collection but does not affect processing carried out before you withdrew it.

8. Who we share your personal data with

We only share personal data where necessary and with appropriate safeguards in place. Depending on the purpose, we may share it with:

Service providers acting on our behalf – such as our IT support provider, cloud hosting and software providers, HR and payroll systems, and our website developer and host.
Recruitment agencies – where they have introduced you to us.
Website technology providers – Google (analytics) and LinkedIn (Insight Tag), only where you have consented (see Section 7).
Professional advisers – such as lawyers, accountants and auditors.
Law enforcement, regulators and public bodies – where we are required or permitted by law to do so.

We do not sell your personal data.

9. How long we keep your personal data

We only keep personal data for as long as necessary for the purpose it was collected, and in line with our data retention schedules and any legal or regulatory retention requirements (for example, statutory retention periods for payroll and tax records). Retention for call recordings is set out in Section 6, and for LinkedIn Insight Tag data in Section 7.1.

At the end of the relevant retention period, your data is either securely deleted or anonymised, for example aggregated with other data so it can no longer identify you, for statistical analysis and business planning.

10. International data transfers

FSC operates across nine countries: the UK, Canada, Malaysia, Czechia, Slovakia, Germany, Austria, Lithuania and Italy. We may share personal data between these locations and with our suppliers and service providers overseas, including providers based in the United States such as Google and LinkedIn (see Section 7).

Where we transfer personal data outside the UK, the DUAA replaced the previous “essential equivalence” test with a new “data protection test”, which asks whether the standard of protection in the destination country is “not materially lower” than the standard of protection under UK law. We apply this test, together with appropriate safeguards, before making any restricted transfer. These safeguards may include:

a UK “data bridge” (adequacy) regulation covering the destination country;
the UK’s International Data Transfer Agreement (IDTA) or Addendum to the EU Standard Contractual Clauses; or
other legally recognised safeguards approved by the ICO.

You can request further details of the safeguards we apply to a specific transfer by contacting our Data Protection Officer using the details in Section 13.

11. Your rights over your personal data

Subject to certain exemptions, you have the right to:

request access to the personal data we hold about you, free of charge in most cases;
request correction of your personal data where it is inaccurate, out of date, or incomplete;
request erasure of your personal data, for example once the purpose for which we hold it has ended (such as the end of employment), unless we need to keep it for a legal purpose such as payroll;
request that we restrict or stop processing your personal data, including where you have withdrawn consent or object and we have no overriding legitimate interest;
object to processing based on legitimate interests or for direct marketing purposes;
request a portable copy of personal data you have provided to us, in certain circumstances;
withdraw consent at any time, where processing is based on consent, including consent to cookies (see Section 7.3); and
not be subject to a decision based solely on automated processing without appropriate safeguards, as set out in Section 4.

If we decide not to action a request, we will explain our reasons to you.

11.1 Making a request (subject access requests)

You can request a copy of the personal data we hold about you at any time by contacting our Data Protection Officer using the details in Section 13. Under Article 12A UK GDPR (introduced by the DUAA), we must respond within one calendar month of receiving your request. Where we reasonably need further information to confirm your identity or clarify the scope of your request, for example because we hold a large volume of data about you, the one-month period runs from when we receive that information rather than from your original request. We may extend the period by a further two months for complex or numerous requests, and we will tell you within the first month if this applies.

We will carry out a reasonable and proportionate search of our records in responding to your request.

12. How to complain

Under section 164A of the Data Protection Act 2018 (introduced by the DUAA), you have the right to complain to us directly about how we handle your personal data. If you are unhappy with how we have used your personal data, you can complain to us by:

emailing our Data Protection Officer at toril@thefscgroup.com; or
writing to us at the address in Section 13.

We will acknowledge your complaint within 30 days of receiving it, and respond without undue delay, keeping you updated on progress and the outcome.

If you remain dissatisfied after raising a complaint with us, or you would prefer to complain directly, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

13. Contact us

Controller: The FoodService Centre Ltd, registered in the United Kingdom under company number 06001580
Data Protection Officer: Toril Simpson
Address: FSC Group Limited, Cheddar Business Park, Wedmore Road, Cheddar, Somerset, BS27 3EB, UK
Email: toril@thefscgroup.com
Telephone: 01934 745600 (Toril Simpson or Kate Heappey)
ICO registration number: Z9225290

14. Changes to this policy

We may update this policy from time to time to reflect changes in the law, ICO guidance, or our own processing activities. We will publish the updated policy on our website and update the version and date at the top of this document. We will also communicate material changes to employees via PeopleHR