Privacy Policy.

Arnett UK Ltd, part of Red Sky Group, acts as the data controller for personal data collected through this website.

This Privacy Policy covers personal data collected through the marketing pages of this website, our contact form, brochure and enquiry requests, and applications to open an Arnett UK account.

If you apply to join Arnett UK as an operative, the personal data collected during the application, screening and vetting process is governed by a separate Candidate Privacy Notice, which is provided to you at the point of application.

If you are an authorised user of our client portal, your use of the portal is also governed by our Terms of Use.

A. Information you provide. When you submit our contact form or request a brochure: your name, organisation, email address, telephone number where required or provided, the nature of your enquiry and the content of your message.

When you apply to open an account, we collect the information set out in section 8A.

B. Website usage, cookies and similar technologies. This website does not use analytics or advertising technologies. We do not set analytics or advertising cookies, we do not use Google Analytics, Google Ads, advertising pixels or marketing trackers, and we do not track you across websites. Should we introduce privacy-focused, cookieless analytics in the future, we will update this Privacy Policy before doing so.

We do use a small number of strictly necessary cookies. These keep you signed in to the client portal, protect against cross-site request forgery, and, where you begin an account application, hold a first-party identifier so that a part-completed application is kept separate from anyone else's. That identifier lasts fourteen days and is not readable by scripts in your browser. These cookies are processed by our hosting provider as part of delivering the service. They are not used for profiling, advertising or cross-site tracking.

Our contact, brochure and account application forms use Cloudflare Turnstile to distinguish real people from automated submissions. Turnstile loads a script from Cloudflare and may set its own storage in your browser. It processes limited technical security data, including your IP address, browser and user-agent information and security signals. It does not receive the contents you enter into the form. It exists to protect the forms from abuse and it is not used for advertising or analytics. Cloudflare's own privacy information applies to what it collects.

Contact form, brochure requests and enquiries: we process your data to respond to your enquiry and to follow up about the services you have expressed an interest in. Our lawful basis is our legitimate interest in responding to and managing business enquiries made to us.

Account applications: see section 8A.

Where we are required to retain or disclose information by law, our basis is legal obligation.

We do not sell personal data.

We use selected third-party providers to operate this website and to process enquiries and applications. These include our application hosting provider, our database provider, a transactional email delivery service, a bot-protection service, a rate-limiting service used to prevent abuse of our forms, and a customer relationship management system.

These providers generally act as processors when handling personal data on our instructions. Some providers may separately act as controllers for limited account, security, abuse-prevention or service-generated data, as explained in their own privacy information.

Where you give us a company registration number as part of an account application, we look that number up on the Companies House public register. We send the company name or registration number to Companies House. We do not send the applicant's contact details.

Our database is hosted in the United Kingdom (London), and the application functions that handle this website, our forms and our client portal execute in the United Kingdom (London).

Requests to our client portal pass through an access check distributed across our hosting provider's global network. This involves limited technical request data, including the IP address, requested URL, request headers and the presence of a session cookie. The access check uses the requested path and cookie presence to allow the request or redirect it to sign-in. It does not query our database or access candidate, order or account content.

Several of our providers are established outside the United Kingdom, and their support, logging and backup operations may involve access from outside the UK. Where that occurs we rely on appropriate safeguards recognised under the Data Protection Legislation, including UK International Data Transfer Agreements or Standard Contractual Clauses together with the UK Addendum, and supplementary measures where necessary.

We keep personal data only for as long as it is necessary for the purpose it was collected for. Our full retention schedule sets out the detail.

Contact form, brochure request and enquiry records: 24 months after the last meaningful interaction with us, unless a business relationship develops or we are required to retain the data for longer to meet a legal obligation.

Unsuccessful, abandoned or withdrawn account applications: 12 months after the last activity or decision.

Successful account applications, together with the approval and the associated commercial evidence: for the life of the account and six years after the account closes, so that we can meet our legal, accounting and tax obligations and deal with any claim brought within the limitation period.

Invitation links expire automatically. Associated invitation and nominated-user records are retained only for as long as needed to administer access, investigate misuse and maintain necessary audit evidence.

You can ask us to delete your personal data and we will do so unless we have a lawful reason to keep it.

When you request a brochure or make an enquiry through our website, we collect your name, company name, business email address and any information you choose to include in your message. We use this information to send you the material you requested, to respond to your enquiry, and to follow up with you about our services where you have expressed an interest in them. Our lawful basis is legitimate interests: responding to and following up business enquiries made to us.

We do not use this information for unrelated marketing and we do not sell it. It is shared only with the providers described in section 5. We keep enquiry records for the period set out in section 7. You can ask us to stop contacting you or to delete your details at any time using the contact details in this notice.

This section applies when someone applies to open an Arnett UK account, whether online, by returning our account-opening form, or by asking us in writing to set one up.

What we collect

From the person completing the application: your name, your job title, your work email address, and the date and text of the declaration you accept.

About the people you name on the application: full name, work email address, job title, the business function or responsibility recorded for them, and whether portal access is proposed and, if so, the role you give them. We record this for every named contact, including primary, accounts, billing and operational contacts, whether or not you ask us to give them portal access. A telephone number is required for the primary contact and for anyone you propose as an account administrator, so that we can reach an authorised representative urgently about account access or a live pass matter. It is optional for every other named contact.

About your organisation: legal entity name, trading name, company registration number, VAT number, nature of business, registered, trading and billing addresses, invoice email address, payment terms requested, purchase order requirements, expected volume and expected start date.

The account application record stores only a keyed hash of the IP address used at submission, not the address itself. Our hosting and security providers may separately process ordinary connection and security log information.

Companies House

Where you give us a company registration number, we look it up on the Companies House public register and record what it returned: the company number, name, status and registered office, and the date we looked it up. We keep both what the register said and what you told us. No application is approved by that check or by any other automated process. A member of our staff reviews every application.

Why we do this

We use this information to assess the application, to establish and administer the business relationship, to configure the account, to manage authorised portal access, and to invoice the organisation correctly.

For business contacts and nominated users, our lawful basis is our legitimate interests in assessing prospective clients, administering client relationships, protecting account access and keeping appropriate commercial records.

Where the person applying is personally entering into the contract, for example as a sole trader, we may also process information where necessary to take steps at their request before entering into that contract.

If someone gives us your details

An organisation may name you on an account application, or give us your details when we set up its account, because you are one of the people we will need to deal with. That happens whether or not portal access is proposed for you. You may be named as the primary contact, as an accounts, billing or operational contact, as a proposed portal user, or in more than one of those capacities.

What we hold about you is your business contact details: your name, your job title, your work email address, the business function or responsibility the organisation recorded for you, and your telephone number where it is required or you have provided it. We hold them to set up and administer that organisation's account and to reach the right person about it. Our lawful basis is our legitimate interests in administering a client relationship and in reaching an authorised representative about the account.

We will provide this privacy information to you directly when we first contact you and, in any event, within the period required by data protection law. That applies however your details reached us, whether the organisation named you on an online application or gave them to us on our account-opening form or in writing. Where no portal access is proposed for you, your details are used only to administer that organisation's account and to contact you in the capacity you were named in. Where portal access is proposed, your details are used only to administer the application and the proposed access until that access is authorised.

You can object to this processing at any time, and you can ask us to correct or delete your details, by emailing team@arnett-uk.com. You can also complain to the Information Commissioner's Office, at https://ico.org.uk/make-a-complaint. Section 9 sets out these rights in full.

How long we keep it

The retention periods for account applications are set out in section 7.

Under UK GDPR you have the right to access your personal data, to rectify inaccurate data, to request erasure, to restrict processing, to data portability where it applies, and to lodge a complaint with the ICO.

You also have the right to object. Where we rely on legitimate interests, you can object to that processing at any time. If you object, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

To exercise your rights: team@arnett-uk.com

Information Commissioner's Office: https://ico.org.uk/make-a-complaint or 0303 123 1113.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. Access to enquiry and application data is restricted to authorised personnel only. Access links and invitation tokens are stored only as a hashed value and expire automatically.

We may update this Privacy Policy from time to time. The current version will always be available on this page with the updated date.