Data Protection and Privacy Policy

1. Purpose and scope

Savage Enterprises Ltd, trading as AES Food Equipment (“AES”), is committed to protecting personal information and respecting the privacy rights of individuals. This policy explains the standards AES applies when collecting, using, sharing, storing and deleting personal data.

This policy applies to personal data relating to customers, prospective customers, suppliers, subcontractors, employees, workers, job applicants, website users and other business contacts. It applies to information held electronically, on paper and in other formats.

AES is normally the data controller for personal data it collects for its own business purposes. Where AES processes personal data solely on another organisation's documented instructions, it will act as a data processor and comply with the applicable contractual and legal requirements.

2. Legal framework

AES will process personal data in accordance with applicable UK data protection and privacy law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Data (Use and Access) Act 2025 (DUAA), in each case as amended or replaced from time to time.

The DUAA amended the UK data protection framework rather than replacing the UK GDPR or Data Protection Act 2018. AES will keep its procedures under review as regulatory guidance develops.

3. Responsibility for data protection

The Managing Director has overall responsibility for data protection and privacy compliance within AES. AES is not currently required to appoint a statutory Data Protection Officer; day-to-day enquiries and requests are managed by the Managing Director or an authorised member of staff.

All employees who handle personal data must follow this policy, keep information secure, use personal data only for authorised business purposes and report suspected data breaches promptly.

4. Data protection principles

AES will apply the data protection principles by ensuring that personal data is:

• processed lawfully, fairly and transparently;
• collected for specified, explicit and legitimate purposes and not used incompatibly with those purposes;
• adequate, relevant and limited to what is necessary;
• accurate and, where necessary, kept up to date;
• kept for no longer than is necessary for the relevant purpose;
• protected by appropriate technical and organisational security measures; and
• processed in a way that allows AES to demonstrate accountability for compliance.

5. Personal data AES may collect

Depending on the relationship and purpose, AES may process information including:

• names, job titles, employer or business name and professional contact details;
• postal, delivery and billing addresses;
• telephone numbers and email addresses;
• enquiries, quotations, orders, purchase history, service records and correspondence;
• account, invoicing, payment and transaction information;
• supplier, subcontractor and business due-diligence information;
• website technical information such as IP address, device/browser information, cookie choices and website usage information;
• marketing preferences and records of communications;
• employee and job-applicant information required for recruitment, payroll, benefits, absence, training, performance, health and safety and employment administration; and
• other information provided to AES where it is relevant to a legitimate business or legal purpose.

AES does not intentionally retain full payment-card details where these are processed by a payment provider.

AES will only process special category personal data or criminal-offence data where there is a valid legal basis and an additional condition permitting the processing. Access will be limited to those who genuinely need it.

6. Why AES uses personal data and lawful bases

AES will identify an appropriate lawful basis before processing personal data. The most common purposes and bases are summarised below.

Where AES relies on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Where AES relies on legitimate interests, it will consider whether the use is necessary and proportionate and whether the individual's rights and interests override the business interest.

7. How AES collects personal data

AES may collect personal data directly from individuals and organisations when they contact us, request a quotation, place an order, create or manage an account, attend a meeting, apply for a role, supply goods or services, correspond with AES, subscribe to marketing or use the AES website.

AES may also receive information from manufacturers, suppliers, delivery companies, professional advisers, credit-reference or fraud-prevention services where used, publicly available business sources and other organisations where this is lawful and relevant to the business relationship.

8. Sharing personal data

AES will only share personal data where there is a legitimate need and an appropriate lawful basis. Recipients may include:

• AES employees and authorised representatives who need the information for their role;
• manufacturers and suppliers where information is needed to fulfil an enquiry or order;
• couriers, hauliers and logistics providers for collection and delivery;
• banks, payment providers, accountants, auditors, insurers and other professional advisers;
• IT, cloud-hosting, email, CRM, ERP, website and other technology service providers;
• subcontractors or service providers engaged for a specific legitimate business purpose;
• regulators, law-enforcement bodies, courts or other authorities where disclosure is legally required or reasonably necessary; and
• a prospective purchaser, investor or adviser in connection with a genuine sale, restructuring or transfer of all or part of the business.

Where a third party processes personal data on AES's behalf, AES will use appropriate contractual and organisational safeguards and will only provide the information reasonably necessary for the service.

9. International transfers

Some technology providers or other service providers may process personal data outside the United Kingdom. Where personal data is transferred internationally, AES will use an appropriate legal transfer mechanism, such as a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard or exception, as applicable.

10. Data retention

AES will keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, tax, employment, warranty, contractual and evidential requirements. Different types of information therefore have different retention periods.

When a fixed period is not prescribed, AES will consider the nature and sensitivity of the data, the purpose for which it is held, the risk associated with continued retention and whether the same purpose can be achieved with less or anonymised information.

11. Information security

AES will use proportionate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Measures may include:

• access controls, passwords and multi-factor authentication where available;
• role-based access to business systems;
• secure cloud and IT services with appropriate supplier controls;
• device, software and security updates;
• secure disposal of paper and electronic records;
• appropriate backup and recovery arrangements; and
• staff awareness and procedures for handling personal information.

12. Personal data breaches

Any employee who becomes aware of a suspected loss, disclosure, cyber incident, misdirected email, unauthorised access or other personal data breach must report it to the Managing Director immediately.

AES will assess the incident, take steps to contain and remedy it, document relevant decisions and notify the Information Commissioner's Office (ICO) and affected individuals where the law requires.

13. Individual rights

Depending on the circumstances and the lawful basis used, individuals may have rights to:

• be informed about how their personal data is used;
• request access to their personal data;
• request correction of inaccurate or incomplete data;
• request erasure of personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• receive or transfer certain personal data in a portable format;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent where processing is based on consent; and
• receive safeguards in relation to qualifying solely automated decisions.

These rights are not absolute and may be subject to legal exemptions. AES may need to verify identity before acting on a request.

14. Subject access requests and other rights requests

Requests may be made verbally or in writing. AES will normally respond to a valid request without undue delay and within one month, subject to any lawful extension, clarification or pause permitted by data protection law.

When responding to a subject access request, AES will carry out reasonable and proportionate searches for relevant personal information.

15. Data protection complaints

Anyone who is concerned about how AES has used their personal data may complain using the contact details in section 3.

AES will provide a straightforward electronic route for complaints, acknowledge a data protection complaint within 30 days and respond to it without undue delay.

Individuals also have the right to complain to the Information Commissioner's Office. Further information is available at www.ico.org.uk.

16. Direct marketing

AES may send relevant business-to-business marketing about its products and services where permitted by data protection law and PECR. Marketing communications will identify AES and provide a clear way to opt out.

Where electronic marketing is sent to an individual subscriber, including a sole trader or certain partnerships, AES will obtain consent unless the statutory products-and-services soft opt-in applies.

AES will maintain suppression or do-not-contact records where necessary to ensure marketing objections are respected.

17. Website, cookies and similar technologies

The AES website may use cookies and similar storage or access technologies for functions such as site operation, security, preferences, analytics and embedded or external media.

AES will provide clear information about the technologies it uses and their purposes.

Consent will be obtained before using storage or access technologies where PECR requires it. Where a statutory exception applies, AES may use the technology without consent only where the conditions of that exception are met.

Cookie choices may be managed through the website cookie controls where available. Browser settings may also allow users to restrict or delete cookies, although doing so may affect some website functions.

18. Third-party websites and services

The AES website may contain links to third-party websites or embedded services. AES does not control the privacy practices of independent third parties. Individuals should review the privacy information provided by those organisations when using their services.

19. Automated decision-making

AES does not normally make decisions about individuals based solely on automated processing where the decision produces legal or similarly significant effects.

If AES introduces such processing, it will identify an appropriate lawful basis, provide required information and apply safeguards required by data protection law.

20. Changes, monitoring and review

AES will review this policy at least annually and sooner where there is a significant change in law, regulatory guidance, business systems, processing activities or identified risk.

Material changes will be communicated to relevant employees and, where appropriate, reflected in the privacy information provided to customers, website users and other individuals.