Statement

We are committed to safeguarding the privacy of our website visitors; this policy sets out how we will treat your personal information.

Relevant Legislation

Our business and internal computer systems, including this website, have been designed to comply with the following national and international legislations with regards to data protection and user privacy:

• UK Data Protection Act 1988 (DPA)
• EU Data Protection Directive 1995 (DPD)
• EU General Data Protection Regulation 2018 (GDPR)

Our website’s compliance with the above legislation’s means that this site is likely compliant with the data protection and user privacy legislation set out by many other countries.

If you are unsure about whether this site is compliant with your own country of residences’ specific data protection and user privacy legislation, you should contact us.

What information do we collect?
We may collect, store and use the following kinds of personal data:

1. information about your computer and about your visits to and use of this website, such as your IP address, geographical location, browser type, referral source, length of visit and number of page views;
2. information relating to any transactions carried out between you and us on or in relation to this website, including information relating to any purchases you make of our goods or services;
3. information that you provide to us for the purpose of registering with us for our newsletters, technical documents and eZine;
4. information that you provide to us for the purpose of subscribing to our website services, email notifications and/or newsletters;
5. any other information that you choose to send to us;

Cookies
We use cookies on this website. A cookie is a text file sent by a web server to a web browser, and stored by the browser. The text file is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.

We may send a cookie which may be stored on by your browser on your computer’s hard drive. We may use the information we obtain from the cookie in the administration of this website, to improve the website’s usability and for marketing purposes. We may also use that information to recognise your computer when you visit our website, and to personalise our website for you.
Most browsers allow you to refuse to accept cookies. (For example, in Internet Explorer you can refuse all cookies by clicking “Tools”, “Internet Options”, “Privacy”, and selecting “Block all cookies” using the sliding selector.) This will, however, have a negative impact upon the usability of many websites, including this one.

We use Google Analytics to analyse the use of this website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this information. Google’s privacy policy is available at: https://policies.google.com/privacy

Using your personal data
Personal data submitted on this website will be used for the purposes specified in this privacy policy or in relevant parts of the website.
We may use your personal information to:

1. administer the website;
2. improve your browsing experience by personalising the website;
3. enable your use of the services available on the website;
4. send you general (non-marketing) commercial communications;
5. send you email notifications which you have specifically requested;
6. send to you our newsletter and other marketing communications (relating to our business;
7. which we think may be of interest to you by post or, where you have specifically agreed to this, by email or similar technology (you can inform us at any time if you no longer require marketing communications to be sent by emailing us at Info@MayfairComplianceGroup.com;
8. provide third parties with statistical information about our users – but this information will not be used to identify any individual user;
9. deal with enquiries and complaints made by or about you relating to the website;

We will not without your express consent provide your personal information to any third parties for the purpose of direct marketing.

Other disclosures
In addition to the disclosures reasonably necessary for the purposes identified elsewhere in this privacy policy, we may disclose information about you:

1. to the extent that we are required to do so by law;
2. in connection with any legal proceedings or prospective legal proceedings;
3. in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk); and
4. to the purchaser (or prospective purchaser) of any business or asset which we are (or are contemplating) selling.

Except as provided in this privacy policy, we will not provide your information to third parties.

International data transfers
Information that we collect may be stored and processed in and transferred between any of the countries in which we operate in order to enable us to use the information in accordance with this privacy policy.

 

Security of your personal data
We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

 

Policy amendments
We may update this privacy policy from time-to-time by posting a new version on our website. You should check this page occasionally to ensure you are happy with any changes.
Your rights

You may instruct us not to process your personal data for marketing purposes by email at any time. In practice, you will usually either expressly agree in advance to our use of your personal data for marketing purposes, or we will provide you with an opportunity to opt-out of the use of your personal data for marketing purposes.

Third party websites
The website contains links to other websites. We are not responsible for the privacy policies or practices of third-party websites.

 

Updating information
Please let us know if the personal information which we hold about you needs to be corrected or updated.

 

Your rights under GDPR

In particular, but without limitation, you may have the following rights under applicable European data protection law:

 

Right of access: You have the right to obtain confirmation from us as to whether or not we process personal data from you and you also have the right to at any time obtain access to our personal data stored by us. To exercise this right you may at any time contact us.

 

Right to rectification of your personal data: If we process your personal data, we shall endeavour to ensure by implementing suitable measures that your personal data is accurate and up to date for the purposes for which we collected your personal data was collected. If your personal data is inaccurate or incomplete, you have the right to obtain the rectification of such data.

Right to erasure of your personal data or right to restriction of processing: You may have the right to obtain the erasure of your personal data or the restriction of processing of your personal data.

Right to withdraw your consent: If you have given your consent to the processing of your personal data, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on the consent before the withdrawal. To exercise this right you may at any time contact us

Right to data portability: You may have the right to receive the personal data concerning you and which you have provided to us, in a structured, commonly used and machine-readable format or to transmit those data to another controller.

 

Right to object: You may have the right to object to the processing of your personal data as further specified in this Privacy Policy.

 

Right to lodge a complaint with supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority located in the European Union. You may contact the Hesse Data Protection Supervisor.

 

Contact
If you have any questions about this privacy policy or our treatment of your personal data, please write to us by post to The Managing Director, Mayfair Compliance Group, Unit C5, Coombswood Business Park East, Coombs Road, Halesowen, West Midlands B62 8BH.

 

Credit Reference and Affordability Checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

• Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority
  FCA Firm Reference Number: 742313
• TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority
  FCA Firm Reference Number: 737740

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

• Creditsafe Privacy / Transparency Notice:
  Transparency Notice | Customers & Suppliers
• TransUnion Bureau Privacy Notice:
  https://www.transunion.co.uk/legal/privacy-centre/pc-bureau

Contact details of the Data Protection Officer (DPO) 

Ian Blood - Group IT Director              email: Ian.Blood@MayfairComplianceGroup.com

Legal Basis for Processing Personal Data 

Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Depending on the activity, we rely on the following lawful bases:

• Performance of a contract – where processing is necessary to deliver services or meet contractual obligations, including obligations involving TransUnion.

• Legal obligation – where processing is required to comply with applicable laws, regulatory requirements, or statutory obligations.

• Legitimate interests – where processing is necessary for legitimate business purposes such as system security, fraud prevention, risk management, audit, and compliance, and where such interests do not override the rights and freedoms of individuals.

• Consent – where required by law, and where individuals have been provided with a clear choice and the ability to withdraw consent at any time.

Where legitimate interests are relied upon, appropriate assessments are conducted to ensure that the rights and freedoms of data subjects are protected.

 

The legitimate interests pursued by the controller (if processing is based on legitimate interests). 

Our legitimate interests include operating our business, fulfilling contractual obligations, ensuring system and data security, preventing fraud, supporting audit and compliance activities, and protecting TransUnion data. These interests are balanced against the rights and freedoms of individuals, with appropriate safeguards in place.

 

The source of personal data (if not obtained directly from the data subject). 

We may collect personal data about you from:

• you directly

• employers/clients when you apply for a role or are considered for an opportunity.

• referees (where relevant and permitted)

• publicly available sources (for example professional networking sites, business websites, and public records)

• credit reference agencies (CRAs) where required for consumer credit, identity, or affordability checks.

• third party service providers used to support recruitment, screening, and compliance processes.

 

The data retention period (how long data will be kept).

We keep personal data only for as long as necessary for its purpose and to meet legal or regulatory obligations. Data used for credit reference or affordability checks is retained only for as long as required and then securely deleted.

 

The right to lodge a complaint with the Information Commissioner’s Office (ICO) or another supervisory authority.

You have the right to complain to the UK Information Commissioner’s Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data.

A statement of whether the provision of personal data is statutory or contractual, and the possible consequences of not providing it. 

 

Provision of Personal Data

Is the provision of personal data statutory or contractual?

The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations.

Personal data is required to:

• enter in to and perform contracts with customers, suppliers, or business partners.

• process orders, manage accounts, and deliver goods and services.

• verify identity and prevent fraud; and

• comply with applicable legal, regulatory, accounting, and tax obligations.

 

What are the consequences of not providing personal data?

If you choose not to provide the personal data, we request:

• we may be unable to enter into a contract with you.

• we may be unable to fulfil orders, supply goods, or provide services.

• we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and

• as a result, our services may be delayed, restricted, or declined.

Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us.

 

We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.

These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.

The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.

 

Last Updated: 10^th September 2026