Privacy notice updates
We review this Privacy Notice regularly to ensure it remains accurate and reflects changes to our services, legal requirements, and business practices.
Where significant changes are made, we will update the effective date and publish the revised version on our website.
Previous versions of this Privacy Notice are available below:
Who are we
Equator (Scotland) Ltd. is the data controller responsible for the personal information described in this Privacy Notice.
Registered Office: 58 Elliot Street, Glasgow G3 8DZ
Company Registration Number: SC435086
Telephone: 0141 229 1800
For privacy-related enquiries, please contact:
Head of Compliance (Privacy Lead)
Grant Dickson
Email: gdpr@eqtr.com
What information do we collect?
Depending on how you interact with us, we may collect and process:
- Name
- Job title
- Employer or organisation name
- Business address
- Business telephone numbers
- Business email addresses
- Communications with us (email/video call/voicemail)
- Website usage information
- IP address
- Device and browser information
- Cookie preferences
- Recruitment information, including CVs, references, qualifications and personal contact details
- Basic visitor information when attending our premises
- Onsite CCTV
How do we collect your information?
Directly from you
We collect information when you:
- Submit an enquiry
- Contact us by telephone or email
- Subscribe to communications
- Register for an event
- Complete website forms
- Apply for a vacancy
- Visit our offices
Indirectly
We may collect professional contact information from publicly available sources, such as company websites, where there is a legitimate business reason for doing so.
Why do we process your information?
We only process personal data where we have a lawful basis under UK GDPR.
Legitimate interests statement
In certain circumstances, Equator processes personal information on the lawful basis of legitimate interests under Article 6(1)(f) UK GDPR.
Before relying on legitimate interests, we consider and balance:
- The purpose and necessity of the processing;
- The potential impact on individuals;
- The reasonable expectations of the individuals concerned; and
- Appropriate safeguards to protect personal information and privacy rights.
We rely on legitimate interests for activities including:
- Responding to business enquiries;
- Managing client and supplier relationships;
- Promoting our services to existing business contacts where permitted by law;
- Maintaining and improving our website and services;
- Protecting our systems, networks and information assets;
- Preventing fraud, misuse and unauthorised access;
- Managing recruitment processes; and
- Ensuring the security and safety of our employees, visitors, premises and business operations.
Where we rely on legitimate interests, we ensure that our interests are not overridden by the rights and freedoms of individuals.
You have the right to object to processing based on legitimate interests. Where an objection is received, we will carefully consider the circumstances and cease processing unless we can demonstrate compelling legitimate grounds to continue.
Do we share your information?
We do not sell personal information and we do not share personal information with third parties for their own direct marketing purposes.
We use carefully selected third-party service providers to deliver elements of our services. These may include:
- Microsoft 365
- Microsoft Azure
- HubSpot
- Google Analytics
- LinkedIn/Instagram/Facebook
- Telecommunications providers
- Recruitment platforms
- Website hosting providers
- Security service providers
All processors are subject to contractual obligations requiring them to process personal information only on our instructions and to maintain appropriate security measures.
Do we process children's information?
Our services are not directed at children and we do not knowingly collect personal information from children.
Do we send your information outside the UK?
Some of our service providers may process personal information outside the United Kingdom.
Where personal information is transferred internationally, we ensure appropriate safeguards are implemented in accordance with UK GDPR, including:
- UK Adequacy Regulations;
- UK International Data Transfer Agreement (IDTA);
- UK Addendum to the EU Standard Contractual Clauses;
- Other recognised transfer mechanisms permitted by law; and
- The EU-US Data Privacy Framework, where applicable.
These measures are designed to ensure your personal information receives an equivalent level of protection wherever it is processed.
How do we protect your personal information?
We maintain appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, disclosure, alteration or destruction.
These measures include:
- Encryption of data in transit;
- Role-based access controls;
- Least-privilege access management;
- Multi-factor authentication;
- Security monitoring and logging;
- Secure backup processes;
- Supplier due diligence and risk assessments;
- Staff privacy and security training; and
- Incident response and breach management procedures.
Access to personal information is limited to authorised personnel who require access for legitimate business purposes.
We regularly review our technical and organisational security measures to ensure they remain appropriate to the nature, scope, context and risks associated with our processing activities.
How long will we keep your information?
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, regulatory and business requirements.
Retention periods may be extended where necessary to establish, exercise or defend legal claims, comply with legal obligations, or where a regulatory authority requires us to do so.
Where information is anonymised so that individuals can no longer be identified, it may be retained for statistical, analytical and reporting purposes.
Marketing Communications
We may send information about our services, events, industry insights and other business-related content that may be relevant to you.
We rely on:
- Consent where required under the Privacy and Electronic Communications Regulations (PECR); and
- Legitimate interests where permitted by law.
You can opt out of marketing communications at any time by:
- Clicking the unsubscribe link in our emails; or
- Contacting us directly.
Opting out of marketing communications will not affect essential service-related communications.
Website, Analytics and Cookies
We use cookies and similar technologies to:
- Enable website functionality;
- Improve website performance;
- Understand visitor behaviour; and
- Support security monitoring.
Where required, we obtain consent before setting non-essential cookies.
Further information about our use of cookies can be found in our separate Cookie Policy and Cookie Preference Centre.
Office Visitors and CCTV
When visiting our offices:
- Visitor details may be recorded through our visitor management system.
- Visitor logs are retained for 90 days.
- CCTV operates inside and outside the building for security and safety purposes.
- CCTV recordings are retained for 30 days unless required for investigation purposes.
- Visitors may be provided with access to guest Wi‑Fi services.
Where visitor Wi‑Fi is provided, technical connection information may be logged to maintain the security, performance and operation of the network.
Automated Decision Making
Equator does not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
Should this position change, we will update this Privacy Notice and provide appropriate safeguards in accordance with applicable data protection legislation.
Your Data Protection Rights
Under UK data protection law, you have the right to:
Right of Access
Request a copy of your personal information
Right to Rectification
Request correction of inaccurate or incomplete information
Right to Erasure
Request deletion of personal information in certain circumstances
Right to Restrict Processing
Request that processing is limited in certain situations
Right to Data Portability
Receive your personal information in a structured, commonly used and machine-readable format and request transfer to another organisation where applicable
Right to Object
Object to processing based on legitimate interests or direct marketing
Rights Relating to Automated Decision Making
Request human intervention where automated decisions significantly affect you
- To exercise any of these rights, please contact the privacy team using the details below.
- We may ask for proof of identity before processing your request.
- We will normally respond within one month, although this period may be extended where permitted by law.
Part Two
Recruitment
If you apply for a role with Equator, we will process the information you provide to:
- Assess your suitability for employment;
- Communicate with you regarding vacancies;
- Verify qualifications and employment history;
- Carry out right-to-work checks; and
- Conduct any legally required statistical pre-employment screening.
Information provided during recruitment is only accessible to authorised personnel involved in the recruitment process.
Where candidates are unsuccessful, we may retain their details for future opportunities where consent has been provided.
Complaints
If you have concerns about how we process your personal information, please contact us first so that we can try to resolve the issue.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113
Contact us
If you have any questions about this Privacy Notice, wish to exercise your rights, or would like further information about how we process your personal information, please contact:
Head of Compliance
58 Elliot Street
Glasgow
G3 8DZ
Telephone: 0141 229 1800
Email: gdpr@eqtr.com
Concerned about how we process your information?
Please get in touch if you have any questions about our privacy practices: