Privacy Policy

Thomson Privacy Policy for Clients, Suppliers, Candidates and Other Individuals

Last updated: November 2025

This privacy policy explains how Thomson Environmental Consultants Ltd (Thomson) collects, uses, stores, and protects personal information relating to our clients, suppliers, and other individuals (“you”, “your”).

For clarity, Thomson refers to any of the following entities:

Thomson Environmental Consultants Ltd
Thomson Ecology Ltd
Thomson Habitats Ltd
Thomson Unicomarine Ltd

Thomson acts as the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What personal information we collect

We collect and process personal data for business purposes only. The types of personal data we may collect include:

Organisational information such as company name, address, and telephone number
Personal contact information such as your name, job title, business email address, and business contact numbers
Financial and contract information such as your organisation’s bank account details or purchase order information (for invoicing and payment)
Website and communication data including information you provide via our website contact forms or when subscribing to our marketing emails
Technical information (via cookies and analytics) such as IP address, browser type, and website usage data collected through Google Analytics

We do not intentionally collect special category (sensitive) personal data or data relating to children.

How and why we use your personal information

We process your personal information only where we have a lawful basis under the UK GDPR. The purposes and corresponding lawful bases are as follows:

Purpose	Lawful Basis
To fulfil a contract with you (e.g., providing consultancy services, managing projects, paying suppliers)	Contractual necessity (Article 6(1)(b))
To manage our business relationship, communicate about projects, and maintain records	Legitimate interests (Article 6(1)(f))
To send marketing emails and news updates to individuals who have opted in	Consent (Article 6(1)(a))
To comply with legal and regulatory obligations (e.g., tax, auditing)	Legal obligation (Article 6(1)(c))

You may withdraw your consent or object to our processing at any time (see “Your Rights” below).

How we store and protect your personal data

Your data is stored securely on Thomson’s internal systems and approved cloud platforms.
We apply appropriate technical and organisational security measures to protect your data from unauthorised access, alteration, disclosure, or destruction.

Where data is stored or processed outside the UK (for example, through Microsoft 365 or Google Analytics), we ensure that appropriate safeguards are in place such as UK adequacy decisions or International Data Transfer Agreements (IDTAs) approved by the Information Commissioner’s Office (ICO).

Data sharing

We may share your data only where necessary for the purposes described above. Examples include:

Service providers and professional advisers who support our business (e.g., IT hosting, accountants, legal advisors)
Regulatory authorities where required by law

All third parties acting as data processors on our behalf are subject to strict contractual obligations to process your data only under our instructions and maintain appropriate security measures.

Data retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or to comply with legal, accounting, or reporting obligations.

Client project files: retained for up to 15 years after project completion, to support future reference or regulatory requirements.
Supplier details: retained for up to 10 years after last engagement, to facilitate potential future use.
Marketing contact data: retained until you withdraw consent or opt out of receiving communications.
Website enquiries: retained for up to 10 years unless you request deletion sooner.

We review data periodically and securely delete information that is no longer needed.

Cookies and website analytics

Our website uses cookies and Google Analytics to collect anonymous data about how visitors use our site.
Cookies help us improve our website experience and performance. You can control or delete cookies via your browser settings.

For more information, please see our Cookie Policy (link to your cookie policy page).

Your rights under UK GDPR

You have the following rights in relation to your personal data:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to correct inaccurate or incomplete information.
Right to erasure – to request deletion of your personal data where it is no longer needed or processed unlawfully.
Right to restrict processing – to request that we limit how we use your data.
Right to data portability – to request your data in a structured, machine-readable format.
Right to object – to object to our processing of your data (e.g., for marketing).
Right to withdraw consent – where processing is based on consent (e.g., marketing emails), you can withdraw consent at any time.

To exercise your rights, please contact us at [email protected].

You also have the right to raise a complaint with the Information Commissioner’s Office (ICO):
https://ico.org.uk/concerns

Marketing communications

We only send marketing emails to individuals who have explicitly opted in.
To unsubscribe, click the ‘unsubscribe’ link at the bottom of any marketing email.
If you unsubscribe, we will retain a record of your email address solely to ensure no further communications are sent.

Information Collected During the Recruitment Process

When you apply for a role with Thomson (either directly or via a recruitment agency), we collect, process and store personal information as part of our recruitment and selection procedures.

What we collect

The personal data we may collect includes:

Your name, contact details (email, phone number, address)
Application forms, curriculum vitae (CV), cover letter, employment and education history
Compensation ie salary and benefits
Qualifications, professional memberships, tickets and accreditations
Employer and personal references
Interview notes, assessment exercises and outcomes
Proof of identity and eligibility to work in the UK (e.g. passport, visa documentation)
Medical fitness forms
Equal opportunities information (if voluntarily provided, such as gender or ethnicity — this is classed as special category data and processed only for monitoring and diversity purposes)

Why we collect this information

We use this data to:

Assess your suitability for the role you have applied for
Communicate with you about your application
Comply with legal and regulatory requirements (e.g. right-to-work checks)
Keep records of our recruitment decisions

Lawful basis for processing

Purpose	Lawful Basis
Assessing applications and communicating with candidates	Legitimate interests (recruitment and selection)
Entering into a potential employment contract	Contractual necessity
Conducting right-to-work checks and complying with employment law	Legal obligation
Equal opportunities monitoring	Legal obligation and legitimate interest

Recruitment data retention

Type of Record	Typical Retention Period	Lawful basis
Unsuccessful applicant data (CVs, cover letters, interview notes)	6–12 months after the recruitment process ends	6–12 months under Equality Act 2010
Shortlisted candidates for future roles (where Thomson has obtained consent to keep your their data)	Up to 24 months	Consent of candidate after the 6-12 month period stipulated by the Equality Act 2010
Successful applicant data	Transferred to the Thomson HRIS (Human Resource Information System) and also your personal e-folder and retained in compliance with employment law guidance which is 6 years after employment ends.	Employment law compliance.
Right-to-work documentation	2 years after employment ends	Immigration, Asylum and Nationality Act 2006
Criminal Conviction	When the conviction is spent	Rehabilitation of Offenders Act
Equality monitoring data (special category data)	Where possible to retain only in anonymised or aggregated form	Required for either legal reporting or for legitimate interest to ensure equality of opportunity. Article 6 UK GDPR, Article 9 UK GDPR & Schedule 1 DPA 2018

Contact us

If you have any questions or concerns about this privacy policy or how we handle your personal data, please contact us at:

Thomson Environmental Consultants
Email: [email protected]
Phone: 01483 466000