Our Privacy Policy

External Data Privacy Policy

1. Who We Are

Multevo Ltd supplies, trains and maintains plant and equipment, provides facilities management, and delivers highway maintenance services. We process personal data under the UK GDPR and the Data Protection Act 2018.

Controller: Multevo Ltd 

Registered company number: 7308583 

Registered office: Units 1-3 Off Charles Street, Duckworth Street, Darwen, Lancashire, BB3 1BF 

Privacy contact: sar@multevo.co.uk

Multevo is not legally required to appoint a Data Protection Officer. Privacy matters are handled by our Governance & Compliance team.

2. Who This Notice Covers

• Customers & prospective customers 
• Suppliers & subcontractors 
• Website visitors 
• Job applicants 
• Learners/delegates attending Multevo-delivered training or assessments 
• Visitors to our premises (CCTV coverage applies)

Employees should refer to the Internal Data Privacy Policy.

3. What Data We Collect

• Identity & contact data 
• Business relationship data 
• Supplier/subcontractor due-diligence data 
• Learner/training data 
• Website & cookies data 
• Recruitment data (including right-to-work checks) 
• Special category data (only where volunteered for reasonable adjustments)

We do not process criminal offence data unless legally required for specific roles.

4. How We Obtain Your Data

We collect data directly from you (enquiries, bookings, applications, website forms). 

We may also receive limited information from training partners, certification bodies, applicant tracking systems, analytics providers, and public registers.

5. Purposes & Lawful Bases

We process personal data for:

• Enquiries, quotes, delivering services – Contract 
• Supplier management – Contract / Legitimate interests 
• Delivering training/assessments – Contract / Legal obligation 
• Account management – Legitimate interests 
• B2B marketing – Legitimate interests (opt-out anytime) 
• Website functionality – Legitimate interests; analytics with consent 
• Recruitment – Legitimate interests / Contract / Legal obligation 
• Legal compliance and claims – Legal obligation / Legitimate interests

Our legitimate interests include running and improving our business, maintaining records, ensuring competence and safety, and promoting our services to professional contacts.

We do not conduct solely automated decision-making.

6. Sharing Your Data

We share data only with:

• Cloud productivity and storage providers 
• CRM, proposals, and e‑signature platforms 
• Training and certification platforms 
• Telematics, fleet safety and licence-checking providers 
• Applicant tracking and recruitment systems 
• Systems integration/automation tools 
• Regulators and awarding bodies 
• Insurers, legal advisers, auditors 
• Law enforcement, where legally required

All processors operate under written contracts meeting UK GDPR Article 28 requirements.

7. International Transfers

We always aim to process your personal data within the UK/EU/EEA area.
Where data is transferred outside the UK, we use appropriate safeguards such as:

• UK IDTA 
• UK Addendum to the EU Standard Contractual Clauses 
• UK adequacy regulations 
• UK-US Data Bridge (where applicable)

Some providers may process data globally.

8. Retention

We keep data only as long as necessary:

• Customer & supplier data: contract term + up to 6 years 
• Enquiries: up to 24 months 
• Training records: typically 3 years or per awarding body requirements 
• Applicant data: normally 6 months unless consented to talent pool 

Data is securely deleted or anonymised when no longer required.

9. Your Rights

You have the following rights: access, rectification, erasure, restriction, portability, objection, and rights regarding automated decision-making. 

We handle these rights in accordance with UK data protection law, including the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
To exercise rights, email sar@multevo.co.uk. We may need to verify your identity.

10. Cookies

We use essential cookies and, with your consent, analytics cookies. 

See our Cookie Policy for full details.

11. Security

We apply appropriate technical and organisational measures including role-based access control, MFA, encryption in transit and at rest, and regular security reviews.

12. Telematics & CCTV

We operate fleet telematics and vehicle cameras for safety, compliance, and incident investigation. 

We also operate CCTV on our premises. Signage is provided. Footage is usually retained 30-90 days unless required longer. 

Lawful basis: legitimate interests and, where applicable, legal obligation.

Controllers at client sites may operate their own CCTV systems independently of Multevo.

13. Children’s Data

Our services are not targeted at children, and we do not knowingly collect children’s data.

14. Changes to This Policy

We update this notice when our data practices change. Material updates will be communicated where appropriate.

15. Contact Us

General enquiries: support@multevo.co.uk 

Privacy rights: sar@multevo.co.uk 

You may complain to the ICO at ico.org.uk, but we appreciate the chance to resolve issues first.