Purpose
Barbarian Facilities Management Limited handles personal data about clients, job applicants, employees and contractors. This policy explains how we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It should be read together with our Privacy Policy.
Our principles
- Lawfulness, fairness and transparency: we tell people how we use their data and only process it where we have a lawful basis
- Purpose limitation: we collect data for specified purposes and do not use it in incompatible ways
- Data minimisation: we collect only what we need
- Accuracy: we keep data up to date and correct errors promptly
- Storage limitation: we keep data no longer than necessary
- Integrity and confidentiality: we protect data against loss, damage and unauthorised access
Security practices
- Access to personal data is limited to people who need it for their role
- Devices and accounts are protected with strong passwords and, where available, multi-factor authentication
- Paper records, CCTV footage and screening documents are stored securely and disposed of safely
- Suppliers who handle data for us are required to protect it appropriately
Individual rights
People have the right to be informed, to access their data, to have it corrected or erased, to restrict or object to processing, and to data portability, where these rights apply. Requests can be sent to info@barbarianfm.co.uk and we will respond within one month.
Data breaches
Any suspected breach must be reported internally straight away. We assess every incident, take steps to contain it and, where required, notify the Information Commissioner's Office within 72 hours and inform the people affected.
Review
We review this policy annually and whenever the law or our processing changes.
Last reviewed: October 2026. Questions about this policy can be sent to info@barbarianfm.co.uk.