Privacy policy
Privacy Notice
(How we use your personal information)
Document No: AMSPOL011
arbnco Ltd is committed to protecting and respecting your privacy. This privacy notice explains when and why we collect personal information about you, how we use it, the conditions under which we may disclose it to others, how we keep it safe and secure and your rights and choices in relation to your information.
This Privacy Notice applies to our customers, users of our software services or website, or visitors of our premises, potential applicants to our vacant job positions, and any other business contacts such as suppliers or contractors.
We have a separate Privacy Notice for our employees available on request.
Who are we?
arbnco is a registered Company having our Registered Office at Inovo – Ground Floor Suite F, 121 George Street, Glasgow, G11RD
arbnco takes the issue of security and data protection very seriously, including compliance with the UK General Data Protection Regulation, the UK Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations.
We are registered as a data controller with the Information Commission, the independent body that upholds information rights in the UK, overseeing data protection legislation.
Our registration details are shown below:
Company Name: arbnco Ltd
Company Address: Inovo – Ground Floor Suite F, 121 George Street, Glasgow, G11RD
Registration Number: ZA416552
Why do we need your personal data?
You may have obligations under your contract / potential contract with us to provide us with the necessary personal data. If you do not provide this information, this may prevent our ability to enter into or maintain a contract with you.
How do we collect information from you?
We may collect your personal information directly from you, or we may receive it indirectly. See the below tables which break down how we collect your personal data in both these instances.
How we collect your data (directly)
- when you register an account with us for the provision of any of our services, when you make an enquiry via telephone or via our website, or otherwise provide us with your personal details from your arrangements to make payment to us
- during visits to our premises
- when you use our website, through the use of Cookies on our website, or our website analytics
- when you enter information on our website, including our Contact Us form, or attend an online virtual meeting in platforms such as Zoom and Teams
- from your use of any of our other online services, website, social media, etc
- if you apply for a job with us
- where we are establishing a business relationship with you, as our prospective business partner, supplier or contractor
How we collect your data (indirectly)
- your information may be shared with us by third parties, which might include subcontractors acting on our behalf who provide us with technical, payment or other services and our business partner
- we may receive information from our third-party sources, which may include energy suppliers, network operators, property managers, and publicly available data sources
- when you visit our website, we place Cookies on your device to run the website, and we may also receive your data from third-party Cookies. For more information about Cookies and how we use them please see our Cookie Notice
- when we collect your personal data via automated data collection: including smart meters, IoT sensors, or analytics tools tracking your energy usage
- when you interact with us on social media platforms such as Facebook and Twitter, we may obtain information about you (for example, when you like or post on our Facebook page). The information we receive will depend on the privacy preferences you have set on those types of platforms. You should check any privacy policy / notice provided to you where you give your data to a third party, for example, when you post to our Facebook page
- when you are noted as the reference of an applicant during our recruitment process
when you are noted as the emergency contact or next of kin of an employee - when we are contacted by local authorities and law enforcement in relation to ongoing investigations
What personal data do we collect and how do we use it?
We collect and use a variety of personal information to manage our relationship with you. The table below shows the typical categories of personal data we process.
|
What will we collect |
How we will use it |
|
Name, title, gender, date of birth |
We use this to identify you and to manage our relationship with you. We will also use this as required for any documentation and work records that we maintain. |
|
Address |
We use your address to identify you and correspond with you. We will also use this as required for any documentation and work records that we maintain. We may also use your address information in order to conduct market research and reviews, to help develop and improve the products and services we offer. |
|
Email address, telephone number & mobile number |
We use your email address, telephone number and mobile number, known as contact information, to correspond with you. We will also use this as required for any documentation and work records that we maintain, or if you are a reference or emergency contact for an employee / applicant. We may also use your contact information in order to conduct market research and reviews, to help develop and improve the products and services we offer. |
|
Qualifications, skills, work experience, previous employers, CV’s |
We use this information in relation to applicants, for making recruitment and role-based decisions. |
|
Employment information |
We use this information when engaging with prospective and current suppliers, contractors, and other business contacts. |
|
Bank account details & Signatures |
We use this to carry out our supplier, contractor or other business contacts payment and contractual responsibilities. Note, these may only constitute your personal data, in some instances, where you are a sole trader. |
|
Online identifiers and Device Information, such as social media profiles, IP addresses, browser type, etc |
We use this to respond to you when you have communicated to us via social media, or when we conduct analytics on the usage of our website for continual improvement purposes. |
|
Race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation
|
We use this for our equality monitoring purposes. |
|
Energy Data, including Consumption, Energy performance, Building and Asset data, etc
|
We require this data in order to provide our energy analytics and improve the energy efficiency and carbon performance in buildings and operations, to meet our regulatory and legal obligations, including carbon reporting or energy efficiency regulations, and to improve our energy analytic tools, develop new features, and enhance user experience. |
|
Enquiry and Communications
|
We process any information you share with us via any form of communication, in order to respond to you and answer any query or questions you may have, and to continually improve our service. |
All of the above information will also be used generally:
• to undertake and perform our obligations and duties to you in accordance with the terms of our contract/agreement either with you or another person
• to enable us to supply you with the services and information which you have requested, and
• for all other purposes consistent with the proper performance of our operations and business
If you are an unsuccessful applicant during our recruitment processes, any application / recruitment data processed will be retained for six months, so that we may contact you if a similar job becomes available.
Unless interviewed as part of a formal resident labour market test where guidance is stipulated by the Government
Lawful basis for processing personal data
Under UK data protection laws, where we process your personal information, we need to have a valid lawful basis. We will only process your personal information where at least one of the following legal bases applies.
| Lawful basis | Description |
| Consent | You have provided clear consent for us to process your personal data for a specific purpose. |
| Contract | The processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering into a contract. |
| Legal Obligation | The processing is necessary for us to comply with the law or legal requirement. |
| Vital Interests | The processing is necessary to protect someone’s life. |
| Public Task | The processing is necessary for us to perform a task or function in the public interest, where that task or function has a clear basis in law. |
| Recognised Legitimate Interests |
Newly added as per the Data (Usage and Access) Act 2025, a list of pre-approved processing purposes, for which personal data may be processed. This list, as per the act becoming law on June 19th, 2025, includes: • National security • Public security • Defence • Responding to emergencies • Preventing or detecting crime • Safeguarding children or individuals at risk
|
|
Legitimate Interests
|
The processing is necessary for our legitimate interests, or the legitimate interests of a third party, where those interests are not overridden by your interests or rights as a data subject. Our legitimate interests for processing your personal data include: • Telephone Call Recordings • Reference Requests • Website Analytics • Responding to Enquiries; and • Conducting Direct Marketing
When we legitimately process your personal information in this way, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information where our interests are overridden by the impact on you, for example, where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).
|
Special Category Data
Special categories of personal information means any information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, genetic data, or biometric data, held in such a way that can uniquely identify you.
We may use your special category personal information, including but not limited to, the following ways:
- We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
- We use this in order to provide you with any additional or specialised support or services you may need during your engagement with us, including during the application process.
Where we process your special category data, our legal basis for processing this will be one of the following:
(a) Explicit consent
(b) Employment, social security and social protection (if authorised by law)
(c) Vital interests
(d) Not-for-profit bodies
(e) Made public by the data subject
(f) Legal claims or judicial acts
(g) Reasons of substantial public interest (with a basis in law)
(h) Health or social care (with a basis in law)
(i) Public health (with a basis in law)
(j) Archiving, research, and statistics (with a basis in law).
Similarly, we also process criminal convictions and offences data, including personal information relating to offences or alleged offences. Criminal convictions and offences data is not classed as special category data, albeit it also requires a higher level of protection, and requires additional legal requirements for lawfully processing it.
For example, if relevant for your application for a job role, we will process criminal convictions data provided by Disclosure Scotland.
Links to other websites
Our website may contain links to other websites run by other organisations. This privacy notice applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other websites even if you access those using links from our website.
In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the privacy notice of that third party site.
Change of Purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason, and that reason is compatible with the original purpose.
Who has access to your information?
The information you provide to us will be treated in accordance with data protection law. Depending on your type of contract or other business relationship with us, we may disclose your personal data to any of our employees, officers, contractors, insurers, professional advisors (including legal advisers and our Data Protection Officer), agents, suppliers or subcontractors, selected third parties, government agencies and regulators for the purposes set out in this notice, or for purposes approved by you, including the following:
• if we enter into a joint venture with, or merge with, another business entity.
• if required by law, we will disclose your information to statutory bodies such as auditors or solicitors, or to local authorities and law enforcement.
• where we have your consent to do so.
• if we are conducting a survey of our services, your information may be disclosed to third parties assisting in the compilation and analysis of the survey results; and
• we may pass your information to our third-party service providers, suppliers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf. This includes software providers, IT technical services providers, payment providers, cloud services providers, etc
Unless required to do so by law, we will not otherwise share, sell or distribute any of the information you provide to us without your consent.
How long is your information kept for?
We only keep your personal data only for as long as we need to, in order to manage your relationship with us and comply with legal and regulatory requirements. Our retention periods are defined within our Data Retention Policy and Schedule.
Where do we keep your data?
Your information will only be stored within the United Kingdom except where international transfers are authorised by law.
How do we keep your data safe?
When we are provided with personal data, we take steps to make sure that your personal information is kept secure and safe. All data is held in accordance with arbnco’s data protection policies and procedures. Our systems are password protected, and all electronic data is stored securely, with encryption enabled during transit and at rest. Additionally, we utilise Microsoft 365 and its associated security features in order to protect your personal data, such as access management controls, data classification controls, and more. We conduct regular security assessments to prevent unauthorised access, loss, or misuse of the data we process. All paper files are kept in secure locked cabinets.
What rights do you have in relation to your personal data?
You have a number of rights in relation to the personal information we hold about you. These rights are not always absolute and certain conditions may apply.
| Right | Description |
| Right to be informed about how we process your personal data. | You have the right to be informed about the collection and use of your personal data. |
| Right to access your personal data (commonly known as a “Subject Access request” (‘SAR’). | You have the right to request a copy of the personal data that we hold about you. |
| Right to rectification of the personal data that we hold about you. | You have the right to ask us to rectify personal data that you believe is inaccurate or incorrect. This includes the right to have information completed which you believe to be incomplete. |
| Right to be forgotten / right to erasure of your personal data. | You have the right to ask us to erase your personal information in certain circumstances. |
| Right to object to processing of your personal data. | You have the right to object to the processing of your personal data in certain circumstances. |
| Right to the restriction of processing of your personal data. | You have the right to ask us to restrict the processing of your personal information in certain circumstances. |
| Right to data portability | You have the right to ask that we transfer the personal data that you provided us with to another organisation, or to you, in certain circumstances. |
| Right not to be subject to an automated decision | When a decision is based on automated processing, and produces an adverse legal or similarly significant effect, you have a number of rights in relation to that decision. |
You can request any of these rights by using the Data Protection Officer (‘DPO’) contact details at the bottom of this privacy notice.
Monitoring Purposes
We may from time to time carry out monitoring activities. This will only be undertaken in limited circumstances, where we have a valid lawful basis to do so and having due regard to your privacy and rights. Monitoring can be undertaken to help determine misconduct or fraud, for your safety and protection at our premises, or for training purposes. We will carry out the following monitoring exercisies:
- Telephone Call Recordings – for training and monitoring purposes
Queries and Complaints
If you have any concerns about how we collect, use, share or keep your personal data, you think there has been a breach, you wish to make a complaint regarding the processing of your personal information, or you have a question or concern about anything in this notice, please contact us via 0141 559 7130 or info@arbnco.com.
Our Data Protection Officer is provided by RGDP LLP and can be contacted either via info@rgdp.co.uk.
If you have already made a complaint to us, and you are not satisfied with the outcome, you then have the right to complain to the Information Commission regarding any concerns about how we collect, use, share or keep your personal data. You may contact them at:
Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Telephone: 0303 123 1113
Web: ico.org.uk
You also have the right to seek other judicial remedy.
Changes to this privacy notice
Any changes we may make to this Privacy Notice in the future will be posted on our website, so please check occasionally to ensure that you’re happy with any changes. If we make any significant changes to the way we process your personal data, we’ll make this clear on our website.
Approved By:
Maureen Eisbrenner
Co-Founder & CEO
Date: 01 April 2026
Review: 01 April 2027
Issue No: 005
