1. Who We Are (Data Controller)

The data controller responsible for your personal information is:

Covenant Crest Group Ltd
Registered in England and Wales
Company Registration Number: 16528951
Telford, Shropshire, United Kingdom
Email: [email protected]
ICO Registration Number: ZC100629

If you have any questions about how we handle your data, please contact us at the address above with the subject line “Data Privacy Enquiry”.

2. What Personal Data We Collect

We collect personal data through the forms on our website. The specific data collected depends on which form you complete:

General Contact Form:

• Full name, email address, telephone number
• Enquiry type and message content

Haulage Quote Request:

• Name, company name, email address, telephone number
• Collection and delivery locations, load type, weight and vehicle preferences
• Preferred service level and additional requirements

Trade & Import Enquiry:

• Name, company name, email address, telephone number
• Product requirements, order quantities, frequency, preferred trade terms (Incoterms)
• Additional specification or requirements

We do not collect sensitive personal data (such as health information, financial account details, or biometric data) through our website forms.

2b. Recruitment & Candidate Data

As a registered Employment Agency and Employment Business, we process additional categories of personal data when you register as a candidate or submit a job application:

Candidate Application Data:

• Full name, contact details (email, telephone, home address)
• CV / resume and employment history
• Qualifications, certifications and professional registrations (e.g. SIA licence number, NMC Pin, FLT licence)
• Availability and preferred working patterns
• Right-to-work documentation (e.g. passport, biometric residence permit, share code)
• DBS certificate number and check outcome (enhanced or basic, as required by role)
• References from previous employers
• National Insurance number (where required for payroll purposes)

Employer / Client Data:

• Company name, contact name, job title, business email and telephone
• Site address / postcode and staffing requirements
• Compliance requirements specified at time of booking

Right-to-work documents and DBS information constitute special category or sensitive data and are handled with heightened security controls. This data is never shared beyond what is legally required and operationally necessary.

3. How We Use Your Data

We use your personal data only for the purposes for which it was submitted:

• Responding to your enquiry and providing the information or services requested
• Processing haulage and trade quotations
• Communicating with you about your enquiry or ongoing business relationship
• Maintaining internal records of business interactions
• Complying with our legal and regulatory obligations

We do not use your data for automated decision-making or profiling, nor do we use it for unsolicited marketing communications.

4. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract performance — processing is necessary to respond to your request for a service or quotation (Article 6(1)(b)).
• Legitimate interests — responding to enquiries and maintaining business records (Article 6(1)(f)), where our interests are not overridden by your rights.
• Consent — where you have explicitly given consent, such as for the use of non-essential cookies (Article 6(1)(a)). You may withdraw this at any time.

5. Cookies

Our website uses cookies. We categorise these as follows:

• Essential cookies — necessary for the website to function correctly (e.g., storing your cookie consent preference). These cannot be disabled.
• Analytics cookies — used to understand how visitors interact with the site, allowing us to improve it. These are only set with your consent.

You can manage your cookie preferences via the banner shown on your first visit, or by clearing your browser’s cookies at any time.

6. How We Share Your Data

We do not sell, rent, or trade your personal data to third parties. We may share your data only with:

• Netlify, Inc. — website hosting and form-processing provider. Form submission data is processed via Netlify’s servers (United States — see Section 8).
• Render, Inc. — backend API server hosting provider. Enquiry and application data passes through Render’s infrastructure when submitted via our website (United States).
• MongoDB Atlas (MongoDB, Inc.) — cloud database provider where enquiries, job applications, and candidate records are stored (EU region).
• Cloudinary, Inc. — cloud storage provider used to store uploaded CVs and candidate documents (United States). Files are stored securely and accessible only to authorised Covenant Crest personnel.
• HubSpot, Inc. — CRM platform used to manage client and candidate contact records for follow-up and relationship management (United States).
• Resend, Inc. — transactional email provider used to send application confirmations and enquiry acknowledgements (United States).
• Our staff and authorised personnel — who need access to respond to your enquiry or process your application.
• Legal and regulatory authorities — where we are required by law to disclose information.

All third-party data processors are bound by appropriate data processing agreements and are required to process personal data only on our documented instructions.

7. How Long We Keep Your Data

Data Type	Retention Period
General enquiries	Up to 12 months from last contact, then deleted
Haulage & trade enquiries	Up to 12 months, or 7 years if a contract arises (legal/accounting requirement)
Business transaction records	Up to 7 years (HMRC and Companies Act obligations)
Candidate CV & application data	Up to 2 years from date of registration or last active contact, then securely deleted
Right-to-work documents	As required by law — 2 years after end of employment, then securely destroyed
DBS certificate information	Outcome noted and retained for the duration of placement only; certificate not retained
Employer / client staffing records	Up to 7 years (payroll, AWR compliance, contractual obligations)
Cookie consent preferences	Until you clear your browser storage

After these periods, data is securely deleted or anonymised.

8. International Transfers

Several of our service providers (see Section 6) are headquartered in the United States. Where your personal data is transferred to and processed by these providers outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including Standard Contractual Clauses (or the UK International Data Transfer Addendum) and/or the providers’ own certified compliance frameworks. This applies to:

• Netlify, Inc. — processes form submissions and hosts our website. See Netlify’s Privacy Policy.
• Render, Inc. — hosts our backend API server, which processes enquiry and application data. See Render’s Privacy Policy.
• Cloudinary, Inc. — stores uploaded CVs and candidate documents. See Cloudinary’s Privacy Policy.
• HubSpot, Inc. — stores client and candidate contact records in our CRM. See HubSpot’s Privacy Policy.
• Resend, Inc. — processes application confirmation and enquiry acknowledgement emails. See Resend’s Privacy Policy.

You can request further details of the safeguards in place for any of these transfers by contacting us using the details in Section 1.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right	What It Means
Right of access	Request a copy of all personal data we hold about you (a “Subject Access Request”).
Right to rectification	Request correction of any inaccurate or incomplete personal data.
Right to erasure	Request deletion of your personal data, subject to any legal obligations to retain it.
Right to restriction	Request that we limit how we process your data in certain circumstances.
Right to portability	Request your data in a structured, machine-readable format for transfer to another controller.
Right to object	Object to processing based on legitimate interests; we will then stop unless we have compelling grounds.
Right to withdraw consent	Withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, please email [email protected] with the subject line “Data Subject Access Request”. We will respond within one calendar month, and free of charge for most requests. You may also write to us at: Covenant Crest Group Ltd, 28 Princess Avenue, Telford, Shropshire, TF1 2LL.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our website is served over HTTPS (TLS encryption). Form data is processed via Netlify’s secure, SOC 2-certified platform. Admin access to collected data is protected by password authentication.

No transmission over the internet can be guaranteed to be 100% secure. If you have concerns about the security of your data, please contact us immediately.

11. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] and we will endeavour to resolve your concern.

If you remain unsatisfied, you have the right to lodge a complaint with the UK’s supervisory authority:

Information Commissioner’s Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of the page. For material changes that affect how we use your personal data, we will provide prominent notice on our website and, where we hold your email address, notify you directly before the change takes effect. We encourage you to review this policy periodically.