1. Who we are
Our website address is: https://hendersonwarnock.com.
Henderson Warnock (“we”, “us”, “our”, “Henderson Warnock”) is a mechanical and electrical (MEP) contracting business. This policy explains how we collect, use, store and protect personal information when you visit our website, contact us, or engage with our marketing.
We are the data controller for the personal information described in this policy.
We are the data controller for the personal information described in this policy.
| Company name | Henderson Warnock |
| Company registration number | SC179057 |
| Registered address | 38 New City Road, Glasgow, G4 9JT |
| ICO registration number | C2006935 |
| Contact for privacy matters | energy@hendersonwarnock.com |
| General contact | [general phone number and email] |
If you have any questions about this policy or how we handle your information, please contact us using the details above.
2. What information we collect
We collect personal information in the following ways.
Information you give us directly
- Enquiry and contact forms — name, company, job title, email address, phone number, and any details you include about your project or enquiry.
- Meeting bookings — name, email address, company, and any information you provide when scheduling a meeting with one of our directors.
- Tender and bid correspondence — contact details and any information exchanged in the course of a commercial enquiry, quotation, or tender process.
- Direct correspondence — anything you tell us by email, phone, or in person, including at meetings, site visits, or industry events.
Information we collect automatically
- Website usage data — pages visited, time spent on the site, referring website, browser and device type, and approximate location (via IP address), collected through cookies and similar technologies. See our Cookie Policy below.
- LinkedIn advertising data — if you interact with our LinkedIn advertisements or submit a LinkedIn Lead Gen Form, we receive the information you provide on that form (typically name, email, job title, and company), together with technical identifiers that allow us to measure advertising performance.
Information from third parties
- Publicly available business information — for example, your job title, employer, and professional details visible on LinkedIn or your company website, where relevant to a genuine business enquiry or account we are targeting for marketing purposes.
- Referrals and introductions — where a colleague, business partner, or existing contact introduces you to us.
We do not knowingly collect any special category data (such as health information, or information about racial or ethnic origin) through this website, and we ask that you do not include such information in any form or message you send us.
3. How we use your information, and our legal basis
We only use personal information where we have a valid legal basis to do so under UK GDPR. The table below sets out our main purposes and the basis we rely on for each.
| Purpose | What we do | Legal basis |
|---|---|---|
| Responding to enquiries | Answering questions, providing quotations, arranging meetings | Legitimate interests (to respond to business enquiries) / Contract (where a contract is being negotiated) |
| Managing our client and prospect relationships | Recording contact details, meeting outcomes, and project history in our CRM (HubSpot) | Legitimate interests (managing business relationships) / Contract |
| Marketing communications | Sending relevant content, case studies, or invitations to connect via LinkedIn | Legitimate interests, or consent where required |
| LinkedIn advertising | Showing relevant advertisements to people and businesses we believe may be interested in our services, and measuring how those advertisements perform | Legitimate interests |
| Improving our website | Understanding how visitors use our site, using cookies and analytics | Consent (for non-essential cookies) |
| Complying with our legal obligations | Record keeping, accounting, responding to regulatory or legal requests | Legal obligation |
| Tendering and bidding | Processing information shared as part of framework applications, pre-qualification questionnaires (PQQs), and tender submissions | Contract / Legitimate interests |
A note on legitimate interests
Where we rely on legitimate interests, we have considered whether our interest in using your information is outweighed by your rights and interests. In each case above, we believe our use is proportionate, expected in a normal business context, and does not cause unwarranted harm. You have the right to object to processing based on legitimate interests — see Section 6 below.
4. LinkedIn advertising and conversion tracking
We advertise our services on LinkedIn, targeted at people and businesses whose profile suggests they may benefit from our services. This section explains specifically how that works, because it involves sharing limited information with LinkedIn.
What we use
- LinkedIn Insight Tag — a small piece of code on our website that allows us to see, in aggregate, how visitors arrived at our site from LinkedIn, and to measure the effectiveness of our advertising.
- LinkedIn Conversions API — where you submit a form on our website or book a meeting with us after clicking a LinkedIn advertisement, we may securely share certain information with LinkedIn (in hashed, non-human-readable form) so that LinkedIn can match your action to the advertisement you saw. This helps us understand which advertisements are effective and does not give LinkedIn access to the content of any enquiry you send us.
- Matched audiences — we may upload hashed contact details (such as an email address) of existing business contacts to LinkedIn, so that we can show relevant advertising to people we already have a business relationship with, or people at businesses on a defined target list. Data is hashed before it is shared and LinkedIn cannot reverse this to identify you from it directly.
International transfer
LinkedIn is operated by LinkedIn Ireland Unlimited Company, with data processed by LinkedIn Corporation in the United States. Where information is transferred outside the UK, this is done under the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under UK GDPR. You can read more about how LinkedIn handles data in its own capacity as a controller in LinkedIn’s Privacy Policy.
Your choices
You can control LinkedIn’s own use of your data through your LinkedIn account settings. You can also opt out of interest-based advertising generally through your browser’s cookie settings or industry opt-out tools such as the Your Online Choices portal.
5. Who we share your information with
We do not sell personal information. We share information with the following categories of recipient, only where necessary:
| Recipient | Purpose |
|---|---|
| HubSpot (our CRM and marketing platform) | Storing contact records, managing enquiries, scheduling meetings, and email communications |
| Advertising and conversion measurement, as described in Section 4 | |
| Microsoft (Microsoft 365) | Email, calendar, and internal communication |
| Velvet | Managing our LinkedIn advertising campaigns on our behalf. Technical support for our CRM and marketing systems |
| Professional advisers | Accountants, solicitors, or auditors, where necessary |
| Regulatory or legal bodies | Where required by law, or to establish, exercise, or defend legal claims |
Each of these parties is either acting as a data processor on our instructions (in which case we have a data processing agreement in place with them), or as an independent controller of any data they hold about you (as is the case with LinkedIn, in relation to your own LinkedIn account).
We do not transfer personal information outside the UK except as described in Section 4, or where a supplier stores data in a jurisdiction that has been assessed as providing adequate protection, or where appropriate safeguards (such as Standard Contractual Clauses) are in place.
6. Your rights
Under UK GDPR, you have the following rights in relation to your personal information:
- Right to be informed — to know how and why we use your information (this policy).
- Right of access — to request a copy of the personal information we hold about you.
- Right to rectification — to have inaccurate or incomplete information corrected.
- Right to erasure — to ask us to delete your information, where there is no good reason for us to continue processing it.
- Right to restrict processing — to ask us to limit how we use your information in certain circumstances.
- Right to data portability — to receive your information in a structured, commonly used format, or have it transferred to another organisation.
- Right to object — to object to our use of your information where we rely on legitimate interests, including direct marketing (you can opt out of marketing at any time by using the unsubscribe link in any email, or contacting us directly).
- Rights related to automated decision-making — we do not use automated decision-making or profiling that produces legal or similarly significant effects about you.
To exercise any of these rights, please contact us at [privacy email address]. We will respond within one month, as required by law.
If you are not satisfied with how we have handled your information, you have the right to complain to the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns directly before you contact the ICO, but this is entirely your choice.
7. Cookies
Our website uses cookies and similar technologies. Cookies are small text files placed on your device that help the website function, and help us understand how the site is used.
| Type | Purpose | Can you refuse? |
|---|---|---|
| Strictly necessary | Required for the website to function (e.g. security, load balancing) | No — these are essential and cannot be switched off |
| Analytics | Help us understand how visitors use the site, so we can improve it | Yes, via our cookie banner or your browser settings |
| Advertising / LinkedIn Insight Tag | Allow us to measure LinkedIn advertising performance and show relevant content | Yes, via our cookie banner or your browser settings |
When you first visit our website, you will be shown a cookie banner allowing you to accept or decline non-essential cookies. You can change your preferences at any time by [clicking here / via the cookie settings link in our website footer]. You can also manage or delete cookies through your browser settings, though this may affect how parts of our website function.
8. How long we keep your information
We keep personal information only for as long as necessary for the purposes described in this policy, or as required by law.
| Type of information | Typical retention period |
|---|---|
| Enquiry and marketing contact records | Up to 3 years from last meaningful engagement, or until you ask us to delete them |
| Client and project records | Duration of the business relationship, plus 6 years, in line with our accounting and contractual obligations |
| Tender and bid records | In line with framework and contractual retention requirements, typically 6 years |
| Website analytics and cookie data | Up to 26 months |
Where we no longer need your information, we will delete or anonymise it securely.
9. How we protect your information
We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, or misuse, including:
- Access to our CRM and business systems is restricted to authorised personnel
- Data is stored with reputable providers (including HubSpot and Microsoft) that maintain their own security certifications
- We use secure, encrypted connections for data transmitted through our website
- We regularly review who has access to personal information and remove access when it is no longer needed
No method of transmission or storage is completely secure, but we work to protect your information to a high standard.
10. Children
Our website and services are intended for business use and are not directed at children. We do not knowingly collect personal information from anyone under the age of 18.
11. Changes to this policy
We may update this policy from time to time, for example to reflect changes in the law or in how we use your information. The date at the top of this page shows when it was last updated. We encourage you to check this page periodically.
12. Contact us
If you have any questions about this policy, or about how we handle your personal information, please contact us:
Email: energy@hendersonwarnock.com Post: 38 New City Road, Glasgow, G4 9JT Phone: 0141 353 2444
