Customer Privacy Policy

Introduction #

Murgitroyd & Company Limited (referred to as "we", "us" or "our") is registered in Scotland under number SC144082, whose registered office is at 165-169 Scotland Street, Glasgow. We are what is known as the 'data controller' of personal information we collect and use. This means that we are responsible for determining the purpose and the means of processing your personal data.  We are registered with the Information Commissioner’s Office under number Z7349800.

Our Chief Compliance Officer ensures that we apply the best standards to protecting your personal information and comply with our responsibilities for data protection. If you have any questions about how we handle your personal information or concerns please contact us using the information provided under ‘How to Contact Us’.

The purpose of this policy is to outline our approach to protecting the personal data we collect, process, hold and share as a Data Controller. We take your privacy seriously and are committed to protecting information through a range of technical and organisational measures to safeguard all personal information under our control. We maintain records of our processing activities, data protection risk assessments and a range of other measures to support our compliance with data protection law. This privacy policy is a key component of our wider Information Security and Governance Framework incorporating our Data Protection and ICT policies.

Personal Data We Collect #

Under UK GDPR, personal data means information which relates to a living person who can be identified from that data (a ‘data subject’) on its own, or when taken together with other information which is likely to come into our possession. It includes any expression of opinion about the person and an indication of the intentions of us or others, in respect of that person. It does not include anonymised data.

Below is a list of the types of your personal data that we may process:

• Name
• Contact details
• Address
• Job Title
• Financial information such as bank account details
• Employment information such as job title and company email

  #

Source of Personal Data #

We may collect personal data about you from: 

• you directly
• employers/clients when you apply for a role or are considered for an opportunity
• referees (where relevant and permitted)
• publicly available sources (for example professional networking sites, business websites, and public records)
• credit reference agencies (CRAs) where required for consumer credit, identity, or affordability checks
• third party service providers used to support recruitment, screening, and compliance processes

How We Use Your Personal Data #

Below is a table of the reasons why we use your personal data and the corresponding lawful basis.

Credit Reference and Affordability Checks #

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

• Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority
  FCA Firm Reference Number: 742313
• TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority
  FCA Firm Reference Number: 805757

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

• Creditsafe Privacy / Transparency Notice:
  Transparency Notice | Customers & Suppliers
• TransUnion CRAIN (Credit Reference Agency Information Notice):
  https://www.transunion.co.uk/legal/privacy-centre/pc-credit-reference
• TransUnion Bureau Privacy Notice:
  https://www.transunion.co.uk/legal/privacy-centre/pc-bureau

  #

Recipients or Categories of Recipients #

We may share personal data with customers or business partners, third-party service providers, regulators, or law enforcement bodies where required, and professional advisers. Where data is shared outside the UK, appropriate safeguards will apply. 

International Transfers #

We may transfer personal data to recipients or service providers located outside the UK and/or European Economic Area (EEA). 

Where such transfers take place, we ensure appropriate safeguards are in place to protect personal data in accordance with applicable data protection laws. These safeguards may include the use of approved standard contractual clauses, international data transfer agreements, or transfers to countries that have been recognised as providing an adequate level of data protection.

Data Retention #

We keep personal data only for as long as necessary for its purpose and to meet legal or regulatory obligations. Data used for credit reference or affordability checks is retained only for as long as required and then securely deleted.

Details of retention periods for different aspects of your personal information are available in our retention policy which can be exercised under the “How to Contact Us” section of this policy. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Automated Decision Making #

We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.

These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.

The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.

Your Rights #

Under UK data protection law, you have a set of certain rights, and they are as follows:

• Right of access – You have the right to request a copy of the personal data we hold about you and information about how it is used.
• Right to rectification – You have the right to request that inaccurate or incomplete personal data is corrected.
• Right to erasure (“right to be forgotten”) – You have the right to request that we delete your personal data where there is no lawful reason for us to continue processing it.
• Right to restrict processing – You have the right to request that we limit how we use your personal data in certain circumstances.
• Right to data portability – You have the right to receive your personal data in a structured, commonly used, and machine readable format, and to request that we transfer it to another organisation where technically feasible. readable format, and to request that we transfer it to another organisation where technically feasible.
• Right to object – You have the right to object to the processing of your personal data where we rely on legitimate interests or where data is used for direct marketing. 
  Right to Withdraw Consent - Withdraw your consent to the processing of your personal information at any time where consent is being relied upon as the lawful basis for processing.
   

You can exercise your rights by emailing us on the contact details below or by writing in to us at, 165-169 Scotland Street, Glasgow, Scotland, G5 8PL. Please mark your correspondence for the attention of the Chief Compliance Officer.

You have the right to complain to the UK Information Commissioner’s Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data. In the first instance, we encourage you to resolve the matter with Murgitroyd. However, you can contact the ICO via www.ico.org.uk, [email protected] or 0303 123 1113.

Provision of Personal Data #

The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations.

Personal data is required to: 

• enter and perform contracts with customers, suppliers, or business partners.
• process orders, manage accounts, and deliver goods and services.
• verify identity and prevent fraud; and
• comply with applicable legal, regulatory, accounting, and tax obligations. 

What are the consequences of not providing personal data?

If you choose not to provide the personal data, we request: 

• we may be unable to enter a contract with you.
• we may be unable to fulfil orders, supply goods, or provide services.
• we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and
• as a result, our services may be delayed, restricted, or declined.

Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us. 

How to Contact Us #

For further information regarding your personal data or about our approach to data protection in general, please contact our Chief Compliance Officer at:

165-169 Scotland Street
Glasgow
Scotland
G5 8PL

(e) [email protected]

(t) +44 (0) 141 307 8400

Version Control #