PRIVACY POLICY

MB FIRESTOP LIMITED

Trillium Group Limited (the 'Company'), referred to as Trillium, 'we' or 'our', is committed to protecting the privacy and security of your personal information.

Trillium Group Limited is registered with the Jersey Financial Services Commission (JFSC) under registration number 152126 and the Jersey Office of the Information Commissioner (JOIC) under registration number 102666. The group comprises several limited companies (the 'Entities') registered with and regulated by the JFSC and the JOIC.

This notice is for MB Firestop Limited, JFSC registration number 139548 and JOIC registration number 71167.

Each Entity is considered a separate Data Controller and is responsible for all data protection activities under its control. This notice is an overarching policy for the Company and will be complied with by the Entities.

This Privacy Notice describes how we collect and use personal information about you during and after your relationship with us, pursuant to the Data Protection (Jersey) Law 2018 (“DPJL”).

Trillium is a “Data Controller”, meaning we are responsible for deciding how we hold and use personal information.

We will comply with data protection law. The principles of the law say that the personal information we hold about you must be:

• Used lawfully, fairly and transparently.
• Collected only for valid purposes that we have clearly explained to you and not used in any way incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only for as long as necessary for the purposes we collected it for.
• Kept securely.

Trillium is accountable to you and the authorities for showing compliance with the DPJL and demonstrating how we are compliant.

The Data Protection Officer (“DPO”)

We have appointed a DPO to oversee compliance with this Privacy Notice. If you have any questions about this Privacy Notice or how we handle your personal information, contact the DPO at dataprotection@trilliumgroup.je.

You have the right to complain to the JOIC at any time. Contact details are outlined at the bottom of this Privacy Notice.

The Kind of Information We Hold About You

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

To explain this, we will list our different services when we collect or use additional information about you.

How Is Your Personal Information Collected?

We collect personal information about you when you contact us, engage us to provide a service, or provide us with your data for another specific purpose.

What Information Do We Collect About You?

• Name
• Title
• Address
• Telephone number
• Email address
• Signature

How Will We Use Information About You?

Trillium Group and its subsidiary companies will only use your personal information when the law allows us to do so.

We are committed to handling your personal data fairly, transparently and lawfully, and will only process it for purposes that are necessary to deliver our services and meet our legal and business obligations.

Most commonly, we will use your personal information in the following circumstances:

• When you have entered into a contract with us for the provision of goods or services. We will use your personal information (such as your contact details, project address and billing information) to manage and fulfil that contract.
• When we are required by law to collect or share certain information. For example, we may need to provide compliance reports to a regulatory body under health and safety legislation.
• When it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example, we may process your contact details to manage supplier relationships, schedule site visits, improve our customer service processes, or ensure the safety and security of our worksites.

Change of Purpose

We will only use your personal information for the purposes we collected it for, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Data Sharing

We do not pass on information gained from your engagement with us without a clear legal basis. However, we may disclose your personal information to meet legal obligations, regulations or valid governmental requests.

We use certain third parties, or Processors, to provide or support our services. We have established appropriate agreements with these processors to ensure the security and confidentiality of your information. For information on these processors, please see the table in Index 1 at the end of this notice.

Processors are other organisations or services carefully chosen by us to process your information correctly and securely. In the case of organisations outside of Jersey, the United Kingdom and the European Economic Area (EEA):

• (a) we have prior written instructions for the transfer; or
• (b) we have entered into specific contractual terms with them to ensure that they treat your personal data in a way that is equivalent to what they would be required to do if they were established in Jersey.

We ensure that your privacy rights are respected in accordance with this notice and that your data is protected as laid down by the DPJL.

Marketing

We want to share with everyone what we do.

To keep you informed about our services, products and promotions, we may contact you under the lawful basis of legitimate interests. If you visit our website or engage with us to use any of our services, we may send you information, updates and new offerings that we believe may be of interest to you.

You can opt out of receiving such communications at any time by selecting the ‘Unsubscribe’ option included in all our digital messages.

If you have no business relationship with us but want to know what is going on with us, you can subscribe through our website and consent to us sending you this information. Again, you can use ‘Unsubscribe’ when you want this to stop.

You can also contact us or our DPO to withdraw your consent at any time.

Use of Social Media

We may wish to share images or videos of the work we do on our social media platforms (e.g. Facebook, LinkedIn). These images will not include any personal details, such as names or addresses.

We may also respond to any reviews you place on social media regarding our business. We will only use the information you have provided and will not disclose any additional personal details that you have not already disclosed during this process. If you have any concerns about this, please reach out to the Data Protection Manager by email at dataprotection@trilliumgroup.je.

Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, altered, disclosed or accessed in an unauthorised way. In addition, we limit access to your personal information to those staff, agents, contractors and other third parties on a need-to-know basis.

They will only process your personal information on our strict instructions and are subject to a duty of confidentiality.

Details of these measures may be obtained from our DPO.

We have implemented procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data Retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the quantity, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your data, the purposes for which we process your data and whether we can achieve those purposes through other means, and the applicable legal requirements.

You can request our Data Retention Schedule from our DPO if required.

In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use it without further notice.

Access to and Control of Your Personal Information

Rights of Data Subjects

You may have certain legal rights concerning the personal information processed, pursuant to the DPJL:

• the right of access;
• the right to have your data corrected, updated, rectified or erased;
• the right to object to the processing of, or restrict the processing of, your data;
• the right to withdraw your consent previously given to the processing of your data; and
• the right to request the transfer of your data to another party.

Please note that the rights set out above are subject to certain exemptions and conditions. We may decline to comply with any request to access, correct, delete or restrict the use of your information if there is a specific legal ground or exemption.

Where we are processing your information based on contractual necessity or legal and regulatory requirements, the provision and processing of such information will likely be mandatory. In addition, where the provision of your personal information is a contractual or legal requirement, or is a requirement for us to enter into a contract, if you choose not to provide any personal information or to exercise one or more of the rights above to restrict the processing of your information, this may limit the services which we can provide.

If you wish to exercise any of your rights, send your request to the DPO at dataprotection@trilliumgroup.je. We will respond to your request in accordance with data protection legislation.

We reserve the right to ask for proof of your identity and address (such as a copy of your driving licence or passport – please do not send any original documents). Under the DPJL, we also reserve the right to request any additional information reasonably required to identify the specific information being requested or referred to, or to confirm your identity.

You can use the Data Subject Access Request form on our Cookie Banner to complete our online form. If you have any questions about this process or your rights, contact our DPO at dataprotection@trilliumgroup.je. You can also make your request by email or verbally over the telephone to one of our team members, whichever way you feel more comfortable with.

We will respond to your request without undue delay, and in any event within four weeks after satisfactory identity verification. In some circumstances, we can apply an eight-week extension to this timeframe if the request is complex and cannot be answered in four weeks. If this happens, we will inform you as soon as possible.

Right to Withdraw Consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.

To withdraw your consent, contact our DPO at dataprotection@trilliumgroup.je.

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Changes to this Privacy Notice

We reserve the right to update this Privacy Notice at any time and will provide you with a new one when we make any substantial updates.

We may also notify you in other ways from time to time about processing your personal information or request you to confirm the accuracy of the information we hold on you.

Complaints

We want to resolve any complaints you have about how we process your information. You have the right to complain to the JOIC about how we have used your data. The details for each of these contacts are:

MB Firestop Limited
2nd Floor, 6 New Street
St. Helier, Jersey JE2 3RA
Email: dataprotection@trilliumgroup.je

Jersey Office of the Information Commissioner (JOIC)
2nd Floor, 5 Castle Street
St Helier, Jersey JE2 3BT
Telephone: +44 (0) 1534 716530
Email: enquiries@jerseyoic.org

Index 1: List of Third-party Processors