Privacy & Data Security Policy

Optics Action Security Ltd ("we", "us", "our") is a UK-based security services company. We are committed to protecting the privacy and security of all personal data we process in connection with our services, website, and employment activities. Company: OPTICS ACTION SECURITY LIMITED (Company No. 17151465) Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ Website: opticsactionsecurity.co.uk Contact: info@opticsactionsecurity.com

We may collect and process the following categories of personal data: • Identity Data: name, job title, date of birth • Contact Data: email address, phone number, postal address • Employment Data: SIA licence number, DBS certificate, work history, references • Technical Data: IP address, browser type, pages visited, cookies • Communications Data: messages sent via our contact or staff request forms • Financial Data: bank details for payroll purposes (staff only)

We use personal data for the following purposes: • To provide and manage our security services • To process employment and contractor applications • To handle staff concierge and HR requests • To communicate with clients and prospective clients • To comply with legal and regulatory obligations (SIA, HMRC, ICO) • To improve our website and user experience • To send service-related communications (no marketing without consent)

We process personal data under the following lawful bases as defined by UK GDPR: • Contract: where processing is necessary to fulfil a contract with you • Legal Obligation: where we are required to comply with UK law • Legitimate Interests: where we have a genuine business need that does not override your rights • Consent: where you have given clear, specific consent (e.g. marketing emails) You may withdraw consent at any time by contacting us at info@opticsactionsecurity.com.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including: • Encrypted data transmission (TLS/SSL) • Access controls and role-based permissions • Regular security audits and staff training • Secure disposal of physical and digital records • Incident response procedures in line with ICO guidance In the event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.

We retain personal data only for as long as necessary for the purposes it was collected, or as required by law: • Client data: duration of contract + 6 years • Job applicant data: 6 months (unsuccessful applicants) • Employee/contractor data: duration of engagement + 6 years • Website enquiry data: 2 years • CCTV footage (where applicable): 31 days After the retention period, data is securely deleted or anonymised.

We do not sell your personal data. We may share it with: • Vetted third-party service providers (e.g. payroll, IT support) under data processing agreements • Government bodies and regulators (SIA, HMRC, police) where legally required • Background screening providers (DBS, reference agencies) for employment vetting • Emergency services where required for safety All third parties are required to handle your data securely and in accordance with UK GDPR.

Under UK GDPR, you have the following rights: • Right to Access: request a copy of the personal data we hold about you • Right to Rectification: request correction of inaccurate or incomplete data • Right to Erasure: request deletion of your data in certain circumstances • Right to Restrict Processing: request that we limit how we use your data • Right to Data Portability: receive your data in a structured, machine-readable format • Right to Object: object to processing based on legitimate interests • Rights related to Automated Decision-Making: not to be subject to solely automated decisions To exercise any of these rights, contact us at info@opticsactionsecurity.com. We will respond within 30 days.

Our website uses cookies to ensure it functions correctly and to improve your experience. These include: • Essential cookies: required for the website to operate • Analytics cookies: help us understand how visitors use the site (anonymised) You can control cookie settings through your browser. Disabling certain cookies may affect website functionality.

We may update this Privacy & Data Security Policy from time to time. The latest version will always be available on this page with the effective date noted below. We encourage you to review it periodically.

If you have any questions about this policy or how we handle your data, please contact us: Email: info@opticsactionsecurity.com Phone: +44 (0) 800 000 0000 Post: Optics Action Security Ltd, United Kingdom If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Website: ico.org.uk | Phone: 0303 123 1113