1. Who we are

W.A. Hutton & Co Ltd ("W·A·Hutton", "we", "us") is the data controller for the CCTV footage described in this notice. That means we decide why the footage is recorded and how it is used, and we are legally responsible for looking after it.

Our registered office and head office is Unit L2, Lancashire House, Green Lane, Romiley, Stockport SK6 3JQ. We also operate from International House, 61 Mosley Street, Manchester M2 3HZ. We are registered in England under company number 2392620.

If you have any question about this notice, or about CCTV at our premises, please email privacy@wahutton.com or call 0161 822 0864.

2. Why we operate CCTV

CCTV is in operation at our business premises. We use it for a small, specific set of purposes:

  • Protecting the safety of staff, customers and visitors on site.
  • Preventing, deterring and detecting crime — in particular theft of, and damage to, machines, parts, tools and vehicles.
  • Securing our premises and stock, including the workshop, parts store and loading areas, outside working hours.
  • Investigating incidents such as accidents, near misses, vehicle damage or disputes about deliveries and collections.
  • Assisting the police and our insurers where a crime or an insurable incident has occurred.

We do not use CCTV to routinely monitor the productivity or performance of our employees, and we do not use automated facial recognition or any other automated decision-making or profiling on CCTV footage.

3. What we record

Our cameras record visual images only. They do not record sound. Cameras are positioned so that they cover our own premises and the immediate approaches to them, and are angled to avoid capturing more of neighbouring property or public space than is necessary for the purposes above.

The footage is date- and time-stamped. In practice it may capture images of employees, visitors, contractors, delivery drivers, customers attending our premises, and members of the public passing directly by an entrance. Under data protection law, a recognisable image of a person is personal data, which is why this notice exists.

Signs are displayed at the entrances to areas covered by CCTV, identifying us as the operator and giving contact details, so that people know recording is taking place before they enter.

4. Our lawful basis for using CCTV

We rely on legitimate interests under Article 6(1)(f) of the UK GDPR. Our legitimate interests are the security of our premises, the safety of the people on them, and the protection of company and customer property — including customer machines held on our site for repair or refurbishment.

We have considered whether those interests are outweighed by the privacy rights of the people recorded, and have taken steps to keep the impact proportionate: cameras are limited in number and placement, signage is displayed, footage is held for a short fixed period, access is restricted to a small number of authorised people, and the system is not used for staff monitoring.

Where footage is used in connection with a criminal offence — for example when it is passed to the police — we also rely on the conditions in Schedule 1 of the Data Protection Act 2018 that permit the processing of criminal offence data for the prevention and detection of unlawful acts.

5. How long we keep footage

Retention period: 30 days

CCTV footage is retained for 30 days from the date of recording. After that, the recording system automatically overwrites it and the footage is permanently deleted. We do not keep an archive of routine footage.

There is one exception. Where a specific clip has been identified as relevant to an ongoing matter — a crime report, an insurance claim, a health and safety investigation, a legal claim, or a request from an individual under section 10 below — that clip may be exported and retained for as long as is necessary to deal with that matter. Exported clips are held securely, kept separate from the live system, reviewed periodically, and deleted once the matter is closed.

Because of the 30-day period, please contact us as soon as possible if you think footage may be relevant to you. If you get in touch after 30 days have passed, the footage will already have been deleted and we will not be able to recover it.

6. Who can view the footage

Access to live and recorded footage is restricted to a small number of authorised staff — directors and senior managers responsible for site security — who view it only when there is a specific reason to do so. Recording equipment is kept in a secured area and is protected by individual login credentials.

We may also use a maintenance contractor to install, service or repair the CCTV system. Any such contractor acts as our data processor, is bound by a written contract, may only act on our instructions, and may not use or retain footage for their own purposes.

7. When we share footage with others

We do not sell footage, use it for marketing, or publish it. We will only disclose it where there is a proper reason to, and we record each disclosure. Footage may be shared with:

  • The police and other law enforcement agencies, where footage is needed to prevent or detect crime or apprehend an offender, and where a valid request has been made.
  • Our insurers, brokers and legal advisers, in connection with a claim, an incident or a legal dispute.
  • Regulators and courts, where we are required to do so by law, a court order or a statutory request.
  • An individual recorded on the footage, where they have made a valid request under section 10 below.

Footage is stored in the United Kingdom and is not transferred outside the UK.

8. How we keep footage secure

Recording equipment is held in a locked, access-controlled part of our premises. Access is protected by unique user accounts and passwords, and viewing is limited to authorised staff. Exported clips are encrypted or password-protected, transferred securely, and logged — recording what was exported, why, who authorised it and who received it. Nobody is permitted to copy footage to personal devices or personal accounts.

9. Your rights

If you have been recorded by our CCTV, you have the following rights under the UK GDPR:

Right of access
You can ask for a copy of footage in which you appear. See section 10 for how to do this.
Right to erasure
You can ask us to delete footage of you. In practice this happens automatically after 30 days, but we may not be able to delete a clip early where it is needed for a crime report, an insurance claim or a legal claim.
Right to object
Because we rely on legitimate interests, you can object to our use of footage of you. We will stop unless we can show compelling legitimate grounds that override your interests, or we need it to establish, exercise or defend legal claims.
Right to restriction
You can ask us to suspend our use of a particular clip — for example while we consider an objection or a challenge to its accuracy.
Right to rectification
Footage itself cannot meaningfully be corrected, but you can ask us to correct associated records, such as an incorrect date, time or description attached to a clip.
Right to complain
You can complain to the Information Commissioner's Office at any time. See section 11.

Exercising your rights is free of charge, and we will not treat you any differently for doing so.

10. How to request a copy of CCTV footage

You are entitled to request a copy of CCTV footage in which you personally appear. This is known as a subject access request. To make one:

  1. Email us at privacy@wahutton.com Write to privacy@wahutton.com and tell us clearly that you are requesting CCTV footage of yourself. You can also write to the Data Protection Contact, W.A. Hutton & Co Ltd, Unit L2, Lancashire House, Green Lane, Romiley, Stockport SK6 3JQ.
  2. Tell us the date, time and location Give us the date and as narrow a time window as you can, plus which of our sites or which entrance you were at. The more precise you are, the more likely we are to find the right footage.
  3. Help us identify you in the footage Include a description of what you were wearing, and — if you are willing — a recent photograph. This is used only to locate you in the recording.
  4. Prove your identity So that we do not release images of one person to another, we will ask for proof of identity such as a passport, driving licence or a recent utility bill. If you are asking on someone else's behalf, we will also need written authority from them.
  5. Do it within 30 days of the incident Footage is deleted automatically after 30 days. If you contact us within that window we can preserve the relevant clip while your request is dealt with.

What happens next. We will respond within one month of receiving your request and the information we need to identify you and locate the footage. If your request is complex, or you have made several requests, we may extend this by up to two further months — we will tell you within the first month if we need to.

There is no charge for a request. We may charge a reasonable administrative fee, or refuse the request, only where it is manifestly unfounded or excessive — for example if it repeats a request we have already answered.

Where other people appear in the same footage, we have to protect their privacy too. We will normally blur or otherwise obscure third parties before releasing a clip, or provide stills instead of video where that is a fairer way to give you the information. In limited circumstances we may have to withhold footage — for example where releasing it would prejudice an ongoing criminal investigation or the prevention or detection of crime. If we withhold anything, we will explain why and tell you how to challenge that decision.

11. Complaints and the ICO

If you are unhappy with how we have handled your footage or your request, please contact us first at privacy@wahutton.com — we would rather have the chance to put it right.

You also have the right to complain directly to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. Complaining to the ICO does not affect your right to seek a remedy through the courts.

Website
ico.org.uk/make-a-complaint
Helpline
0303 123 1113
Post
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Changes to this notice

We review this notice periodically and will update it if our CCTV system, our retention period or the law changes. The date at the top of the page shows when it was last updated. Any material change will be reflected here, so please check back before relying on an earlier version.