Nobu Statutory Limited
trading as “”

Our Privacy Policy

Your privacy is important to us. When we process your personal data we comply with the UK GDPR and the Data Protection Act 2018, together with any other applicable data protection and privacy legislation.

Your personal data includes all the information we hold that identifies you or is about you. More information about the types of personal data we process about you is set out below.

Everything we do with your personal data counts as processing it, including collecting, storing, amending, transferring and deleting it.

This privacy policy provides information about the personal data we process about you, why we process it and how we process it. It applies to customers and suppliers as well as candidates contacting us in relation to job vacancies.

Our responsibilities

Nobu Statutory Limited (a company registered in England with registered company number 14408762 and registered address at Quarry Cottage Swincliffe Top, Hampsthwaite, Harrogate, HG3 2HY and trading as is the data controller of the personal data you provide.

If you have any questions or concerns about the ways in which we process your personal data, please contact us at

What data do we process about you?

Customer, Suppliers and Business Contacts

All our sales and services provided are business to business, so the personal data that we process about our customers and suppliers is limited to contact information about individual contacts at those organisations. If you are one of our contacts, we may process your full name, email address and telephone number.

All other information that we process, such as payment details and transaction or order data will relate to the organisation for which you work and is therefore not personal data.We may also process your personal data if you are one of our business contacts, in which case it will usually consist of your name, email address and contact number as well as information about the organisation at which you work and any related organisations to which the services may relate.

We do not collect any special categories of data about you. Special categories of data include information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data or information about your sexual orientation.


Personal data that we are likely to process about you includes:

  • identity data such as your first name, signature, middle names, last name, marital status, title, date of birth and gender;
  • contact data such as your postal address, email address and telephone number(s);
  • background data such as your education, career background and work experience;
  • personal information such as your skills and qualities; and/or
  • any other information that you include on any CV, application, information request, or covering letter you send to us.

Why do we process your personal data?

Customers, Suppliers and Business Contacts

We will process your personal data if you are an individual contact at one of the customer or supplier organisations with which we work. We process your personal data in order to maintain our relationship with the organisation with which you work and to provide or receive services to/from your organisation or in order to provide sales and customer services to you. We process your information on the grounds of our legitimate interests. We process your information on the grounds of our legitimate interests or in order to fulfil a contract we have entered into with you.

If you are a business contact or a contact of a prospective customer, we process your personal data on the grounds of our legitimate interests.

Where we have a lawful basis to do so, we may also process your personal data for marketing purposes (please see section below entitled “Marketing” for further detail).


We will process your information on the grounds of our legitimate interests to determine whether or not we have a suitable vacancy for you. To the extent we need to process special categories of data about you (for example, to ensure our premises are suitably equipped for you if you attend for an interview), we will do so in accordance with our legal obligations. If you provide special categories of data to us which we have not requested, we will process it on the grounds of your consent because you have voluntarily provided the information to us.

Our collection of your personal data

Customers, Suppliers and Business Contacts

We use different methods to collect data from and about you including through:

  • Direct interactions.

You may give us your personal data by filling in forms on our website or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you (where applicable): place an order for our products or services; receive a Claim Pack; enter into a contract with us for Services; are involved (directly or indirectly) in a Freedom of Information request (pursuant to the Freedom of Information Act 2000); are provided with documents for e-signature; submit a query about our products or service whether on our website or by email or phone; request for marketing to be sent to you; give us feedback; or otherwise contact us.

  • Third parties.

Third parties may provide your personal details by: complying with Freedom of Information requests; providing details of marketing lists; referring you and/or the organisation with which you work; providing details to us (or our third parties) as required and as part of the Services; or, by corresponding with us by post, phone, email or otherwise. We may also receive this information via publicly available information, such as contract award noticed to public bodies.

  • Automated technologies or interactions.

As you interact with our website, we may automatically collect personal data about you. You can find out more information in our Cookie Policy available at .


We receive personal data about you directly from you or, where relevant a recruitment agency on your behalf, when you contact us in respect of a specific vacancy or with a speculative approach.

Who will receive your personal data?

Your personal data is only transferred to the extent that this is necessary. Recipients of your personal data may include:

  • legal advisers (including, without limitation, mediators and expert witnesses) and courts to the extent they need to see your personal data to provide us with legal advice or otherwise provide the Services;
  • third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy;
  • third party service providers to whom we subcontract any or all of our Services and/or assist with marketing;
  • a ‘body governed by public law’ as more particularly defined in the Public Contract Regulations 2015 who shall be the defendant to any claim(s) and/or other legal action(s) and/or any other body or organisation against which com makes a claim and/or takes legal action as part of the Services;
  • debt collection agencies or similar organisations used in order to provide the Services;
  • any third parties to whom you ask us to transfer personal data, for example on termination or expiry of our contract with you; and
  • if you are a candidate, we may provide feedback to you via the recruiter that recommended you to us.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

We do not ordinarily transfer your personal data outside of the UK but where we transfer to the EU/EEA, we will ensure that any such transfer is in compliance with data protection legislation. This will normally mean that the country has been deemed to provide adequate protection to your personal data.

We do not anticipate a situation where we will transfer personal data to a country that is outside of the UK/EU/EEA (and therefore outside of data protection legislation). If this should occur, we will insert a Standard Contractual Clause, that ensures one of the approved safeguards for data transfers are in place.

If you want any further information in this regard, please contact


In addition to data protection legislation, we will where applicable comply with the requirements of the Privacy and Electronic Communications Regulations, (PECR), which relate to marketing by electronic means.

We will occasionally contact you via phone, SMS, email or in writing, we will also send newsletters and magazines to you, in which case we will share your name, email address, phone number and (for the purposes of sending you magazines) your billing address with third party companies.

We only send you marketing if we are entitled to do so under data protection and privacy legislation, which usually means we either have your consent to send you marketing, there is a legitimate interest for doing so, or we send it to you because you are one of our existing customers. You can unsubscribe to our marketing communications at any time, either by clicking “unsubscribe” in any marketing email we send to you or by emailing

How long will we keep your personal data?

Customers, Suppliers and Business Contacts

Your personal data is retained for no more than 7 years. It is retained for this period in case any issues arise or in case you have any queries. Your information will be kept securely at all times. Following the end of the 7 year period, your files and personal data we hold about you will be permanently deleted or destroyed. If we are required to obtain your consent to send you marketing communications, any information we use for this purpose will be kept until you withdraw your consent, unless we have other legitimate reasons to retain the data.


If you are successful, we will retain your personal data in line with our employee facing privacy policy, a copy of which will be provided to you. If you are unsuccessful, we will retain your application, CV and/or covering letter and any other personal data you provided to us for 6 months from the date we reach our decision in case any other suitable roles arise in which we think you may be interested, or in case you have any questions about our decision. After that date, your personal data will be permanently deleted or destroyed.

What are your rights?

You benefit from a number of rights in respect of the personal data we hold about you. We have summarised your rights below, and more information is available from the Information Commissioner’s Office website ( These rights apply for the period in which we process your data. There are certain caveats and exemptions to those rights which mean that in some circumstances you may not be entitled to exercise them, if we believe that is the case upon receipt of a request from you we will let you know.

  1. Access to your data

You have the right to ask us to confirm that we process your personal data, as well as access to and copies of your personal data. You can also ask us to provide a range of information, although most of that information corresponds to the information set out in this fair processing notice.

  1. Rectification of your data

If you believe personal data we hold about you is inaccurate or incomplete, you can ask us to rectify that information.

  1. Right to be forgotten

In some circumstances, you have the right to ask us to delete personal data we hold about you.

  1. Right to restrict processing

In some circumstances you are entitled to ask us to suppress processing of your personal data. This means we will stop actively processing your personal data but we do not have to delete it.

  1. Data portability

You have the right to ask us to provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit the personal data to another data controller.

  1. Right to object

You are entitled to object to us processing your personal data:

  • if the processing is based on legitimate interests or performance of a task in the public interest or exercise of official authority;
  • for direct marketing purposes (including profiling); and/or
  • for the purposes of scientific or historical research and statistics.

We do not intend to use your personal data for scientific or historical research and statistics.

Automated decision making

Automated decision making means making a decision solely by automated means without any human involvement.

We may carry out any automated decision making using your personal data.

Your right to complain about our processing

If you think we have processed your personal data unlawfully or that we have not complied with GDPR, please get in touch with us first so we can try to help. You can also report your concerns to the supervisory authority in your jurisdiction. The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You can call the ICO on 0303 123 1113 or get in touch via other means, as set out on the ICO website –