How Tornado FM Ltd handles personal information.

Last updated: 14 July 2026

Company details: Registered in England — Reg No: 11744171 — VAT: 490221023

1. Who we are

This website is operated by TORNADO FM LTD, a private limited company registered in England and Wales.

• Company number: 11744171
• Registered office: Office 113 The Charter Building, Uxbridge, Middlesex, England, UB8 1JG
• Email: info@tornadofm.co.uk

For the purposes of UK data protection law, Tornado FM Ltd is the controller of personal information collected through this website and through direct business communications, unless we tell you otherwise.

2. What this policy covers

This policy applies to personal information we collect through:

• this website;
• our enquiry forms;
• email, telephone and business communications;
• customer portal or staff portal access, where issued;
• future WhatsApp Business contact, if enabled;
• messaging channels such as WhatsApp Business, where we make them available for general business enquiries;
• supplier, contractor, customer and business relationship management.

Separate notices, contracts, staff policies or portal terms may apply where we collect information for employment, worker onboarding, site deployment, payroll, vetting, screening, incident reporting, customer contracts or operational service delivery.

Do not send alarm codes, passwords, access credentials, photographs of keys or sensitive incident information through general website forms or messaging channels.

3. Personal information we may collect

The personal information we collect depends on your relationship with us and how you contact us. It may include:

• name and job title;
• company or organisation name;
• email address, telephone number and business contact details;
• site address, postcode or location information you provide;
• details of your security requirement, enquiry or message;
• records of communications and follow-up activity;
• portal access information, where applicable;
• technical information such as IP address, browser type, device information, date and time of form submission, security logs and anti-spam checks.

If you are a member of staff, officer, contractor or applicant, we may also process additional information separately, including right-to-work information, vetting information, SIA licence information, training records, rota information, timesheet records, clock-in/clock-out records and operational deployment records. This will be handled under the appropriate employment, worker, contractor or operational privacy information.

4. How we use personal information

We use personal information for the following purposes:

• to respond to enquiries and requests for information;
• to discuss security services, site requirements and potential proposals;
• to manage customer, supplier and business relationships;
• to provide, administer and support agreed services;
• to manage customer portal and staff portal access, where issued;
• to operate, secure and improve this website;
• to prevent spam, fraud, misuse, unauthorised access and malicious activity;
• to maintain business, accounting, insurance, legal and compliance records;
• to comply with legal obligations and respond to lawful requests from authorities, regulators or courts.

We do not sell personal information.

5. Lawful bases for processing

Depending on the context, we may rely on one or more of the following lawful bases under UK data protection law:

• Legitimate interests – to respond to business enquiries, manage customer and supplier relationships, operate and secure the website, prevent misuse, and keep appropriate business records.
• Contract or steps before entering into a contract – where we discuss, quote for, provide or manage services.
• Legal obligation – where we need to comply with company, accounting, tax, employment, health and safety, security industry, insurance, regulatory or legal requirements.
• Consent – where we ask for consent for a specific activity, such as optional marketing communications or non-essential cookies.
• Vital interests or public task – these are unlikely to apply to normal website use, but may be relevant in limited emergency or legally directed circumstances.

6. Enquiry forms and anti-spam protection

When you submit an enquiry form, we use the information you provide to review and respond to your enquiry. We may also process technical information to help protect the website and identify automated or malicious submissions.

Our forms may use security measures such as hidden fields, timing checks, rate limiting, IP checks and anti-bot services such as Cloudflare Turnstile or similar tools. These checks are used to protect the website and ensure genuine enquiries can be handled properly.

7. Customer portal and staff portal

The customer portal area is intended for authorised customers where access has been issued. The portal may be used to support customer communications, operational updates or service-related information.

The staff portal may link to Guardhouse or another operational system used for rota information, time and attendance, clocking in and out, incident reporting, operational updates or related workforce management processes. Third-party portal providers may process personal information under their own terms and privacy information.

8. WhatsApp Business

We may add WhatsApp Business as an optional contact route. If you contact us through WhatsApp, your phone number, message content, profile information visible to us and related communication records may be processed by us and by WhatsApp/Meta.

Please do not send highly sensitive information through WhatsApp unless we specifically ask you to use that channel for a defined purpose.

9. Cookies and similar technologies

This website may use essential cookies and similar technologies needed for the site to work, protect forms, maintain security, remember basic settings and support administration. Essential cookies are used because they are necessary for the website to function.

If we add analytics, advertising, retargeting, tracking or other non-essential cookies, we will update our cookie information and use an appropriate consent mechanism where required.

10. Who we may share information with

We may share personal information where necessary with:

• website hosting, IT, email, security, form-processing and anti-spam providers;
• customer portal, staff portal, workforce management or operational software providers;
• professional advisers, accountants, insurers, auditors and legal advisers;
• customers, suppliers, subcontractors or operational partners where necessary for legitimate service delivery or business administration;
• law enforcement, regulators, courts, public authorities or other parties where required by law or necessary to protect our rights.

We only share personal information where there is a proper business, operational, legal or security reason to do so.

11. International transfers

Some service providers may process personal information outside the United Kingdom. Where this happens, we expect appropriate safeguards to be in place, such as UK adequacy arrangements, standard contractual clauses, international data transfer agreements or other legally recognised protections.

12. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected. Typical retention periods may include:

• Website enquiries: normally up to 24 months from the last meaningful contact, unless the enquiry becomes a customer, supplier, contractual or legal matter.
• Customer, supplier and contract records: normally up to 7 years where needed for accounting, tax, insurance, legal or contractual purposes.
• Portal and operational records: retained for the period needed for operational, contractual, workforce, audit, insurance or legal reasons.
• Technical and security logs: retained for a limited period appropriate to website security, troubleshooting and misuse prevention.
• Marketing preferences: retained for as long as needed to respect your preferences and suppression requests.

Retention periods may be extended where required for legal claims, disputes, regulatory requirements, insurance matters or ongoing business records.

13. Keeping information secure

We use appropriate organisational and technical measures designed to protect personal information against unauthorised access, loss, misuse or disclosure. These may include access controls, secure hosting, account controls, staff instructions, system permissions, backups and security monitoring.

No website, email system or online service can be guaranteed to be completely secure. You should avoid sending highly sensitive information through general website forms unless we specifically request it and provide an appropriate method.

14. Your data protection rights

Depending on the circumstances, you may have rights to:

• request access to your personal information;
• ask us to correct inaccurate information;
• ask us to erase information in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing in certain circumstances;
• request data portability where applicable;
• withdraw consent where processing is based on consent.

To make a request, contact us at info@tornadofm.co.uk. We may need to verify your identity before responding.

15. Marketing communications

We may contact business contacts about relevant services where permitted by law and where there is a legitimate business context. We will not send consumer-style mass marketing without appropriate permission. You can ask us to stop marketing communications at any time by contacting us.

16. Complaints

If you are unhappy with how we handle your personal information, please contact us first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection matters. The ICO website is ico.org.uk.

17. Updates to this policy

We may update this Privacy Policy from time to time as our website, services, portals, systems or legal obligations develop. The updated version will be posted on this page.

18. Contact us

For questions about this Privacy Policy or how we use personal information, contact:

Tornado FM Ltd
Email: info@tornadofm.co.uk
Registered office: Office 113 The Charter Building, Uxbridge, Middlesex, England, UB8 1JG