Last reviewed: 31 August 2026 · Data controller: ETABLIX, a Groupe Nseya brand · Groupe Nseya House, Kingstanding, Birmingham B44 8DJ · contact@etablix.com
1. Who we are
ETABLIX ("we", "us", "our"), a Groupe Nseya brand, provides integrated site services and the CONSTRUX and VERYX technology products. We are the data controller for personal data collected through this website and through our business, supplier and product enquiries. This notice explains what we collect, why, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What we collect
Business project enquiries
- Identity and contact data: full name, business email, company, telephone.
- Enquiry data: required service, project sector, project location, required start date and your project brief.
- Any supporting documents you choose to upload with your enquiry.
Supplier registrations
- Company data: legal company name, trading name, company registration number, operating territories.
- Contact data: contact person, business email, telephone.
- Capability data: primary capability, largest contract delivered, mobilisation lead time, capability statement and any supporting documents (capability, insurance, HSE or accreditation records).
Technical data
- Standard server logs (IP address, request time, pages requested) used for security and service operation.
3. Why we process it (lawful bases)
- Responding to your enquiry — steps taken at your request prior to entering into a contract (Article 6(1)(b) UK GDPR).
- Assessing supplier registrations — our legitimate interest in prequalifying a competent, safe and lawful supply chain (Article 6(1)(f)), and steps prior to a contract where an engagement follows.
- Security and service operation — our legitimate interest in protecting the website and our systems (Article 6(1)(f)).
- Legal obligations — where retention or disclosure is required by law (Article 6(1)(c)).
4. Who we share it with
Personal data is accessible to authorised ETABLIX and Groupe Nseya personnel who need it to handle your enquiry or assess your registration. We do not sell personal data. We may share data with:
- Professional advisers (legal, insurance, audit) where necessary;
- IT and hosting providers acting as our processors under contract;
- Clients, only where you are registered as a supplier and disclosure is necessary for a specific project prequalification, and proportionately;
- Regulators or authorities where the law requires it.
5. International transfers
We serve the UK, Ireland, Europe and selected international programmes. Where personal data is transferred outside the UK, we use lawful transfer mechanisms such as adequacy regulations or the International Data Transfer Agreement (IDTA) / addendum to the EU Standard Contractual Clauses.
6. How long we keep it
- Business enquiries that do not proceed: up to 24 months from last contact.
- Supplier registrations: for the period your registration remains active, reviewed at least every 24 months.
- Documents you supply for an engagement — your programme, drawings, registers and the rest of an information pack: while the engagement is live and for 12 months after it closes, so that a question about our report can still be answered against what the report was written from. They are then deleted automatically, and the deletion is recorded.
- What we issued you, and the commercial record — the report, the invoices and the audit trail: 6 years. That period is not a preference. The Limitation Act 1980 allows six years to bring a claim on a simple contract, and HMRC requires company records to be kept for six years from the end of the accounting period. Deleting these earlier would leave both of us unable to evidence what was agreed.
- Server logs: up to 12 months.
You can ask us to delete your information pack at any time, before the twelve months are up, and we will. We will tell you what was deleted and what we have had to keep, and why.
7. Your rights
Subject to legal conditions, you have the right to access, rectify, erase, restrict and object to our processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. To exercise any right, email contact@etablix.com. We respond within one month.
On erasure specifically: we can list everything we hold against an engagement and delete the documents you supplied, on request, and the deletion is recorded against the engagement so you can see it was carried out. Where we have to keep something — the invoices and the report itself, for the six years described above — we will say so rather than implying everything was destroyed.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to address your concern first.
8. Security
We apply proportionate technical and organisational measures: encrypted transport (TLS), access controls on internal systems, authenticated access to uploaded documents, and staff limited to the data their role requires.
9. Changes to this notice
We review this notice periodically and publish the current version on this page with the review date above. Material changes will be highlighted on this page.
10. Contact
Privacy questions and rights requests: contact@etablix.com · ETABLIX, Groupe Nseya House, Kingstanding, Birmingham B44 8DJ · +44 7493 216101.
