1. Identity of the controller
DIRECT BRANDED LTD is the controller of personal data processed through directbranded.art and in the course of providing business support, administrative and support services, outsourced business process management, facilities and office maintenance support, commercial waste management and recycling, environmental remediation and industrial cleanup, back-office administrative coordination, and corporate logistics and fulfilment services. The company operates from 51 Bollington Road, Oadby, Leicester, LE2 4ND, United Kingdom. The designated mailbox for data protection correspondence is general@directbranded.art. Telephone contact is +44 7860 345678. This Privacy Policy is issued under the United Kingdom General Data Protection Regulation and the Data Protection Act 2018, read with the Privacy and Electronic Communications Regulations 2003 as amended. It applies to visitors of the website, correspondents who submit a recovery request, clients, suppliers, site contacts, and any individual whose data we process because a client has instructed us to coordinate a process that includes that individual.
This document is not a museum catalogue of rights. It is a working record of how a Leicester support and remediation company handles information while it tests operational surfaces. We process only what a window requires. We do not sell personal data. We do not use the website as a marketplace for profiles. If a conflict arises between a client’s instruction and UK data protection law, UK law prevails and we will say so in writing.
2. Scope and territorial application
The website and the services are directed at organisations in the United Kingdom, with a principal establishment in England. Where a data subject is in the European Economic Area and we still process their data because a UK client has named them as a site contact or process owner, we apply UK GDPR standards and, where required, an appropriate transfer mechanism if data later leaves the UK. This Policy does not create rights under foreign privacy statutes except where those statutes mandatorily apply. Governing interpretation of this Policy follows the law of England and Wales. Complaints may be made to the Information Commissioner’s Office as set out below.
3. Categories of personal data
We process identity data such as names, job titles, employer names and professional roles. We process contact data such as business email addresses, telephone numbers, postal addresses of premises, and the Oadby correspondence address you send to us. We process correspondence data including the content of recovery requests, attachments you choose to send, and our replies. We process operational data necessary to run a window: access lists, induction records, keys logs, waste transfer names of authorised signatories, delivery contacts, and exception owners. We process financial data of organisational payers: invoice contacts, purchase-order numbers, and payment references. We do not seek special category data. If a facilities or remediation window incidentally reveals health information, for example because a site induction form includes a medical disclosure, we treat that as special category data, minimise it, and process it only with a lawful basis and an Article 9 condition, typically employment and social protection or explicit consent where employment law does not already require the record.
We process technical data from the website: IP address as seen by the host, browser type, referring URL if the server logs it, and time of request. We do not run a marketing pixel on this site. Google Fonts and Google Maps, if loaded by your browser, may process technical data under those providers’ terms; see the Cookie Policy. Form submissions are sent by the browser as a POST to a confirmation page. You should assume that any text you type is readable by the company once it reaches us through the mailbox or through a later copy you send to general@directbranded.art.
4. Sources
Data comes from you when you complete the recovery request, telephone +44 7860 345678, write to general@directbranded.art, or hand documents to a supervisor on site. Data comes from your employer or contracting organisation when they name you as a contact. Data comes from public registers where we must verify a company number, VAT status, or insolvency marker before opening a credit window. Data comes from waste carriers, landlords, and logistics counterparties where a duty-of-care or fulfilment trail requires a name. We do not buy lists. We do not scrape social networks for prospects.
5. Purposes and lawful bases
We process data to respond to enquiries, which is our legitimate interest in operating a business and, where you request a quote that will form a contract, steps at your request prior to entering a contract. We process data to perform a contract for services, including scheduling, invoicing, and delivering administrative, facilities, waste, remediation and logistics windows. We process data to comply with legal obligations: tax retention, waste duty of care, health and safety records, and responses to competent authorities. We process data to defend legal claims, which is a legitimate interest and, where relevant, the establishment, exercise or defence of legal claims. We process limited data to keep the website secure, a legitimate interest in preventing misuse. We do not rely on consent for core service delivery. Where we ever use consent, for example an optional mailing you asked for, you may withdraw it without affecting prior lawful processing.
Legitimate interests are balanced. A site manager named on a waste transfer note has a reasonable expectation that the note will hold their name. A private individual who wrote to complain about a skip on a public road has a reasonable expectation that we will handle the complaint and then close the file. We do not use legitimate interests to justify unexpected profiling. We do not make solely automated decisions that produce legal effects.
6. Business support and BPO processing
When DIRECT BRANDED LTD provides outsourced business process management or back-office coordination, we often act as a processor for the client’s own customer or staff data, and as a controller for our own employee, supplier and invoice data. The distinction is recorded in the engagement file. Processor activity follows written instructions, confidentiality, deletion or return at the end of the window, and sub-processor transparency. We will not use client process data to train a public model or to market to the client’s customers. If a BPO window requires access to a mailbox, we restrict that access to named operators and we log it. If a window requires payment-card handling, we will refuse unless a PCI-appropriate method is agreed; this site’s form is not an appropriate method.
7. Facilities, waste and remediation files
Facilities logs may include contractor names, times of attendance, and photographs of completed windows. Photographs are of fabric and residue, not of people, unless a person cannot be excluded and the shot is necessary as evidence of a safety condition. Waste files include consignee details, SIC associations where used, and signatures. Remediation files include method statements and exclusion maps. These records are kept because environmental and safety law, and the defence of claims, require a trail. They are not published in our portfolio. Portfolio pages use recovery references without client trading names.
8. Recipients
Recipients include our personnel who need the data, professional advisers such as accountants and solicitors, insurers, banks processing invoices, IT hosting for email, waste carriers and disposal facilities, landlords and managing agents where access requires it, and public authorities when law requires disclosure. Google Ireland Limited or Google LLC may receive technical data if you load Fonts or Maps. We do not disclose data to brokers. If a corporate transaction is contemplated, data may be disclosed under confidentiality to a prospective buyer’s advisers, limited to what due diligence requires.
9. International transfers
Our primary filing is in the United Kingdom. Email and productivity tools may use infrastructure that transfers data to the United States or other third countries. Where that occurs we require the UK International Data Transfer Addendum or another mechanism recognised by the UK government. You may request a summary of transfer safeguards by writing to general@directbranded.art. We will not transfer special category data outside the UK unless a documented assessment supports it.
10. Retention
Enquiry records that do not become contracts are kept for up to twenty-four months so that a later surface read can see what was already refused. Contract files are kept for six years after the end of the engagement, reflecting limitation in England and Wales for simple contract, unless a deed or a longer statutory waste or health-and-safety period applies. Health and safety reports of incidents are kept in line with RIDDOR and our insurer’s requirements, often a minimum of three years and longer where a child or a latent injury is involved. Waste transfer notes are kept for at least two years, and hazardous waste consignment notes for at least three years, or longer if a regime or a claim requires it. Website server logs, if retained by a host, follow the host’s cycle, typically under ninety days. When a period ends, we delete or irreversibly anonymise.
11. Security
We apply access control, unique credentials, and a need-to-know rule on recovery files. Paper slips are not left on a public table. Devices used on site are locked. We require processors to give equivalent assurances. No method is perfect. If a personal data breach is likely to result in a risk to individuals, we will notify the ICO without undue delay and, where the risk is high, we will inform affected individuals with the information the law requires.
12. Your rights
You have the right to be informed, of access, to rectification, to erasure in the cases the Act allows, to restrict processing, to object to processing based on legitimate interests, and to data portability where processing is automated and based on contract or consent. You have rights in relation to automated decision-making; we do not operate such decisions on this site. To exercise a right, write to general@directbranded.art from an address we can reasonably associate with you, or post to 51 Bollington Road, Oadby, Leicester, LE2 4ND, United Kingdom. We may need to identify you. We respond within one month, extendable by two months for complex requests as the statute allows. Access is free unless a request is manifestly unfounded or excessive.
Objecting to a facilities or waste trail that we are legally required to keep will not erase the legally required record. It will stop any secondary use. Erasure will not apply to invoices we must retain for HMRC. We will explain any refusal.
13. Children
The site and the services are not directed at children. We do not knowingly take recovery requests from persons under eighteen. If you believe a child has sent personal data, write to general@directbranded.art and we will delete it unless a legal hold applies.
14. Cookies and similar technology
This Policy sits beside the Cookie Policy. Non-essential cookies, if ever introduced, will be described there and will not run without the consent PECR requires. Presently the site is a static informational surface with a form that posts to a confirmation page, plus third-party map and font resources. Details, durations and how to refuse are in the Cookie Policy.
15. Direct marketing
We do not operate a newsletter from this website. If we later send electronic marketing to a corporate subscriber, we will comply with PECR. You may refuse at any time by writing to general@directbranded.art with the subject line ‘marketing stop’. Transactional messages about an open window are not marketing.
16. Automated processing and profiling
DIRECT BRANDED LTD does not profile website visitors to predict preferences. We do not assign a credit score from this site. Any credit check on a corporate client is a separate controller activity by a licensed agency if we instruct one, under that agency’s notice.
17. Joint controllers and processors
If a client and DIRECT BRANDED LTD jointly determine purposes for a particular list, we will arrange a transparent allocation of GDPR responsibilities. Processors are bound by Article 28 terms: documented instructions, confidentiality, security, sub-processor flow-down, assistance with rights and breaches, deletion or return, and audit information. A list of material processors can be requested from general@directbranded.art.
18. Records of processing
We maintain a record of processing activities proportionate to a company of our scale, covering purposes, categories, recipients, transfers, retention and security measures. The record is an internal instrument. It is available to the ICO on request.
19. Data protection officer
We are not required by Article 37 to appoint a statutory Data Protection Officer for our core activities. Correspondence is still handled seriously through general@directbranded.art. If our activities later require a DPO, this Policy will name that person.
20. Information Commissioner
You may complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, ico.org.uk. We invite you to write to us first so that a window can be opened on the concern. ICO contact does not affect any other remedy.
21. Changes
We will revise this Policy when our processing or the law changes. The version on directbranded.art is the current version. Material changes will be marked by the date below. Continued use of the site after a change is not consent where consent is required; it is notice of the new text.
22. How to contact us
Write to DIRECT BRANDED LTD, 51 Bollington Road, Oadby, Leicester, LE2 4ND, United Kingdom. Email general@directbranded.art. Telephone +44 7860 345678. Do not send passwords or payment-card numbers to that mailbox. Do not use the website form for special category data. If your matter is a subject-access request, say so in the first line.
This Policy was issued for the 2026 publication of directbranded.art and describes processing for administrative and support services, waste management and remediation, facilities support, BPO, and corporate logistics as carried out from Oadby, Leicester, under the law of England and Wales.
23. Schedule of processing by activity
Administrative support windows process the names and business contact details of client staff who issue instructions, visitors whose attendance is logged, and suppliers whose invoices are coordinated. The purpose is performance of the contract and the legitimate interest of keeping a reliable coordination trail. Recipients are the client’s nominated supervisors and our operators. Retention follows the contract file. No special category data is sought. If a visitor book includes a vehicle registration, that registration is treated as personal data and is not published.
BPO windows may process the client’s customer names, order references, delivery addresses and complaint narratives because the client has instructed us to run a cycle. In that posture we are a processor. The client remains controller of that customer data and must have its own notice. Our operators see only the fields required for the cycle. Exports from a client system are stored in restricted folders. When the window closes, customer data is returned or deleted according to the processing terms, except for a minimal invoice trail that we control as controller showing that work occurred.
Facilities windows process names of attending technicians, alarm codes only insofar as a sealed instruction requires, and photographs of plant. Alarm codes are not stored in email if an alternative vault is available. Photographs are cropped to fabric. If a CCTV system on a client site captures our staff, the client is controller of that CCTV and must handle our staff’s data lawfully.
Waste and recycling windows process signatory names on transfer notes, carrier permit numbers, and site addresses. These are legal records. Requests for erasure of a signatory name on a transfer note that is still within its statutory retention will be refused with an explanation. After retention, destruction is logged.
Remediation windows process names of persons authorised to enter an exclusion zone, medical fitness only if a statutory or CDM role requires it, and emergency contacts supplied by the client. Medical fitness, if held, is minimised to a pass or fail against a defined task, not a diagnosis, unless a clinician’s certificate must be kept.
Logistics and fulfilment windows process delivery contacts, proof-of-delivery names, and exception owners. Proof-of-delivery signatures are kept for the claim period. We do not use delivery names for marketing.
24. Lawful basis table in narrative form
Contract performance covers scheduling, delivering and invoicing the window you bought. Legitimate interests cover answering a first enquiry, keeping a refusal file so we do not repeat an unsafe lift, securing the website, and sharing limited data with insurers when a claim is intimated. Legal obligation covers tax, waste, health and safety, and court orders. Vital interests are unused in ordinary work; they would apply only if we had to share a name to protect life on a hazardous site. Public task does not apply; we are not a public authority. Consent is reserved for optional items and for any cookie that PECR treats as non-essential.
25. Recipients in further detail
Professional advisers receive data under privilege or confidentiality. Insurers receive claim files. Banks receive payee names. Hosting providers receive whatever the email system stores. Waste facilities receive what a consignment note must show. The police or the Environment Agency receive what a lawful notice requires. A court receives what a disclosure order requires. We will not disclose to journalists. Portfolio text does not contain personal names of client staff.
26. Security measures in further detail
Logical access is unique, not shared. Privileged access to mailboxes used in BPO is reviewed. Paper waste containing personal data is shredded. Removable media is avoided. Site tablets are encrypted where the device allows. We train operators not to photograph badges or faces. We require that recovery request messages not include extra lists of unrelated staff. A breach log exists. Testing of restoration from backup is periodic and proportionate.
27. Rights handling procedure
When a request arrives, we date it, identify the requester, clarify the scope if the request is broad, search mail, engagement files and waste records, and extract what the law requires. We will not disclose a third party’s data without considering that third party’s rights. We may provide data in a concise electronic form. We will not provide a replica of an entire server. Manifestly unfounded requests, such as repeated identical demands intended to disrupt a live remediation window, may be refused or charged as the ICO’s guidance allows.
28. Processor instructions we will not follow
We will not follow a client instruction to delete a waste note that is still within statutory retention. We will not follow an instruction to copy a mailbox of an employee who has not been told, unless a documented lawful basis exists. We will not follow an instruction to transfer a file to an unnamed personal address. We will record the refusal. The client remains responsible for the lawfulness of its instructions; we remain responsible for our own.
29. Website form notice
The recovery request form collects name, email and message. Those fields are required to log a slip. The form posts to a confirmation page. Treat the message as a letter to the company. Do not include extra identifiers of other people unless they are the point of the request. IP logging, if performed by hosting, is for security. Confirmation-page visits are not used to score you.
30. Employment and applicant data
If you apply to work with DIRECT BRANDED LTD, we process your CV and correspondence to decide whether to engage you, which is a step prior to contract and a legitimate interest in recruitment. Unsuccessful applicant files are kept for up to twelve months unless you ask us to delete sooner and no equalities claim requires a hold. We do not want special category data in a speculative CV. Criminal-record checks, if ever required for a site, follow the Rehabilitation of Offenders Act and the correct level of disclosure.
31. Supplier data
Supplier contacts are processed to buy services, pay invoices and meet duty of care when the supplier is a carrier. Retention follows commercial limitation and tax. Public liability certificates may contain a director’s name; they are stored as insurance evidence, not as a marketing list.
32. Closed-circuit and body-worn
DIRECT BRANDED LTD does not operate public CCTV at 51 Bollington Road, Oadby, Leicester, LE2 4ND, United Kingdom as a surveillance product through this website. If a future site office uses CCTV, signage and a local notice will be added. Body-worn cameras are not standard kit. If a high-risk remediation window requires them, individuals will be told at the exclusion line.
33. Links
The site may link to ICO guidance or to maps. Other sites have their own controllers. This Policy does not govern them.
34. Language and accessibility
This Policy is issued in English. If you need a reasonable adjustment to access it, write to general@directbranded.art. We will not charge for a reasonable accessible copy of your own data.
35. Governing text
If a translated summary is later issued, the English text on directbranded.art prevails. Section headings are for reading, not for limiting a clause. References to statutes include replacements and subordinate legislation. References to the ICO include any successor.
For completeness, the company states that personal data is processed in connection with Administrative and Support Services, Administrative and Support and Waste Management and Remediation Services, Business Support Services, business services not elsewhere classified, Outsourced business process management, Facilities and office maintenance support, Commercial waste management and recycling, Environmental remediation and industrial cleanup, Back-office administrative coordination, and Corporate logistics and fulfilment services, all from the Leicester address above, with the mailbox general@directbranded.art as the primary data route.
36. Lawful bases illustrated by recovery windows
When a facilities supervisor emails photographs of a failed pump, we process the supervisor’s name and the image of plant under contract performance if a Window is live, or under legitimate interests if the message is a pre-contract enquiry. When a waste transfer note is signed, we process the signatory’s name under legal obligation. When we store an unsuccessful enquiry for twenty-four months, we rely on legitimate interests in not repeating an unsafe lift. When we send an invoice to an accounts mailbox, we rely on contract and on legal obligation for tax. When we share a claim file with an insurer, we rely on legitimate interests in defending claims and on the insurance contract.
We do not treat a visitor who merely reads terms-and-conditions.html as having entered a contract. We do not treat scrolling as consent. We do not treat a telephone call to +44 7860 345678 as permission to add the number to a marketing list. If a caller asks to be contacted about a later Window, that request is logged as an enquiry, not as a newsletter subscription.
37. Categories we do not want
Do not send us copies of passports through the website form. Do not send us medical diagnoses. Do not send us children’s data. Do not send us trade-union membership lists. Do not send us genetic or biometric templates. Do not send us passwords. If a remediation Window truly requires a fitness certificate, send it through the named supervisor path described in the method statement, not through the public form. If you send unwanted special category data, we will delete it unless a legal hold applies, and we will tell you if we can identify the sender.
38. Recipients: worked examples
A carrier collecting a skip receives a site address and a gate contact. A disposal facility receives the waste description and the consignee fields the law requires. An accountant receives invoice data. A solicitor receives a dispute file. A hosting provider receives email. The ICO receives what a notice requires. A Client’s landlord receives confirmation of attendance times if access requires it. A Client’s customer does not receive our internal recovery notes unless the Client instructs a processor disclosure that is lawful.
39. Retention worked examples
A quote that was refused in March is deleted or anonymised by March two years later unless a claim has been intimated. A BPO mailbox export is deleted at the end of the processor term except for the invoice narrative ‘cycle run, hours’. A hazardous consignment note dated June is kept at least until June three years later. A RIDDOR file is kept in line with insurer and HSE expectations, often much longer than two years. A job application that did not proceed is removed within twelve months.
40. Security incidents
If an operator’s bag containing a paper visitor list is lost, we assess identifiability and risk, contain, and decide on ICO notification. If a mailbox is phished, we reset credentials, review sent items, and notify the Client if Client-controlled data may have been accessed. If a laptop is stolen, we rely on device authentication and encryption where present. You can reduce risk by not emailing extra spreadsheets of unrelated staff. DIRECT BRANDED LTD will not pretend a paper table is a bank vault; it will pretend even less that it is a laboratory.
41. Your right to object, illustrated
You may object to our keeping an unsuccessful enquiry. We will consider the objection against our need not to repeat an unsafe lift. You may object to a photograph of a doorway that includes a reflection of a face. We will crop or delete if the face is not necessary. You cannot object to a tax invoice existing. You cannot object to a waste note existing during its statutory life. You may complain to the ICO if you disagree with our balance.
42. Automated tools
Spam filtering on email may automatically quarantine messages. That is not a solely automated legal decision about you; it is mail hygiene. If you believe a recovery request was trapped, telephone +44 7860 345678 or post to 51 Bollington Road, Oadby, Leicester, LE2 4ND, United Kingdom. Browser autofill is your browser. Map tiles are Google’s systems. We do not run a credit-scoring model on website visitors.
43. Updates and versioning
This Policy may be versioned by date on privacy-policy.html. We will not hide a new purpose inside a synonym. If we begin using a new processor that materially changes risk, we will say so. If UK law is replaced by a successor data regime, references to UK GDPR are read as references to that successor so far as possible.
Correspondence about this Policy is not a Window. It does not require a quotation. It should still be civil. Abuse of data-rights processes to disrupt a live spill response may be treated as excessive. DIRECT BRANDED LTD still has to consider the request; it may extend the deadline as the Act allows and it may speak to the ICO if harassment is involved.
44. Leicester filing and language of records
Operational files are directed from 51 Bollington Road, Oadby, Leicester, LE2 4ND, United Kingdom. Records are kept in English. If a site instruction arrives in another language, we may ask for an English working copy before we act. We will not refuse a data-rights request solely because it is not in English, but we may take the extra time the law allows to understand it. The website mailbox general@directbranded.art is the correct first address. Telephone +44 7860 345678 is available during table hours. Do not send original identity documents by untracked post unless we have asked for them in writing for a specific, lawful check.