Data protection policy
Last updated: October 2026
Parragon Ltd ("we", "us", "our") is committed to protecting your personal information in line with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. This policy explains what information we collect about you, why we collect it, how we use it, and what rights you have.
1. Who we are
Parragon Ltd is the data controller for the personal information described in this policy. We provide site security, temporary CCTV, lighting, monitoring and manned security services across the United Kingdom.
Registered in England and Wales. Registered office: [registered address to be confirmed]. Company number: [company number to be confirmed]. Our Information Commissioner's Office registration status and number are to be confirmed.
2. How to contact us about your data
If you have any questions about this policy, or wish to exercise any of the rights set out below, please contact us:
Email: parragon@parragonuk.org
Telephone: 020 8092 9397
Post: [registered address to be confirmed]
3. Information we collect
We may collect and process the following categories of personal information:
Information you give us: your name, job title, company, email address, telephone number, the address of the site you need protected, and the content of any messages you send us through our enquiry form, by email or by telephone.
Information about your use of our website: technical information such as your IP address, browser type and version, operating system, pages viewed, referring website, and the date and time of your visit. This is collected through cookies and similar technologies — please see our Cookie policy for full details.
Information from third parties: where relevant to a quote or contract, we may receive information about you from our suppliers, subcontractors, or from the owner or principal of a site we are instructed to protect.
CCTV and monitoring footage: where we operate cameras on a site on our client's instruction, our client is normally the data controller of that footage and we act as their data processor. If you have a query about footage of yourself, please contact the site owner in the first instance, or contact us and we will direct you.
4. Why we use your information and our lawful basis
We only use your personal information where the law allows us to. The table below sets out our purposes and the lawful basis we rely on (Article 6 UK GDPR).
Responding to your enquiry and providing a quotation — necessary in order to take steps at your request before entering into a contract with you personally (Article 6(1)(b)). For contacts acting for a business, we rely on our legitimate interests in handling business enquiries, balanced against your rights (Article 6(1)(f)).
Performing a contract for the supply of security products or services — necessary for the performance of a contract with you personally (Article 6(1)(b)). Where you act for your employer, we rely on our legitimate interests in managing that business relationship, balanced against your rights (Article 6(1)(f)).
Managing our business relationship, including billing, support and service records — necessary for the performance of a contract and for our legitimate interests in running our business efficiently (Articles 6(1)(b) and 6(1)(f)).
Improving our website and services, and understanding how visitors use the site — our legitimate interests in developing and improving our services, and, for any future consent-requiring tracking, your consent. We have not added optional analytics or advertising tracking to the website (Articles 6(1)(a) and 6(1)(f)).
Complying with our legal obligations, including tax, record-keeping, licensing, health and safety, and preventing crime — necessary for compliance with a legal obligation (Article 6(1)(c)).
Preventing and detecting crime, and protecting the safety of people and property — our legitimate interests, balanced against your rights (Article 6(1)(f)). Any processing of special-category or criminal-offence data requires an additional applicable legal condition; legitimate interests alone is not sufficient.
5. Who we share your information with
We do not sell your personal information, and we do not share it except where set out here. We may share your information with:
Our professional advisers (accountants, insurers and solicitors); our technology and service providers who host our website, process payments, store data or help us deliver monitoring services; our subcontracted security operatives where we engage them to deliver a service to you; and the police, our client, or a regulator where we are required or permitted by law to do so, or where it is necessary to prevent or detect crime.
Website enquiry and confirmation emails are delivered through Lovable managed email. If you use our automated service recommender, your description is sent to Lovable AI and its model providers. Approved staff may also use that service to draft replies from enquiry text and relevant notes. Recommendations are automated; staff drafts are reviewed before sending. See our website Privacy policy.
All service providers are required to use your personal information only for the specific purpose we have engaged them for, and in accordance with UK GDPR.
6. International transfers
We aim to keep your personal information within the United Kingdom or the European Economic Area. Where a supplier transfers information outside the UK, we only do so where the destination country is covered by UK adequacy regulations, or where we have put appropriate safeguards in place, such as the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.
7. How long we keep your information
We only keep personal information for as long as we need it for the purposes set out above, and then only where we have a lawful reason to continue — for example to meet tax, accounting or licensing obligations.
Enquiry and quotation records that do not become a contract are normally retained for up to three years. Contract, billing and correspondence records are normally retained for six years, to match limitation and tax requirements. CCTV and monitoring footage held by us is normally retained for 30 days unless it is required as evidence, in which case it is kept until the matter is closed.
8. Your rights
You have the following rights under UK GDPR. Each is free of charge:
Right of access — to obtain a copy of the personal information we hold about you. Rectification — to have inaccurate or incomplete information corrected. Erasure — to ask us to delete information where we have no lawful reason to keep it. Restriction — to ask us to stop actively using your information in limited circumstances. Objection — to object to processing based on our legitimate interests, including direct marketing.Data portability — to receive information you gave us in a structured, commonly used machine-readable format, or to have it sent to another provider.Withdraw consent — where we rely on your consent, to withdraw it at any time, without affecting processing already carried out.
To exercise any of these rights, email parragon@parragonuk.org. We will respond within one month. We may need to verify your identity before dealing with your request, and in some cases we may need to ask you for further information; in that event our response period begins again once we receive it.
9. Marketing
We will only send you marketing information about our services where you have asked us to, or where we are permitted to do so under the Privacy and Electronic Communications Regulations. You can ask us to stop at any time by replying to any message or emailing parragon@parragonuk.org, and we will act on that request promptly.
10. Security
We use appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction or damage. This includes access controls on our systems, encryption of information in transit where available, and limiting access to personal information to the people who genuinely need it to do their job.
11. Automated decision-making
We do not make decisions about you by automated means that have a legal or similarly significant effect on you, and we do not profile you in that way.
12. Making a complaint
If you are unhappy with how we have used your personal information, please contact us in the first instance using the details in section 2. If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office, the UK's independent regulator for information rights:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Web: ico.org.uk/raise-your-concerns
13. Changes to this policy
We keep this policy under regular review and will post any changes on this page. Where a change materially affects how we use your information, we will notify you directly. This policy was last updated in October 2026.