Your Privacy Matters to Us
We're committed to protecting your personal information and your right to privacy
At Nationwide Metal Recycling, we take the protection of your personal information seriously. This privacy policy explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) and UK data protection laws.
We are committed to being transparent about our data practices and empowering you with control over your personal information.
We follow strict data protection principles and have implemented comprehensive security measures to safeguard your personal information. Your privacy rights are at the heart of everything we do.
Nationwide Metal Recycling Limited is a metal and waste recycling business operating from multiple locations across East England.
Martells Quarry, Slough Lane
Ardleigh, Essex, CO7 7RU
Our ICO registration number is:
Z323472XFor any questions or requests regarding your personal information, please contact our Data Protection Lead using the email address above.
We are committed to protecting your rights to privacy. Under GDPR, you have the following rights regarding your personal data:
You have the right to know what personal data we process about you and why we process it.
You can request a copy of all personal information we hold about you through a Subject Access Request.
You can ask us to correct any inaccurate or incomplete personal data we hold about you.
Also known as the "right to be forgotten," you can request that we delete your personal data in certain circumstances.
You can ask us to limit the way we use your personal data in certain situations.
You have the right to object to processing based on our legitimate interests or for direct marketing purposes.
To exercise any of these rights, please contact our Data Protection Lead at sheila@nmrecycling.co.uk. We will respond to your request within one month, or inform you if we need additional time (up to three months for complex requests).
As a scrap metal dealer and recycling business, we collect and process various types of personal information to comply with legal requirements and operate our business effectively.
When you do business with us, we may collect:
For our employees, we process:
We operate CCTV cameras at our facilities for security purposes. CCTV footage is retained for one month unless needed for crime investigation.
We only collect and process personal data when we have a lawful basis to do so. Here's why we process your information:
As a scrap metal dealer, we are required by legislation to keep certain records for three years, including:
The Scrap Metal Dealers Act 2013 requires us to maintain detailed records of all scrap metal transactions. This legislation helps prevent metal theft and ensures traceability in the recycling industry.
We also process personal information when it's in our legitimate interests as a business, including:
For our employees, we process personal data pursuant to employment contracts, including:
For sensitive information such as health records, we always obtain your explicit consent before processing. You can withdraw this consent at any time by contacting our Data Protection Lead.
We only retain personal data for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations.
CCTV footage is automatically deleted after one month unless it's needed for the investigation of a crime, in which case it may be retained longer and shared with police services.
We follow the principle of data minimization - we only collect and retain the minimum amount of personal data necessary for our purposes. When retention periods expire, we securely delete or destroy the information.
Secure Disposal: All personal data is disposed of securely, either through on-site shredding or via GDPR-compliant confidential waste disposal services.
We share personal data internally on a strict need-to-know basis only. Access to identity records and personnel files is limited to designated individuals with appropriate security measures in place.
We do not sell, rent, or trade your personal information to third parties. We only share personal data externally when:
Accountants, solicitors, and other professional advisers who assist with our business operations (under confidentiality agreements).
When required for the investigation or detection of crime, including metal theft.
Local authorities, Environment Agency, HMRC, or VAT Commissioner when required by law.
When we're legally required to do so pursuant to a court order or legal process.
We work with trusted service providers who process personal data on our behalf under strict GDPR-compliant contracts:
We do not transfer your personal data outside of the United Kingdom. All data processing takes place within the UK under UK GDPR protection.
We take the security of your personal information very seriously. We have implemented comprehensive physical, organizational, and technical measures to protect your data from unauthorized access, loss, or misuse.
We maintain cyber security insurance to provide additional protection. In the event of an IT-related data breach, affected individuals may be offered free access to identity protection services through our insurers.
Our security measures are reviewed, tested, and evaluated at least annually. We also conduct Data Protection Impact Assessments whenever introducing new processes that may affect your data.
While we take extensive measures to protect your data, we recognize that breaches can occur. We have comprehensive procedures in place to respond quickly and appropriately.
We follow the Information Commissioner's Office advice on responding to personal data breaches with transparency and urgency.
We record all personal data breaches in our risk register, no matter how minor, including:
This comprehensive recording helps us identify patterns, strengthen our security, and prevent future breaches.
We encrypt high-risk personal data including identification records, financial information, and health records. Encryption significantly reduces risks to individuals following a breach.
We make it easy for you to access, correct, or delete your personal information. Here's how to exercise your GDPR rights:
You can submit requests in any format - there's no required wording or official form. You can contact us:
We respond to all requests within one month. For complex requests, we may need up to three months - if so, we'll inform you within the first month and explain why additional time is needed.
When you request access to your personal data:
To facilitate quick responses to your requests, we maintain well-organized records:
Subject access requests and most other rights requests are completely free of charge. We only charge a reasonable administrative fee for manifestly unfounded, excessive, or repetitive requests.
In rare cases where we cannot fulfill a request (for example, due to legal obligations to retain certain records), we'll explain our reasons and seek legal advice if necessary. You always have the right to complain to the ICO if you're unsatisfied with our response.
While we strive to handle all data protection concerns directly, you have the right to lodge a complaint with the UK's data protection supervisory authority.
We encourage you to contact us directly first:
01206 231 534
You can contact the Information Commissioner's Office if:
We take all privacy concerns seriously and will work diligently to resolve any issues. If you're unhappy with how we've handled your data or responded to your request, please let us know so we can make it right.
We review and update this privacy policy regularly to ensure it remains accurate and compliant with current data protection laws.
Last Updated: January 2026 | Next Review: January 2027
When we make significant changes to this privacy policy, we will:
If you have any questions about this privacy policy or our data practices, we're here to help:
Our Data Protection Lead is here to help with any questions or concerns about your personal information.
