Our website terms of use, privacy notice and cookie policy. How Eco Drift Limited handles your personal data under UK data protection law.
This website is operated by Eco Drift Limited, a company registered in England and Wales under company number 07427833.
| Registered office | Larch House, Parklands Business Park, Denmead, Hampshire, PO7 6XP |
|---|---|
| Correspondence address | 1000 Lakeside, Western Road, North Harbour, Portsmouth, Hampshire, PO6 3EN |
| office@ecodrift.co.uk | |
| Telephone | 023 9228 7112 |
References to "we", "us" and "our" mean Eco Drift Limited. References to "you" and "your" mean the person using this website.
By accessing or using this website you confirm that you accept these Terms of Use and agree to comply with them. If you do not agree, please do not use the website.
You do not need to register to use this website.
We may amend these Terms of Use at any time by updating this page. Please check this page periodically. The date at the foot of this page indicates when it was last revised. Continued use of the website after any change constitutes acceptance of the revised terms.
We may update, suspend, withdraw or restrict access to all or any part of the website without notice. We do not guarantee that the website, or any content on it, will always be available or uninterrupted, and we will not be liable to you if the website is unavailable at any time or for any period.
You may use this website only for lawful purposes. You must not:
We may report any breach of these provisions to the relevant law enforcement authorities and will co-operate with those authorities by disclosing your identity to them. Any such disclosure will be made in accordance with our obligations under data protection law.
We are the owner or licensee of all intellectual property rights in this website and in the material published on it. Those works are protected by the Copyright, Designs and Patents Act 1988 and by intellectual property laws and treaties around the world. All such rights are reserved.
You may print off one copy and download extracts of any page from this website for your personal use. You must not modify copies of any materials you have printed or downloaded, and you must not use any illustrations, photographs, video or audio sequences separately from any accompanying text. Our status as the authors of content on the website must always be acknowledged.
Nothing in these Terms of Use excludes or limits our liability for death or personal injury arising from our negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be excluded or limited under English law.
To the extent permitted by law, we exclude all conditions, warranties, representations or other terms which may apply to the website or any content on it, whether express or implied.
We will not be liable to any user for any loss or damage, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with use of, or inability to use, this website, or use of or reliance on any content displayed on it.
The content on this website is provided for general information only. It is not advice on which you should rely, and you should obtain professional advice before taking or refraining from any action on the basis of it.
Where this website contains links to other sites and resources provided by third parties, those links are provided for your information only. We have no control over the contents of those sites or resources and accept no responsibility for them or for any loss or damage that may arise from your use of them.
These Terms of Use, their subject matter and their formation are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, save that if you are a consumer resident elsewhere in the United Kingdom, you may also bring proceedings in the courts of the part of the United Kingdom in which you live.
If any provision of these Terms of Use is found to be invalid or unenforceable, that provision will be severed and the remaining provisions will continue in full force and effect.
Eco Drift Limited is committed to protecting the personal data we hold. This notice explains what personal data we collect, why we collect it, what we do with it, how long we keep it, and the rights you have in relation to it.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Data (Use and Access) Act 2025 (DUAA), which amends parts of the UK data protection and electronic communications framework.
Eco Drift Limited is the data controller for the personal data described in this notice because we decide why and how that data is used. Our details are set out in section 1 above.
In limited circumstances we may process personal data solely on behalf of a client and in accordance with that client's documented instructions. In that situation the client is normally the controller and Eco Drift acts as its processor under the relevant contract. This notice primarily describes processing for which Eco Drift is the controller.
For any question about this notice, to exercise your data protection rights, or to make a data protection complaint, contact us at office@ecodrift.co.uk.
This notice applies to:
Our employees, workers and job applicants are covered by a separate Staff Privacy Notice, which is issued directly to them and is not published on this website.
| Category of person | Data we collect | Where it comes from |
|---|---|---|
| Website enquirers | Name, email address, telephone number, business name, location, details of your enquiry, and technical data about your visit | Directly from you via our web forms or by email |
| Clients and prospects | Contact names, business email addresses and telephone numbers, job titles, site addresses, service requirements, contract and pricing information, correspondence, payment and bank details | Directly from you, from publicly available sources, and from our own records |
| Suppliers and subcontractors | Contact names, business contact details, insurance and accreditation documents, invoices and payment details | Directly from you |
| Site visitors and third parties | Names and contact details where recorded in service records, incident reports or quality audits | From our staff, our clients, or directly from you |
We do not routinely process special category data (such as health data) in relation to clients, suppliers or website users. Where we do, for example an accident or incident record naming an injured person, we process it only where a specific condition under Article 9 UK GDPR applies, most commonly the establishment, exercise or defence of legal claims, or reasons of substantial public interest in the field of health and safety at work.
| Purpose | Detail | Lawful basis |
|---|---|---|
| Responding to enquiries | Answering questions, preparing and issuing quotations | Legitimate interests (responding to a request you have made), or steps prior to entering a contract |
| Providing our services | Scheduling, delivering, supervising and auditing cleaning and facilities services | Performance of a contract; legitimate interests where the contract is with your employer |
| Invoicing and payment | Raising invoices, collecting payment, managing direct debits, credit control | Performance of a contract; legal obligation |
| Supplier management | Procuring goods and services, verifying insurance and accreditation | Performance of a contract; legitimate interests |
| Health, safety and quality | Incident reporting, site audits, ISO 9001 and ISO 14001 management systems | Legal obligation; legitimate interests |
| Accounting and tax | Statutory record keeping and filing | Legal obligation |
| Marketing | Sending information about our services to business contacts | Legitimate interests, subject to PECR (see section 15) |
| Website security | Protecting our forms and infrastructure from abuse | Legitimate interests |
| Legal claims | Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we assess whether the processing is necessary for the stated purpose and balance our interests against the individual's rights and freedoms. We keep that assessment under review and will provide further information on request where appropriate.
If you enquire about our services, we may contact you about that enquiry and about services similar to those you enquired about. You may opt out at any time: every marketing message we send contains an unsubscribe mechanism, and you can also object by contacting us directly.
We do not send unsolicited marketing to individual subscribers by electronic mail without consent, and we do not sell, rent or otherwise share your details with third parties for their own marketing purposes.
We do not sell personal data. We share it only where necessary for the purposes described in this notice, with carefully selected service providers, other organisations that have their own legal responsibilities, professional advisers, or public authorities where required or permitted by law. Where an organisation processes personal data on our behalf, we require a written contract containing the protections required by Article 28 UK GDPR.
| Category of recipient | Why we may share personal data | Examples of the function |
|---|---|---|
| Cloud productivity and storage providers | To operate business email, calendars, document storage and collaboration | Email, files, calendars and business collaboration |
| Workforce and operational management providers | To schedule and manage service delivery, attendance, site activity and operational records | Scheduling, shift/job management and service administration |
| Accounting, bookkeeping, payroll and payment providers | To invoice, collect and reconcile payments, maintain accounts and meet statutory financial obligations | Accounting, direct debit collection, payroll and bookkeeping |
| Electronic signature and document workflow providers | To issue, sign and retain contracts and other business documents | Electronic signatures and controlled document workflows |
| Quality, compliance and audit providers | To manage service audits, quality records, health and safety and certification evidence | Quality auditing and compliance records |
| Device, security and infrastructure providers | To protect business devices, accounts, websites and systems | Mobile device management, hosting, content delivery, anti-abuse and cyber security |
| Workflow automation and integration providers | To connect approved business systems and automate defined administrative processes | System-to-system workflows and integrations |
| Approved AI-assisted service providers | Where appropriate, to assist with administrative drafting, summarisation, classification or analysis under human review | AI-assisted productivity and workflow support; not solely automated significant decision-making |
| Website analytics provider | Only if you accept analytics cookies, to understand how our website is used (see section 25) | Google Analytics |
| Professional advisers and assurance bodies | Where necessary for professional advice, insurance, audit or certification | Accountants, legal advisers, insurers, auditors and certification bodies |
| Public authorities and other lawful recipients | Where disclosure is required or permitted by law | HMRC, regulators, courts, law enforcement and other competent authorities |
We keep an internal record of our processing activities and service providers, which we review when systems or suppliers change.
Some recipients and service providers may process personal data outside the United Kingdom. Where a restricted transfer takes place, we use a transfer mechanism permitted by UK data protection law. Depending on the circumstances this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. Where required, we assess the protection available for the transfer and put additional measures in place where necessary.
You may request further information about the safeguards applying to a particular transfer using the contact details in section 11.
| Record type | Retention period | Reason |
|---|---|---|
| Enquiries that do not lead to a contract | 12 months from last meaningful contact | Business follow-up and dispute handling; reviewed for ongoing necessity |
| Unsuccessful quotations and tender submissions | 24 months after the opportunity closes | Reasonable follow-up, audit trail and dispute handling; longer only if a claim or legal need arises |
| Client contracts and core service records | 6 years after the contract ends (normally); up to 12 years where a contract is executed as a deed | Limitation periods and defence/establishment of legal claims |
| Accounting and tax records | At least 6 years from the relevant accounting period, subject to the specific statutory rule | Companies Act / HMRC record-keeping requirements |
| Supplier contracts and transaction records | 6 years after the relationship or relevant transaction ends | Contract limitation and financial audit trail |
| RIDDOR accident / incident records | At least 3 years from the date the record is made; longer where a claim, insurer or other legal requirement justifies it | RIDDOR record-keeping and legal claims |
| Website security / technical logs | Website application logs: 14 days. Server logs: as set by our hosting provider, only as long as needed for security and troubleshooting | Security and abuse prevention |
| Website cookies and similar technologies | As set out for each item in section 25 | PECR / UK GDPR |
| Marketing contact records | Until you object, or 24 months after last meaningful engagement; suppression details kept as necessary to honour an opt-out | Legitimate interests / PECR and respecting objections |
At the end of the applicable period we securely delete or anonymise the data, unless we are required to retain it for longer by law or in connection with an actual or anticipated legal claim.
We maintain technical and organisational measures appropriate to the risk, including multi-factor authentication on business accounts, role-based access controls, encrypted transmission of data, managed devices, password management tooling, and documented procedures for granting and withdrawing access when staff join or leave.
We operate certified ISO 9001 and ISO 14001 management systems, and our procedures for handling information are maintained as controlled documents within those systems.
Under UK GDPR you have the right to:
To exercise any of these rights, contact us using the details in section 11. For access requests, we take reasonable and proportionate steps to locate the requested personal data. We normally respond within one month, subject to any lawful extension or clarification permitted by data protection law.
There is normally no charge. We may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive. We may need to verify your identity before responding.
If you believe we have infringed data protection law, you can make a data protection complaint to us at office@ecodrift.co.uk. We will acknowledge receipt within 30 days, investigate without undue delay, keep you appropriately informed of progress, and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
| Website | ico.org.uk/make-a-complaint |
|---|---|
| Helpline | 0303 123 1113 |
| Post | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
We do not currently make decisions about you solely by automated means where the decision produces legal effects or similarly significant effects. Approved AI-assisted tools may be used to support administrative tasks such as drafting, summarisation, classification or analysis, but material decisions are subject to appropriate human review. If we introduce significant automated decision-making, we will assess the processing and update this notice before it begins.
New or materially changed AI-assisted or automated processing is subject to our data-protection-by-design process. A Data Protection Impact Assessment will be completed where the processing is likely to result in a high risk to individuals.
Cookies are small text files placed on your device when you visit a website. They allow the site to function correctly and to remember information about your visit. Similar technologies, such as your browser's local storage, work in a comparable way.
Our use of cookies and similar storage/access technologies is governed by PECR, as amended by the Data (Use and Access) Act 2025, and, where personal data is processed, by the UK GDPR and Data Protection Act 2018.
PECR allows certain storage/access technologies to be used without prior consent where a statutory exception applies, including technologies that are strictly necessary to provide a service you have requested.
Where no exception applies, we ask for your consent first. On this website that means analytics cookies: they are not set unless you choose Accept in our cookie banner. Declining is as easy as accepting, and you can change your choice at any time using the Cookie Settings link at the foot of every page.
Google Analytics is not loaded at all until you accept, so nothing about your visit is sent to Google before then. If you later withdraw your consent, we delete the analytics cookies and stop loading Google Analytics.
| Cookie / technology | Provider | Classification | Purpose | Duration |
|---|---|---|---|---|
| eco-drift-session | Eco Drift (this website) | Strictly necessary | Keeps your session working between page views, for example while you complete a form | 2 hours |
| XSRF-TOKEN | Eco Drift (this website) | Strictly necessary | Protects our web forms against cross-site request forgery | 2 hours |
| eco-cookie-consent (local storage) | Eco Drift (this website) | Strictly necessary | Remembers whether you accepted or declined analytics cookies, so we do not ask again on every page | Until you clear your browser storage |
| Cloudflare Turnstile | Cloudflare, Inc. | Strictly necessary | Protects our forms from spam and automated abuse (see section 26). Used only on pages with a form | Short-lived, for the security check only |
| _ga | Analytics (consent required) | Distinguishes visitors so we can understand how the website is used | 2 years | |
| _ga_<ID> | Analytics (consent required) | Keeps track of your visit (session) for Google Analytics | 2 years |
We use Cloudflare Turnstile to protect our web forms from spam and automated abuse. Turnstile is a privacy-preserving alternative to traditional CAPTCHA: it does not track you across websites and is not used for advertising. To tell people and bots apart it may process limited technical information, such as a challenge token and your IP address, and may use short-lived storage within the Cloudflare security check. This data is processed by Cloudflare, Inc. solely for security purposes. For more information see Cloudflare's privacy policy.
You can change your analytics choice at any time using the Cookie Settings link at the foot of every page. Most browsers also allow you to refuse or delete cookies through their settings. If you block strictly necessary cookies, parts of the website, such as our forms, may not work correctly. Guidance for common browsers is available at aboutcookies.org.
Last updated: 1 October 2026.