Privacy Policy
introduction
Whitetree (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and protect your personal information when you visit our website (www.whitetree.co.uk), engage our services, contact us, or otherwise interact with us.
who we are
For the purposes of UK data protection law, Whitetree acts as a data controller.
Whitetree consists of:
- Whitetree Group Limited (Company No. 11365046)
- Whitetree Resourcing Limited (Company No. 11727311)
Registered Office:
One New Street
Wells
Somerset
BA5 2LA
Depending on the services provided, the companies within the Whitetree group may act as separate controllers or as joint controllers of your personal data.
We process personal data in accordance with:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Data (Use and Access) Act 2025 (DUAA)
how to contact us
If you have any questions about this Privacy Policy or how we process your personal data, please contact us:
Email: info@whitetree.co.uk
Post:
One New Street
Wells
Somerset
BA5 2LA
personal data we collect
We may collect and process the following categories of personal data:
Contact Data
- Name
- Job title
- Employer or organisation
- Email address
- Telephone number
Customer Data
- Contract details
- Billing and payment information
- Service history
- Correspondence and communications
Website Usage Data
- IP address
- Browser type and version
- Device information
- Pages viewed
- Website interaction data
- Cookie information
Marketing Data
- Communication preferences
- Subscription records
- Consent records
Recruitment Data
- Where you apply to work with us, we may process recruitment-related personal information as described in our Candidate Privacy Notice.
- We do not routinely collect special category personal data. If it becomes necessary to do so, we will identify the appropriate lawful basis and, where required, obtain your explicit consent.
Children’s Data
- Our services are not generally directed at children. Where personal data relating to children may be processed, we will apply appropriate safeguards and protections in accordance with applicable law.
how we collect personal data
We collect information:
- Directly from you through enquiries, meetings, emails, telephone calls and service delivery
- Through recruitment and employment-related activities
- Automatically through website technologies including cookies and analytics tools
- From trusted third parties such as professional networking platforms, business partners, analytics providers and publicly available sources
how we use your personal data
We may use your personal data to:
- Deliver and manage our services
- Respond to enquiries and requests
- Manage client and supplier relationships
- Improve our website, services and customer experience
- Send marketing communications where permitted by law
- Meet legal, regulatory and contractual obligations
- Protect our business, systems and users from fraud, cyber threats and other risks
- Establish, exercise or defend legal claims
automated decision making
We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
If this changes in the future, we will ensure you are informed and provided with applicable safeguards, including the right to:
- Obtain meaningful information about the decision
- Request human intervention
- Express your point of view
- Challenge the decision
Our Lawful Bases for Processing
We process personal data under one or more of the following lawful bases:
Consent
Where you have given clear consent for a specific purpose, such as receiving marketing communications.
Contract
Where processing is necessary to perform a contract with you or take steps at your request before entering into a contract.
Legal Obligation
Where processing is necessary for compliance with legal or regulatory requirements.
Legitimate Interests
Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms.
Recognised Legitimate Interests
Where permitted by law, we may rely on recognised legitimate interests for specific processing activities identified under applicable legislation, including where processing is necessary for:
- Safeguarding vulnerable individuals
- Preventing, detecting or investigating crime
- Responding to emergencies
- Supporting public security or national security requirements
- Certain lawful information-sharing activities with public authorities
In each case, we will ensure that the processing is necessary and proportionate.
cookies & Similar Technologies
We use cookies and similar technologies to:
- Enable essential website functionality
- Improve performance and user experience
- Measure website usage and effectiveness
- Support security and fraud prevention
Certain cookies and similar technologies that are strictly necessary, or which fall within applicable legal exemptions, may be used without consent.
For all other cookies, we will obtain your consent before they are deployed.
Further information can be found in our Cookie Policy.
sharing personal data
We may share personal data with:
- Other companies within the Whitetree group
- IT service providers, hosting providers and software suppliers
- Professional advisers including lawyers, accountants and auditors
- Recruitment and background screening providers where relevant
- Law enforcement agencies, regulators, courts and public authorities where legally required
We do not sell personal data to third parties.
international transfers
Where personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place.
These may include:
- Transfers to countries recognised as providing an adequate level of protection
- International Data Transfer Agreements (IDTAs)
- Approved contractual safeguards
- Other lawful transfer mechanisms recognised under UK data protection law
We will ensure transferred personal data remains protected to a standard that is not materially lower than that required under UK law.
your rights
You have the right to:
- Access your personal data
- Request correction of inaccurate information
- Request erasure of your personal data
- Restrict processing in certain circumstances
- Object to processing in certain circumstances
- Request transfer of your personal data
- Withdraw consent where processing relies on consent
To exercise any of these rights, please contact:
When responding to Subject Access Requests, we may conduct reasonable and proportionate searches and, where permitted by law, seek clarification where necessary before responding.
Raising a Data Protection Complaint
If you have concerns about how we process your personal data, please contact us in the first instance using the details above.
We will:
- Acknowledge your complaint within a reasonable period
- Investigate the matter appropriately
- Keep you informed where necessary
- Explain the outcome of our investigation
If you remain dissatisfied, you may lodge a complaint with the Information Commissioner’s Office (ICO):
data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, accounting and reporting requirements.
Where appropriate, personal data may be securely anonymised and retained for statistical or business analysis purposes.
changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations or data processing practices.
The latest version will always be available on our website.