1. Who we are
Empyrean Fire Consultancy Ltd ("Empyrean", "we", "us") is a fire safety consultancy registered in England and Wales under company number 17131618. Our registered office is Dennett House, 11 Middle Street, Taunton, TA1 1SH, and we have offices in London, Taunton and Grantham.
For the personal information described in this policy, we are the data controller, unless section 5 explains otherwise. We are responsible for deciding how your information is used and for keeping it safe.
If you have any questions about this policy or how we handle your information, contact us at info@empyreanfire.co.uk (subject line "Data Protection") or call 020 3633 9078.
2. Our commitment
We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). In practice this means we only collect what we need, use it for the purposes we tell you about, keep it accurate and secure, and delete it when it is no longer needed.
Our fire safety work often involves sensitive material, including building plans, details of security and life-safety systems, and information about vulnerable occupants. We treat all of this as confidential, whether or not it contains personal data.
3. Information we collect
When you contact us
If you use our website contact form, email, phone or message us, we collect your name, business name, email address, phone number and anything you tell us in your message.
When we work for you
To deliver our services we collect contact details for the people we deal with (for example the Responsible Person, Accountable Person, managing agent or site contact), billing information, and correspondence about the job.
During site visits we may also record photographs, notes, plans and other records of the premises. We aim not to capture identifiable people in photographs; where this happens incidentally, we crop or blur them before the image is used in a report where practical.
When you apply to work with us
If you send us a job application or speculative CV, we collect the information you provide, such as your CV, qualifications, professional memberships and references.
When you visit our website
Our hosting provider automatically records standard server logs, including your IP address, browser type and the pages requested. These are used for security and to keep the site running. We do not use analytics or advertising cookies (see section 11).
4. How we use your information
UK GDPR requires us to have a lawful basis for each use of personal information. The table below sets out what we do and why.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and preparing quotations | Legitimate interests (responding to people who contact us) or steps prior to entering a contract |
| Delivering our services, arranging site visits and issuing reports | Performance of a contract |
| Invoicing, payment and keeping financial records | Performance of a contract; legal obligation |
| Quality assurance, peer review, internal audit and handling complaints | Legitimate interests (maintaining the quality of our work and our ISO 9001 certification) |
| Keeping records of our work to defend or respond to legal claims | Legitimate interests; establishment, exercise or defence of legal claims |
| Assessing job applications | Steps prior to entering a contract; legitimate interests |
| Keeping our website and systems secure | Legitimate interests (information security) |
| Occasional updates about our services to business clients | Legitimate interests; you can opt out at any time |
We never sell personal information, and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.
5. Personal data within client work
Some of our work involves information about people who live in, work in or use the buildings we assess. For example, information about residents who may need assistance to evacuate (including Personal Emergency Evacuation Plans and Person-Centred Fire Risk Assessments) can include health or disability information, which is a special category of personal data.
Where we handle this information to help a client meet their own legal duties, we usually act as a data processor on that client's behalf. The client remains the controller, and our contract with them sets out how we may use the information. If you are a resident or occupant and want to exercise your rights over this information, please contact the building owner or manager first; we will support them in responding.
We restrict access to this information to the consultants working on the job, and only include it in reports where it is necessary for fire safety purposes.
7. International transfers
We store and process information in the UK and European Economic Area wherever possible. Some of our software providers are based in, or use infrastructure in, the United States. Where personal information is transferred outside the UK, we make sure it is protected by an adequacy decision (including the UK-US Data Bridge for certified organisations) or by the ICO's International Data Transfer Agreement or Addendum.
8. How we protect your information
The security controls below are part of our ISO 27001 certified ISMS and are reviewed through internal audit, management review and annual external surveillance audits.
- Access control: staff only access the information they need for their role, using individual accounts protected by multi-factor authentication.
- Encryption: information is encrypted in transit (TLS) and our devices and cloud storage are encrypted at rest.
- Device security: company devices are managed, kept up to date and can be locked or wiped remotely if lost.
- People: all staff are bound by confidentiality obligations and receive information security and data protection training.
- Suppliers: we assess the security of suppliers that handle our information before we use them, and review them regularly.
- Secure disposal: records are deleted or securely destroyed at the end of their retention period.
- Incident management: we have a documented process for reporting, investigating and learning from security incidents.
9. How long we keep it
We keep personal information only for as long as we need it. Our standard retention periods are:
| Type of record | Retention period |
|---|---|
| Enquiries that do not lead to work | 2 years from last contact |
| Reports, site records and project files | 15 years from completion of the work, reflecting the limitation periods for professional negligence and building safety claims |
| Financial and accounting records | 6 years from the end of the financial year they relate to |
| Unsuccessful job applications and speculative CVs | 12 months, unless you ask us to delete them sooner |
| Website server logs | Up to 90 days |
Where we act as a processor for a client, we follow the retention instructions in our contract with that client.
10. Your rights
Under UK data protection law you have the right to:
- access the personal information we hold about you;
- have inaccurate information corrected;
- have your information erased, where there is no good reason for us to keep it;
- restrict how we use your information;
- object to us using your information on the basis of legitimate interests, including for direct marketing;
- receive your information in a portable format, where this applies; and
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email info@empyreanfire.co.uk. We may need to verify your identity before responding. We will respond within one month, and there is normally no charge.
12. Data breaches
If a personal data breach occurs, we will contain and investigate it under our incident management procedure. Where a breach is likely to put people's rights and freedoms at risk, we will report it to the ICO within 72 hours of becoming aware of it, and tell affected individuals without undue delay where the risk is high. Where we act as a processor, we will notify the relevant client without undue delay so they can meet their own obligations.
13. Complaints
If you are unhappy with how we have handled your information, please contact us first at info@empyreanfire.co.uk so we can try to put it right. We will acknowledge your complaint within 30 days and keep you informed of progress.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
14. Changes to this policy
This policy is a controlled document within our Integrated Management System. It is reviewed at least annually and whenever our processing changes. The current version is shown at the top of this page.
Document reference: EFC-IMS-POL-PRV · Version: 1.0 · Last updated: 14 October 2026 · Next review: October 2027
See also our Terms and Conditions.