PRIVACY POLICY
Last updated: September 2025
​
Introduction
Whitetree (“we”, “our”, “us”) respects your privacy and is committed to protecting your personal data. This policy explains how we collect, use, and safeguard your information when you visit our website (www.whitetree.co.uk) or use our services.
​
Who We Are
Whitetree is the data controller. Whitetree consists of:
-
Whitetree Group Limited (company number 11365046)
-
Whitetree Resourcing Limited (company number 11727311)
​​
Registered office: One New Street, Wells, Somerset, BA5 2LA.
​
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA).
​
How to Contact Us
If you have any questions about this privacy policy or how we handle your personal data, please contact:
📧 info@whitetree.co.uk
📮 One New Street, Wells, Somerset, BA5 2LA
You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk.
​
What Data We Collect
We may collect the following categories of personal data:
-
Contact data – name, email address, phone number, job title, organisation
-
Customer data – billing details, service history, communications
-
Website usage data – IP address, browser type, pages visited, cookies
-
Marketing preferences – opt-in choices, consent records
-
Recruitment data – if you apply to work with us (see our Candidate Privacy Notice)
-
​
We do not routinely collect special category data. If we need to, we will request your explicit consent.
​
Our services are not intended for children. If they may be accessed by children, we apply additional safeguards in line with the DUAA 2025.
​
How We Collect Data
We collect data in the following ways:
-
Directly from you (enquiries, emails, phone calls, service delivery)
-
Through recruitment activities
-
Automatically when you use our website (cookies, analytics)
-
From trusted third parties (e.g. analytics providers, professional networks)
How We Use Your Data
We use your personal data to:
-
Provide and improve our services
-
Manage client relationships and enquiries
-
Send updates and marketing (if you opt in)
-
Meet legal and regulatory obligations
-
Protect our business (security, safeguarding, fraud prevention)
Our Legal Bases
We process your personal data under one or more of the following bases:
-
Consent – where you have given permission (e.g. marketing)
-
Contract – to perform our services
-
Legal obligation – to comply with the law
-
Legitimate interests – to operate our business, balanced against your rights
-
Recognised legitimate interests (new under DUAA 2025) – for activities such as safeguarding, crime prevention, or responding to emergencies
Automated Decision-Making
We do not currently use solely automated decision-making that has legal or significant effects.
If we do in future, you will have the right to:
-
Be informed,
-
Request human review, and
-
Challenge the decision.
Cookies and Tracking
Our website uses cookies and similar technologies to:
-
Enable essential site functions
-
Improve performance and user experience
-
Analyse website traffic
Some low-risk cookies may be used without consent (as permitted under DUAA 2025). For all other cookies, we will ask for your permission.
​
Sharing Your Data
We may share your data with:
-
Other Whitetree companies
-
IT and hosting providers
-
Professional advisers (lawyers, accountants, auditors)
-
Regulators or authorities where legally required
We do not sell your personal data.
​
International Data Transfers
If we transfer your data outside the UK, we ensure it is protected to a standard not materially lower than that required under UK law (DUAA 2025 standard).
​
Your Rights
You have the right to:
-
Request access to your personal data (Subject Access Request). We will carry out a reasonable and proportionate search, and may pause the response time if clarification is needed.
-
Request correction or erasure of your data
-
Restrict or object to processing
-
Request data portability
-
Withdraw consent at any time (where consent applies)
To exercise these rights, please email info@whitetree.co.uk.
Data Security
We use technical and organisational measures to protect your data from unauthorised access, loss, or misuse. Access is restricted to those who have a genuine business need.
If a breach occurs that affects your data, we will notify you and the ICO where legally required.
Data Retention
We retain your personal data only as long as necessary for the purposes set out in this policy, or to meet legal, accounting, or reporting obligations.
In some cases, we may anonymise data for longer-term analysis.
Changes to This Policy
We may update this privacy policy from time to time. Please check this page periodically for the latest version.