PRIVACY POLICY

Feref Limited (“Feref”, “we”, “our” or “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share and safeguard personal data when you interact with us, including through www.feref.com.

1. Who we are

Feref Limited is a company registered in England and Wales under company number 14857352 and is part of The Delta Group.

For the purposes of this website, Feref Limited acts as the data controller.

Data protection matters are handled centrally by The Delta Group. For any data protection enquiries, requests or complaints, please contact:

Email: gdpr@thedeltagroup.com

2. Personal data we collect

The personal data we collect depends on how you interact with Feref.

• Clients and suppliers: name, business contact details, company information and other information required to establish and manage a business relationship or fulfil contractual obligations.
• Job applicants: name, contact details, employment history, CV and other information supplied as part of an application. This may include special category personal data where relevant and permitted by law.
• People who contact us: name, email address, telephone number, company and any other information you choose to provide.
• Website visitors: IP address, browser and device information, pages requested, technical website information and cookie-consent preferences.

Where we process special category personal data, we will only do so where an appropriate condition under data protection law applies.

For information about cookies and similar technologies used on this website, please see our Cookie Policy.

3. How we use your personal data

We may use personal data for the following purposes:

• Clients and suppliers: to establish and manage business relationships, provide or receive services, administer accounts, fulfil contractual obligations and communicate with you.
• Job applicants: to assess applications, communicate with candidates and manage recruitment.
• People who contact us: to respond to enquiries and communicate with you by email, telephone or other appropriate means.
• Website visitors: to operate, secure, maintain and improve the website and to record and respect your cookie preferences.
• Security and administration: to protect our systems, information, employees, clients and suppliers.
• Legal and regulatory purposes: to comply with applicable laws and regulations and to establish, exercise or defend legal claims.

We use CookieYes as our consent management platform to record and respect website cookie preferences.

4. Legal bases for processing

We only process personal data where we have a lawful basis to do so. Depending on the circumstances, these may include:

• Contract: where processing is necessary to enter into or perform a contract with you, including taking steps at your request before entering into a contract.
• Legitimate interests: where processing is necessary for our legitimate business interests and those interests are not overridden by your data protection rights.
• Legal obligations: where processing is necessary to comply with legal, regulatory, tax, accounting or other statutory requirements.
• Consent: where you have given us consent to process personal data for a specific purpose, including the use of non-essential cookies where consent is required.

5. Consent

Where we rely on your consent, you may withdraw that consent at any time.

For general data protection matters, contact gdpr@thedeltagroup.com.

Cookie consent can be reviewed, changed or withdrawn at any time using the CookieYes settings icon displayed on the website.

Withdrawing consent does not affect the lawfulness of any processing carried out before consent was withdrawn.

6. Sharing personal data

Where necessary for the purposes described in this Privacy Policy, we may share personal data with:

• other companies within The Delta Group where appropriate for the relevant business activity or service;
• website hosting, IT, security and technical service providers;
• cookie-management, embedded-media and other website service providers;
• recruitment platforms and recruitment service providers;
• professional advisers including accountants, auditors, insurers and legal advisers;
• clients, suppliers and other business partners where necessary to provide or receive services; and
• regulators, law-enforcement bodies, courts or other authorities where disclosure is required or permitted by law.

Where another organisation processes personal data on our behalf, we require it to handle that data appropriately and in accordance with applicable data protection law.

We do not sell your personal data.

7. International transfers

Some third-party technology and service providers used by Feref or by this website may process personal data outside the United Kingdom.

Where personal data is transferred internationally, appropriate steps are taken to ensure that it remains protected in accordance with UK data protection law. This may include relying on UK adequacy regulations or appropriate contractual safeguards where required.

8. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, regulatory, tax, accounting and business requirements.

Our general retention periods include:

• Clients and suppliers: generally for six years following the end of the relevant financial year or business relationship where records are required for accounting, tax, contractual or legal purposes, and longer where required by law.
• Job applicants: generally for up to 18 months, unless a different period has been explained to you or continued retention is appropriate for future opportunities.
• General enquiries: generally for up to 18 months unless the enquiry results in an ongoing business relationship or there is another reason to retain the correspondence for longer.
• Emails: generally for up to three years, although correspondence connected with contracts, financial records, legal matters or other ongoing business requirements may be retained for longer where necessary.
• Cookie information: according to the lifetime of the relevant cookie or service. Current cookie durations are set out in our Cookie Policy.

Personal data subject to a statutory or legal retention requirement will be kept for the applicable mandatory period.

9. Your rights

Depending on the circumstances, UK data protection law gives you rights in relation to your personal data, including:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete personal data.
• Right to erasure: ask us to delete personal data in certain circumstances.
• Right to restrict processing: ask us to restrict how personal data is processed in certain circumstances.
• Right to data portability: receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, have it transferred to another organisation.
• Right to object: object to certain processing based on legitimate interests and object at any time to processing for direct-marketing purposes.
• Right to withdraw consent: where processing is based on consent, withdraw that consent at any time.
• Rights relating to automated decision-making: where applicable, exercise rights relating to decisions based solely on automated processing that have legal or similarly significant effects.

To exercise any of these rights, contact gdpr@thedeltagroup.com.

We may need to verify your identity before responding to a request. Valid data-subject requests will normally be dealt with within one month, subject to the exceptions permitted by data protection law.

10. Data security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal data is limited to employees, contractors and service providers who require it for legitimate business purposes and who are subject to appropriate confidentiality and data protection obligations.

11. Data protection complaints

If you have a concern or complaint about how Feref has collected, used, stored or otherwise handled your personal data, please contact us in the first instance:

Data Protection Contact
HR Office
The Delta Group
Delta Park, 1, 2 & 3 Wood Street
Thorley
Bishop’s Stortford
CM23 4TR
United Kingdom

Email: gdpr@thedeltagroup.com

If you remain dissatisfied with how your personal data or complaint has been handled, you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, business activities, technology or legal requirements.

The date below indicates when this Privacy Policy was last reviewed and updated.

---

Last updated: 30 August 2026