Last updated: 5 October 2026
This Privacy Policy explains how ZimCos Security Ltd handles personal information when you visit zimcos.co.uk, contact us, receive our marketing or apply to work with us.
1. Who is responsible for your information?
ZimCos Security Ltd is the controller of the personal information described in this notice. We are based in Watford, WD24 4ET, United Kingdom. For privacy questions or requests, email protect@zimcos.co.uk or call 0204 577 0205. Please use “Privacy request” as your email subject.
2. Information we collect
- Enquiries and service requests: your name, email address, telephone number, business or site details, service requirements, messages and related correspondence.
- Recruitment: contact and address details, work history, qualifications, references, identity and eligibility documents supplied during application and screening.
- Criminal-record checks: information from applicant declarations and Disclosure and Barring Service (DBS) certificates used in recruitment vetting.
- Health information: medical conditions affecting an applicant’s ability to perform security duties.
- Technical information: information associated with website requests and security, such as IP address, browser details and access times, and information processed by the cookie and third-party services described below.
- Marketing preferences: contact details used for promotional communications and requests to stop receiving them.
We obtain information directly from you through forms, documents, email, telephone and WhatsApp, and from the references and checks involved in your application. Please provide only information relevant to your request. Do not send medical information or DBS documents through our general enquiry form.
3. Why we use information
- To respond to enquiries, discuss requirements, prepare quotations and arrange security services.
- To assess applications, verify information and conduct recruitment checks.
- To assess whether relevant medical conditions affect security duties and consider suitable working arrangements.
- To operate and protect the website, prevent spam and investigate misuse.
- To communicate about our services by email and WhatsApp and advertise through Google and Meta.
- To manage relevant legal obligations, complaints and disputes.
4. Lawful bases
For enquiries and applications, the relevant basis may be steps taken at your request before entering a contract with you. When communicating with business contacts, our legitimate interests include responding to enquiries and arranging services. Our legitimate interests also include operating a secure website and assessing suitability for security work. These interests must be balanced against your rights.
Where information is needed to meet a specific legal obligation, that obligation provides the relevant basis. Optional analytics and marketing activities requiring consent rely on your choice; contacting us does not by itself constitute consent to promotional messages.
Health and criminal-record information have additional protections. Health processing requires an applicable UK GDPR Article 9 condition; criminal-record processing requires authority under Article 10 and the Data Protection Act 2018. A general legitimate interest in recruitment is not sufficient on its own. The condition depends on the particular check and purpose. Contact us before submitting sensitive records if you need information about the condition applicable to your check.
5. Recruitment and confidentiality
ZimCos handles recruitment and vetting internally. Applicants’ criminal-record and health information is not shared with customers. It is used for the recruitment and suitability purposes described above, rather than advertising.
Required information depends on the role and check. If information necessary to establish eligibility or suitability is not provided, we may be unable to complete the application. Questions about a request for information should be directed to us before sending documents.
6. Marketing and advertising
We use email and WhatsApp for promotional communications and Google and Meta to display adverts. We do not use uploaded customer lists or website remarketing for those adverts.
You can ask us to stop promotional messages at any time by replying to the message or emailing protect@zimcos.co.uk. This does not stop necessary replies to enquiries or communications about an existing service. A minimal record of an opt-out may be retained to avoid contacting you again against your wishes.
Google and Meta operate their own platforms and may process information under their own privacy policies when you view or interact with adverts. See Google’s Privacy Policy and Meta’s Privacy Policy.
7. Storage, service providers and disclosure
Emails and records are stored through our hosting/cPanel setup and handled by ZimCos. Hosting and email infrastructure providers process information to supply those services. The website uses WordPress and WPForms; Google Analytics and Google reCAPTCHA are configured for measurement and form protection. Installing a plugin does not necessarily mean its developer receives your form submissions.
Information may also need to be disclosed where required by law or necessary to deal with a legal claim. This is separate from sharing information with customers.
Third-party services may involve processing outside the UK. Hosting/cPanel is a management system and does not itself establish where data is stored. Provider and transfer arrangements depend on the service used. Please contact us for details of the providers, processing locations and applicable transfer safeguards relevant to your information.
8. Retention
Our retention policy distinguishes ordinary enquiries from employment and vetting records:
- Enquiries that do not become customers: 90 days after the enquiry closes.
- Unsuccessful applications and recruitment decision records: six months after the final decision.
- Detailed vetting material: deletion after checks and recruitment are completed, unless a specific, documented reason requires particular information to be retained. A proportionate record of the checks and outcome may be kept separately.
- Employee right-to-work evidence: throughout employment and for two years after it ends.
- Successful applicants, ongoing customers and other records: retention depends on the continuing relationship, the purpose of the record and relevant employment, accounting or legal requirements. The 90-day enquiry period does not apply to active client records.
Relevant records may need to be retained longer for an active complaint, dispute or legal requirement. Cookie lifetimes are separate from retention of emails, applications and analytics reports. Contact us if you require the retention details applicable to a particular record.
9. Cookies and website services
Our Cookie Policy explains the configured cookie services and how to accept, reject or change optional permissions. The cookie preferences icon lets you revisit your choices.
Google reCAPTCHA processes technical and interaction information for spam protection. Google Analytics supports website measurement. See Google’s Privacy Policy for information about Google’s processing. External websites and third-party content have their own privacy arrangements.
10. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or a portable copy of your personal information. You may object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.
Send requests to protect@zimcos.co.uk. We may need proportionate information to verify your identity. Rights are subject to applicable conditions and exemptions; any relevant restriction will be explained.
11. Complaints
Please contact us if you are concerned about the handling of your information. You can also complain to the Information Commissioner’s Office through ico.org.uk/make-a-complaint/.
12. Scope and updates
This notice covers the website, enquiries, marketing and recruitment. CCTV, visitor records and incident information processed on a client’s site depend on the particular assignment and the relevant controller. Contact us for the privacy information applicable to a specific security operation.
We may update this notice as our practices change. The revision date appears at the top of this page.