PRIVACY NOTICE

Last updated: 28 July 2026

1. About this privacy notice

This privacy notice explains how Turnbull Kyle Ltd collects, uses, stores and shares personal information.

It applies to clients, prospective clients, property owners and occupiers, clients’ representatives, professional consultants, contractors, suppliers, website visitors and other people with whom we have business dealings.

Turnbull Kyle Ltd is the data controller responsible for the personal information described in this notice.

Turnbull Kyle Ltd
Company number: SC247021
Registered office: 47–49 The Square, Kelso, Roxburghshire, TD5 7HW
Correspondence address: 10 Oliver Place, Hawick, Scottish Borders, TD9 9BG

Telephone: 01450 371177
Email: info @ turnbullkyle . com

References in this notice to “we”, “us” and “our” mean Turnbull Kyle Ltd.

We process personal information in accordance with applicable UK data-protection legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003, in each case as amended.

2. Personal information we collect

Depending on our relationship with you, we may collect and process the following information:

• your name, postal address, email address and telephone number;
• the name of your employer, business or organisation and your position within it;
• details of a property, site or project with which you are connected;
• information contained in quotation requests, appointment documents and instructions;
• correspondence, emails, telephone notes, meeting notes and records of our interactions with you;
• information provided by your architect, agent, contractor, solicitor or other representative;
• technical information, drawings, specifications, reports, photographs, site records and project documents that may contain personal information;
• financial and transaction information, including invoices, payment records and account details;
• client, project, quotation, invoice or other reference numbers allocated by us;
• information relating to complaints, disputes, insurance matters or legal claims;
• information required to satisfy legal, regulatory, professional or insurance obligations;
• information submitted through our website contact form; and
• limited technical information about your use of our website, including cookie, device, browser and internet-protocol information where applicable.

We do not normally require special-category personal information, such as health information. Where such information is provided to us, we will only use it where it is relevant and lawful to do so.

3. How we obtain personal information

We may obtain personal information:

• directly from you;
• from a quotation request, appointment document or acceptance form;
• through correspondence, emails, telephone calls or meetings;
• through our website contact form;
• from an architect, agent, contractor, developer, solicitor, property manager or other representative;
• from other members of a project design or construction team;
• from local authorities, building standards departments, public bodies and regulatory organisations;
• from Structural Engineers Registration Ltd;
• from publicly available sources, including planning portals, property records, company registers and professional directories;
• from insurers, legal advisers, debt-recovery agents and other professional advisers; and
• from website, email, information-technology and communications service providers.

Where someone provides personal information to us about another person, we expect them to have authority to do so and, where appropriate, to bring this privacy notice to that person’s attention.

4. How and why we use personal information

We use personal information for the following purposes.

Providing quotations and taking steps before entering into a contract

We use your information to:

• review enquiries and project information;
• assess whether we can provide the requested services;
• prepare fee proposals and quotations;
• communicate with you and your representatives; and
• agree the scope and terms of our appointment.

Our lawful basis is that the processing is necessary to take steps at your request before entering into a contract, or that it is necessary for our legitimate interests in managing and developing our business.

Providing engineering and related professional services

We use your information to:

• provide structural and civil engineering advice, inspections, designs, drawings, calculations, reports and certification services;
• manage projects and appointments;
• communicate with clients, agents, consultants, contractors and relevant authorities;
• arrange and record inspections and meetings;
• maintain appropriate project and quality-management records; and
• manage changes to project instructions and scope.

Our lawful basis is that the processing is necessary to perform our contract with you or is necessary for our legitimate interests in providing, administering and documenting our professional services.

Certification and regulatory requirements

Where applicable, we use and disclose information to:

• register projects with Structural Engineers Registration Ltd;
• provide certification under the Scottish building standards system;
• liaise with local authority building standards departments;
• respond to regulatory or professional requirements; and
• demonstrate compliance with applicable engineering and building standards.

Our lawful basis is compliance with our legal obligations and our legitimate interests in meeting our professional, regulatory and contractual responsibilities.

Financial and business administration

We use personal information to:

• issue quotations, invoices, statements and payment reminders;
• receive and record payments;
• maintain accounting and tax records;
• manage suppliers and subcontractors;
• recover unpaid sums; and
• administer our business.

Our lawful basis is performance of a contract, compliance with legal obligations and our legitimate interests in operating and protecting our business.

Professional, insurance and legal matters

We may use personal information to:

• maintain records required by our professional-indemnity insurers;
• notify or manage circumstances, complaints and claims;
• obtain legal or professional advice;
• establish, exercise or defend legal rights;
• prevent and investigate fraud, misuse or unlawful activity; and
• respond to lawful requests from courts, regulators or public authorities.

Our lawful basis is compliance with legal obligations and our legitimate interests in protecting our clients, staff, professional position and business.

Communications and service information

We use contact details to respond to enquiries and provide information relating to our services or an existing project.

We will only send direct marketing communications where permitted by law. You may ask us to stop sending marketing communications at any time.

Our lawful basis may be consent or our legitimate interests in maintaining appropriate business relationships, depending on the circumstances.

Website operation and security

We may process website and device information to:

• operate and secure our website;
• respond to contact-form submissions;
• remember privacy and cookie preferences;
• prevent misuse and investigate technical problems;
• understand how our website is used; and
• provide optional website functionality, including third-party translation services where you have agreed to their use.

Our lawful basis is our legitimate interests in operating a secure and effective website. Where the law requires consent for a cookie, translation tool or similar technology, we will rely on your consent.

You can change your cookie and privacy preferences through the privacy settings available on our website.

5. Our legitimate interests

Where we rely on legitimate interests, these interests may include:

• providing and improving our professional services;
• managing client, consultant and supplier relationships;
• administering projects efficiently;
• maintaining accurate technical and business records;
• protecting our professional and commercial interests;
• meeting insurer and professional-body requirements;
• securing our systems, communications and premises;
• recovering sums properly due to us; and
• establishing, exercising or defending legal rights.

We consider and balance these interests against your rights and reasonable expectations before relying on this lawful basis.

6. When you must provide information

Certain information is required before we can provide a quotation, enter into an appointment, supply professional services, issue certification or comply with legal and regulatory requirements.

Where required information is not provided, we may be unable to provide a quotation or service, complete a certification or continue acting on a project.

7. Who we share personal information with

Where necessary and lawful, we may share personal information with:

• our employees, directors and authorised consultants;
• your architect, agent, contractor, developer or other representative;
• members of the project design and construction team;
• local authority planning and building standards departments;
• Structural Engineers Registration Ltd;
• other regulators, certification bodies and professional organisations;
• accountants, auditors, solicitors, insurers and other professional advisers;
• banks, payment providers and financial organisations;
• debt-recovery agencies;
• document-storage, email, cloud-computing, website, software, backup and information-technology service providers;
• printing, postal and communications providers;
• law-enforcement agencies, courts, regulators and public authorities where disclosure is required or permitted by law; and
• a purchaser, investor or adviser in connection with a proposed sale, restructuring or transfer of all or part of our business.

We only share information that is reasonably necessary for the relevant purpose.

Service providers acting on our behalf are required to process personal information securely, confidentially and in accordance with our instructions and applicable data-protection law.

We do not sell personal information.

8. International transfers

Some of our information-technology, email, website, cloud-storage or software providers may process information outside the United Kingdom.

Where personal information is transferred outside the United Kingdom, we will take reasonable steps to ensure that an appropriate legal safeguard is in place. This may include:

• transferring information to a country covered by UK adequacy regulations;
• using the United Kingdom International Data Transfer Agreement;
• using the United Kingdom Addendum to approved standard contractual clauses; or
• relying on another lawful transfer mechanism.

You may contact us for further information about the safeguards applying to a particular transfer.

9. How long we retain personal information

We only retain personal information for as long as reasonably necessary for the purpose for which it was collected and to meet our legal, contractual, regulatory, professional and insurance obligations.

Our normal retention periods are:

• project and client records: 12 years from completion of our services, termination of our appointment or the last substantive project activity, whichever is later;
• unsuccessful enquiries and quotations: normally up to two years after the last communication;
• accounting and transaction records: normally six years after the end of the relevant financial year, or longer where required by law;
• complaint, dispute and legal-claim records: for as long as reasonably necessary to investigate and conclude the matter and for the applicable legal or insurance period afterwards;
• website contact enquiries: for as long as reasonably necessary to respond to and manage the enquiry; and
• cookie and website information: for the period stated in our website cookie or privacy settings.

We may retain information for longer where:

• a complaint, dispute, investigation or legal claim has arisen or may reasonably arise;
• our professional-indemnity insurer requires a longer period;
• the information relates to a continuing project or obligation; or
• retention is required by law, regulation or a court order.

At the end of the relevant retention period, information will be securely deleted, destroyed or anonymised.

10. How we protect personal information

We use reasonable organisational and technical measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.

These measures may include:

• access controls and password protection;
• appropriate email, device and network security;
• secure backups and document storage;
• limiting access to staff and service providers who require the information;
• confidentiality obligations;
• staff awareness and training;
• secure disposal of paper and electronic records; and
• procedures for managing data-security incidents.

Although we take reasonable precautions, no electronic transmission or storage system can be guaranteed to be completely secure.

11. Your data-protection rights

Depending on the circumstances and the lawful basis on which we use your information, you may have the following rights.

Right of access

You may ask us to confirm whether we hold personal information about you and request a copy of that information.

Right to rectification

You may ask us to correct personal information that is inaccurate or complete information that is incomplete.

Right to erasure

You may ask us to delete personal information in certain circumstances. This right is not absolute and may not apply where we need to retain information to comply with a legal obligation, perform a contract, meet professional or insurance requirements, or establish, exercise or defend legal claims.

Right to restriction

You may ask us to restrict the use of your personal information in certain circumstances, including while we consider a challenge to its accuracy or our lawful basis for using it.

Right to object

You have the right to object at any time to the use of your personal information for direct marketing.

You may also object to processing based on our legitimate interests. We will stop the relevant processing unless we have compelling legitimate grounds to continue or the information is required for legal claims.

Right to data portability

In certain circumstances, you may ask us to provide information that you supplied to us in a structured, commonly used and machine-readable format or to transfer it to another organisation.

This generally applies where processing is automated and is based on your consent or a contract.

Right to withdraw consent

Where we rely on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Automated decision-making

We do not currently use solely automated decision-making or profiling that produces legal or similarly significant effects concerning individuals.

Exercising your rights

To exercise a data-protection right, contact us using the details in section 15.

We may need to request reasonable information to confirm your identity or authority to act for another person. We will not normally charge a fee.

We will respond without undue delay and normally within one month. Where a request is complex or several requests have been made, the response period may be extended as permitted by law. We will tell you if an extension applies.

Some rights are subject to legal exemptions and do not apply in every situation.

12. Data-protection complaints

You have the right to complain to us if you believe that we have not handled your personal information properly or have failed to comply with data-protection law.

You may make a complaint:

• by email to info @ turnbullkyle . com;
• by telephone on 01450 371177; or
• in writing to Turnbull Kyle Ltd, 10 Oliver Place, Hawick, Scottish Borders, TD9 9BG.

Please provide:

• your name and contact details;
• an explanation of your concern;
• relevant dates, project references or correspondence; and
• the outcome you would like us to consider.

We will acknowledge your complaint within 30 days, investigate it appropriately and without undue delay, and inform you of the outcome.

13. Complaining to the Information Commissioner’s Office

We would appreciate the opportunity to resolve your concern directly. However, you also have the right to complain to the Information Commissioner’s Office, which is the United Kingdom’s data-protection regulator.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint

The Information Commissioner’s Office is expected to relocate its head office during autumn 2026. Its current contact details should therefore be checked before this notice is reissued or substantially updated.

14. Links and third-party services

Our website may contain links to third-party websites or use optional third-party services, including translation tools.

Third parties may process information under their own privacy notices. We are not responsible for the content, security or privacy practices of independent third-party websites.

Optional services that store or access information on your device will only be activated where the necessary consent has been provided.

15. Contacting us

Questions, rights requests and data-protection complaints should be sent to:

Data Protection Contact
Turnbull Kyle Ltd
10 Oliver Place
Hawick
Scottish Borders
TD9 9BG

Telephone: 01450 371177
Email: info @ turnbullkyle . com

Turnbull Kyle Ltd has not appointed a statutory Data Protection Officer. Data-protection matters are managed through the contact details above.

16. Changes to this privacy notice

We keep this privacy notice under review and may update it to reflect changes to our services, systems, suppliers or legal obligations.

The current version will be published on our website. Paper copies are available on request.

Where a change would materially affect how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals.

This privacy notice was last updated on 28 July 2026.