DTC - Privacy Policy - Dyson Technical Ceramics

IMPORTANT NOTICE: This Privacy Policy explains how Dyson Technical Ceramics Limited collects, uses, discloses, retains and protects personal data relating to its customers, prospective customers, website visitors, suppliers, distributors, business contacts and other individuals. It should be read alongside Dyson Technical Ceramics’ Terms and Conditions of Sale. Please read it carefully.

1. INTERPRETATION
1.1 In this Privacy Policy, unless the context otherwise requires, the following expressions shall have the following meanings:
1.2 “Applicable Laws” means all laws, statutes, regulations and codes of practice applicable to the processing of personal data, including (without limitation) the UK GDPR, the DPA 2018, the PECR and the DUAA, together with any guidance or codes of practice issued by the Information Commission from time to time;
1.3 “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
1.4 “Data Subject” means the identified or identifiable natural person to whom personal data relates;
1.5 “DPA 2018” means the Data Protection Act 2018;
1.6 “DUAA” means the Data (Use and Access) Act 2025;
1.7 “Goods” means the refractory and technical ceramic products manufactured and supplied by DTC, including (without limitation) zirconia ceramics, tin oxide electrodes, alumina refractories, isostatically pressed crucibles, tundish metering nozzles, atomising nozzles, sliding gate plate inserts, zirconia ceramic filters, foundry ladle nozzles, firebricks and related products;
1.8 “Information Commission” means the Information Commission (formerly the Information Commissioner’s Office), the supervisory authority responsible for data protection in the United Kingdom, as established under the DUAA;
1.9 “PECR” means the Privacy and Electronic Communications Regulations 2003 (as amended);
1.10 “Personal Data” means any information relating to an identified or identifiable natural person, as defined in the UK GDPR;
1.11 “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of a Controller;
1.12 “Protected Data” means Personal Data processed by DTC in connection with the manufacture, supply and delivery of its Goods and the operation of its business;
1.13 “Special Category Data” has the meaning given in Article 9 of the UK GDPR;
1.14 “DTC” “we”, “us” or “our” means Dyson Technical Ceramics Limited (company number 08169018), whose registered office is at Unit 12A, Beresford Way, Chesterfield S41 9FG, with manufacturing facilities at West Hunwick Works, Hunwick, Nr. Crook, County Durham DL15 0LB and research and development facilities in Sheffield, United Kingdom; and
1.15 “UK GDPR” means the retained EU law version of the General Data Protection Regulation (EU) 2016/679, as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018.
1.16 In this Privacy Policy, unless the context requires otherwise: (a) references to any act or regulation shall be construed as referring also to any amendment or re-enactment of that act or regulation; (b) the singular includes the plural and vice versa; (c) headings are for convenience only and shall not affect interpretation; and (d) references to “writing” include email.

2. IDENTITY OF THE DATA CONTROLLER
2.1 Dyson Technical Ceramics Limited is the Data Controller in respect of Personal Data collected through its website at www.dysontc.com and through the operation of its business, including the manufacture, sale and supply of Goods, the operation of its global distribution network, and all associated customer, supplier and business contact relationships.
2.2 DTC is a specialist manufacturer of high-performance refractory and technical ceramics, with over 200 years’ experience in the production and innovation of zirconia ceramics (zirconium oxide) and tin oxide ceramics. DTC supplies its Goods to customers on a worldwide scale through a global distribution network of technical representatives, serving industries including steel, glass, foundry, powder metallurgy, investment casting, and aerospace, biomedical and automotive applications.
2.3 DTC has designated a Senior Responsible Individual (SRI) with responsibility for data protection compliance in accordance with the DUAA. Any data protection queries or correspondence should be directed to DTC using the contact details set out in Clause 14 of this Privacy Policy.
2.4 This Privacy Policy should be read alongside DTC’s Terms and Conditions of Sale (available on request or at www.dysontc.com). In the event of conflict between this Privacy Policy and any specific written agreement with a customer or supplier in respect of data processing arrangements, the specific agreement shall prevail.

3. LEGAL FRAMEWORK AND APPLICABLE LEGISLATION
3.1 This Privacy Policy is drafted to comply with DTC’s obligations under the following legislative and regulatory instruments:
3.2 (a) the UK GDPR, as it forms part of retained EU law under the European Union (Withdrawal) Act 2018; (b) the DPA 2018; (c) the PECR; (d) the DUAA; and (e) any other applicable privacy, data protection or electronic communications legislation in force from time to time in the jurisdictions in which DTC operates or to which it supplies Goods.
3.3 The DUAA represents a significant evolution in the UK’s approach to data regulation and introduces provisions that directly bear on how DTC processes Personal Data. The key provisions of the DUAA relevant to DTC’s processing activities are as follows:
3.4 (a) a statutory framework for “recognised legitimate interests”, providing a clearer basis for certain categories of processing without the need for a full balancing test in every case, which DTC will apply where relevant to its processing activities, including in connection with customer relationship management and product quality assurance; (b) the introduction of the Senior Responsible Individual (SRI) role in place of the mandatory Data Protection Officer requirement for certain organisations, with updated accountability obligations; (c) amendments to the cookie consent requirements under the PECR framework, moving towards a more permissive approach for certain low-risk analytics and functionality cookies; (d) a new statutory right for data subjects to complain directly to data controllers about how their personal data is processed, with obligations on controllers to acknowledge complaints within 30 days and respond without undue delay; and (e) the replacement of the Information Commissioner’s Office with the Information Commission as the UK’s data protection supervisory authority.
3.5 DTC monitors the implementation of the DUAA and updates its policies, procedures and technical controls accordingly as relevant provisions come into force.
3.6 Where DTC operates in connection with customers or distributors in other jurisdictions, including through its global distribution network, it additionally takes into account the requirements of the EU GDPR and other locally applicable legislation to the extent relevant to the specific processing activity concerned.

4. PERSONAL DATA DTC COLLECTS
4.1 DTC may collect and process the following categories of Personal Data, depending on the nature of the individual’s relationship with DTC:
4.2 Identity and Contact Data. (a) first name, last name and job title; (b) employer name and, where applicable, the legal entity with which the individual is associated; (c) business postal address, email address and telephone number(s); and (d) any personal contact details voluntarily provided to DTC, including those provided by technical representatives within DTC’s global distribution network.
4.3 Technical and Usage Data. When an individual visits www.dysontc.com, DTC may automatically collect: (a) Internet Protocol (IP) address, browser type and version; (b) pages visited, time and date of visit, and time spent on each page; (c) referring URLs and clickstream data; and (d) device information, including operating system and screen resolution.
4.4 Marketing and Communications Data. This includes preferences in receiving marketing communications, records of attendance at or registration for industry exhibitions and trade events (including METEC, GIFA, THERMPROCESS, ANKIROS and similar events), and records of communications between the individual and DTC.
4.5 Transaction and Commercial Data. Where a customer engages DTC for the supply of Goods, DTC may process data relating to that engagement, including quotation details, purchase order information, billing and payment information, delivery and shipping records, product specifications and technical requirements, quality assurance records, and correspondence relevant to the commercial relationship.
4.6 Supplier and Distributor Data. DTC may process Personal Data relating to individuals employed by or associated with its raw material suppliers, sub-contractors, freight and logistics providers, and members of its global distribution network, including contact details, commercial correspondence and contractual records.
4.7 Special Category Data. DTC does not intentionally collect Special Category Data in the ordinary course of its business activities. If DTC ever needs to process such data in connection with an employment or supplier relationship, it will do so only with an appropriate lawful basis and in compliance with the additional safeguards required by Applicable Laws.

5. HOW DTC COLLECTS PERSONAL DATA
5.1 DTC collects Personal Data through the following means:
5.2 (a) directly from individuals when they contact DTC via its website, submit an enquiry form, request a quotation, place a purchase order, request product literature or technical data sheets, or otherwise engage voluntarily; (b) through use of DTC’s website, via cookies and similar technologies as further described in Clause 11 of this Privacy Policy; (c) from the individual’s employer or associated organisation in the context of a commercial relationship between that organisation and DTC, including where an organisation places purchase orders or requests quotations; (d) from third-party sources, including publicly available professional databases, LinkedIn and other professional networking platforms, industry event organisers and trade exhibition contact lists, in each case where DTC has a legitimate purpose for doing so; (e) from members of DTC’s global distribution network, who may provide contact details and commercial information relating to end-customers and prospective customers in the territories they serve; and (f) through the conduct of DTC’s Research and Development Laboratory (RDL) activities, where customer or third-party technical data is provided in connection with product development, testing or quality assurance.

6. LAWFUL BASIS FOR PROCESSING
6.1 DTC will only process Personal Data where it has a lawful basis for doing so. The lawful bases upon which DTC relies are as follows:
6.2 Contract. Where processing is necessary for the performance of a contract to which the individual or their organisation is a party, or to take steps at their request prior to entering into a contract. This basis applies, for example, to the processing of contact and transactional data in connection with the supply of Goods pursuant to DTC’s Terms and Conditions of Sale.
6.3 Legitimate Interests. Where processing is necessary for the purposes of the legitimate interests pursued by DTC or a third party, except where such interests are overridden by the individual’s fundamental rights and freedoms. DTC relies on this basis for: (a) business development and maintaining relationships with existing and prospective customers, distributors and suppliers; (b) ensuring the security and integrity of its systems, manufacturing processes and data; (c) product quality assurance, including maintaining records necessary for ISO 9001 certification and traceability of Goods supplied to safety-critical industries; (d) sending direct marketing communications to business contacts where there is an existing professional or commercial relationship; and (e) analysing website usage to improve the performance and content of www.dysontc.com.
DTC carries out a legitimate interests assessment (LIA) where it relies on this basis and takes into account the DUAA’s statutory framework for recognised legitimate interests where applicable.
6.4 Legal Obligation. Where processing is necessary for compliance with a legal obligation to which DTC is subject, such as tax and financial reporting obligations, export control regulations applicable to the supply of Goods to certain jurisdictions, health and safety record-keeping, and responding to lawful requests from regulatory authorities.
6.5 Consent. Where the individual has given freely given, specific, informed and unambiguous consent to processing for a particular purpose, such as subscribing to DTC’s product updates or accepting non-essential cookies. The individual has the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7. HOW DTC USES PERSONAL DATA
7.1 DTC uses the Personal Data it collects for the following purposes:
7.2 (a) to respond to enquiries, provide quotations, supply product literature and technical data, and manage its commercial relationship with the individual or their organisation; (b) to perform and manage contracts for the manufacture and supply of Goods, including processing purchase orders, arranging delivery and carriage, invoicing and credit control; (c) to manage and develop its global distribution network, including communicating with distributors and technical representatives regarding product availability, technical specifications and customer requirements; (d) to send marketing communications about DTC’s products, services, industry events and technical developments, where the individual has consented or where DTC has a legitimate interest in doing so; (e) to conduct product quality assurance, testing and traceability, including maintaining records required for ISO 9001 certification and to support customers in safety-critical industries such as steel, aerospace and glass manufacturing; (f) to support the activities of DTC’s Research and Development Laboratory (RDL), including analysing customer application data to develop and improve ceramic formulations and manufacturing processes; (g) to comply with legal and regulatory obligations, including data protection, tax, export control, corporate governance and health and safety requirements; (h) to protect DTC’s legal rights and enforce its Terms and Conditions of Sale; (i) to manage and investigate complaints, disputes or claims relating to the supply of Goods; and (j) to administer DTC’s participation in industry exhibitions and trade events.

8. SHARING AND DISCLOSURE OF PERSONAL DATA
8.1 DTC does not sell Personal Data to third parties. DTC may share Personal Data in the following circumstances:
8.2 Service providers. DTC engages trusted third-party service providers to assist in operating its business. These include, without limitation, cloud hosting and IT infrastructure providers, payment processors, accounting and payroll service providers, email and communications service providers, freight and logistics companies, and professional advisers including legal counsel and accountants. All service providers are required to process Personal Data only on DTC’s documented instructions and to implement appropriate technical and organisational measures.
8.3 Distribution network. In the course of managing its global distribution network, DTC may share Personal Data (principally business contact details and commercial information) with its appointed distributors and technical representatives in relevant territories, for the purposes of fulfilling orders, providing technical support and managing customer relationships in those territories.
8.4 Group companies and affiliates. DTC may share Personal Data with its parent company, subsidiary companies or affiliated entities where necessary for the administration and management of its business, subject to appropriate data sharing arrangements.
8.5 Legal and regulatory disclosure. DTC may disclose Personal Data where required to do so by law, court order or the directions of a competent regulatory authority, including the Information Commission.
8.6 Business transfers. In the event of a merger, acquisition, reorganisation or sale of all or part of DTC’s business assets, Personal Data may be transferred to the relevant successor entity, subject to appropriate confidentiality arrangements.
8.7 Professional advisers. DTC may share Personal Data with its solicitors, accountants, insurers and other professional advisers where necessary for them to provide advice in connection with DTC’s business operations, on a confidential basis.

9. INTERNATIONAL TRANSFERS OF PERSONAL DATA
9.1 DTC supplies Goods to customers worldwide through its global distribution network. In the course of these activities, DTC may transfer Personal Data to countries outside the United Kingdom. Where DTC transfers Personal Data to countries not providing an equivalent level of data protection to that available in the UK, it will ensure that appropriate safeguards are in place, including:
9.2 (a) relying on an adequacy decision made by the UK Secretary of State in respect of the destination country or territory; (b) entering into UK International Data Transfer Agreements (IDTAs) or UK Addenda to EU Standard Contractual Clauses as approved by the Information Commission; or (c) another lawful transfer mechanism available under the UK GDPR, the DPA 2018 and the DUAA, applying the “data protection test” introduced by the DUAA to assess whether the standards of data protection in the destination country will not be materially lower than those available in the UK.
9.3 Individuals may request further information about the specific safeguards applicable to any international transfer of their Personal Data by contacting DTC using the details set out in Clause 14.

10. DATA RETENTION
10.1 DTC retains Personal Data only for as long as is necessary for the purposes for which it was collected, having regard to its legal, regulatory and contractual obligations. The following principles govern DTC’s retention decisions:
10.2 (a) customer and contractual data is retained for the duration of the relevant commercial relationship and for a period of six (6) years thereafter, in accordance with obligations under the Limitation Act 1980 and applicable tax legislation; (b) product quality and traceability records may be retained for longer periods where required by industry standards, ISO 9001 certification requirements, or the specific requirements of safety-critical industries served by DTC (such as aerospace and steel); (c) marketing and communications data is retained until the individual opts out of receiving marketing communications or otherwise requests erasure, subject to any legal obligation to retain records; (d) website analytics data is retained for a period determined by DTC’s analytics platform configuration, which is typically no longer than twenty-six (26) months; and (e) financial and accounting records are retained for a minimum of six (6) years in accordance with HMRC requirements.
10.3 At the end of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with DTC’s internal data disposal procedures.

11. COOKIES AND SIMILAR TECHNOLOGIES
11.1 DTC’s website at www.dysontc.com uses cookies and similar tracking technologies to enhance browsing experience, understand how visitors interact with its content and support its business activities. Cookies are small text files placed on a device when a website is visited.
11.2 DTC uses the following types of cookies:
11.3 (a) strictly necessary cookies, which are essential for the operation of the website and cannot be disabled without impairing core functionality; (b) performance and analytics cookies, which help DTC understand how visitors use the website and identify areas for improvement; (c) functionality cookies, which remember preferences and settings to personalise the individual’s experience; and (d) marketing and targeting cookies, which enable DTC and its marketing partners to show relevant content and measure the effectiveness of campaigns.
11.4 The DUAA introduces amendments to the PECR framework that may, over time, reduce the need for explicit consent in connection with certain low-risk analytics and functionality cookies. DTC will update its cookie practices as and when relevant provisions of the DUAA come into effect. In the meantime, DTC continues to operate its cookie consent mechanism in compliance with current guidance from the Information Commission.
11.5 Cookie preferences may be managed at any time via the cookie settings tool available on DTC’s website, or by adjusting browser settings. Disabling certain cookies may affect the functionality of the website.

12. AUTOMATED DECISION-MAKING
12.1 DTC does not currently use automated decision-making processes that produce legal or similarly significant effects on individuals in the course of its business activities. DTC’s commercial decisions, including the acceptance of purchase orders, the provision of quotations and the assessment of creditworthiness, are made by qualified personnel with appropriate human oversight.
12.2 In the event that DTC introduces any automated decision-making processes in the future, it will ensure that appropriate safeguards are in place in accordance with Article 22 of the UK GDPR and the enhanced provisions introduced by the DUAA, including: (a) transparency to the affected individual about the existence of automated decision-making and the logic involved; (b) the right to obtain human review of any automated decision; (c) the right to contest a decision and to have it reconsidered by a qualified individual; and (d) appropriate technical and organisational measures to minimise the risk of errors and bias in automated processing.

13. RIGHTS OF DATA SUBJECTS
13.1 Individuals have the following rights in relation to the Personal Data DTC holds about them, subject to the conditions and limitations set out in the UK GDPR, the DPA 2018 and the DUAA:
13.2 Right of access. The right to request a copy of the Personal Data DTC holds and to receive information about how it is processed (commonly known as a Subject Access Request or SAR). In accordance with the DUAA, DTC will conduct a reasonable and proportionate search in response to any such request.
13.3 Right to rectification. The right to request that DTC correct any inaccurate or incomplete Personal Data without undue delay.
13.4 Right to erasure. The right to request deletion of Personal Data where: (a) it is no longer necessary for the purposes for which it was collected; (b) consent is withdrawn and there is no other lawful basis for processing; (c) the individual objects to processing and there are no overriding legitimate grounds; or (d) the data has been unlawfully processed.
13.5 Right to restriction of processing. The right to request that DTC restrict the processing of Personal Data in certain circumstances, including where the accuracy of the data is contested or where the individual has objected to processing pending the outcome of a legitimate interests assessment.
13.6 Right to data portability. Where processing is based on consent or the performance of a contract and is carried out by automated means, the right to receive Personal Data in a structured, commonly used and machine-readable format and to transmit it to another controller.
13.7 Right to object. The right to object at any time to the processing of Personal Data where DTC relies on legitimate interests as its lawful basis, including for the purposes of direct marketing. Where an individual objects to direct marketing, DTC will cease such processing immediately.
13.8 Rights in relation to automated decision-making. The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects, except in the circumstances permitted by law and subject to the safeguards described in Clause 12.
13.9 Right to withdraw consent. Where DTC processes Personal Data on the basis of consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
13.10 Right to complain to DTC. In accordance with the DUAA, individuals have the right to complain directly to DTC about how their Personal Data is processed. DTC will acknowledge any such complaint within thirty (30) days and will respond in full without undue delay. Complaints should be directed to DTC using the details set out in Clause 14.
13.11 To exercise any of the above rights, individuals should contact DTC using the details provided in Clause 14. DTC will respond within one (1) calendar month of receipt of a valid request, as required by Applicable Laws, and may extend this period by a further two (2) months in cases of complexity or volume, in which case the individual will be notified accordingly.
13.12 Individuals also have the right to lodge a complaint with the Information Commission if they believe their Personal Data has been processed in a manner inconsistent with their rights or Applicable Laws. The Information Commission can be contacted at www.ico.org.uk or by telephone on 0303 123 1113.

14. HOW TO CONTACT DTC
14.1 Any questions about this Privacy Policy, requests to exercise data protection rights, or concerns or complaints about DTC’s processing of Personal Data should be directed to:
Dyson Technical Ceramics Limited — Data Protection Contact
Unit 12A, Beresford Way, Chesterfield S41 9FG
Email: enq@dysontc.com
Telephone: +44 (0) 3300 887 210
Website: www.dysontc.com

14.2 In accordance with the DUAA, DTC has designated a Senior Responsible Individual (SRI) with responsibility for data protection compliance. All correspondence addressed to the Data Protection Contact will be directed to the SRI for review and response.
14.3 DTC endeavours to address all data protection queries and complaints promptly and constructively. Where an individual remains dissatisfied following DTC’s response, they are entitled to escalate the matter to the Information Commission as described in Clause 13.12.

15. SECURITY OF PERSONAL DATA
15.1 DTC has implemented appropriate technical and organisational security measures to protect Personal Data against accidental loss, unauthorised access, disclosure, alteration or destruction. These measures include:
15.2 (a) access controls and role-based permissions restricting access to Personal Data to authorised personnel only; (b) encryption of data in transit using industry-standard protocols; (c) regular review of information security practices and procedures; (d) staff training on data protection and information security responsibilities; (e) incident response and breach notification procedures in accordance with obligations under the UK GDPR, the DPA 2018 and the DUAA; and (f) contractual obligations on service providers and third parties to implement equivalent security measures.
15.3 In the event of a Personal Data breach that is likely to result in a risk to individuals’ rights and freedoms, DTC will notify the Information Commission without undue delay and, where required, will also notify affected individuals directly.

16. THIRD-PARTY WEBSITES AND LINKS
16.1 DTC’s website may contain links to third-party websites, services or applications that are not operated or controlled by DTC. This Privacy Policy applies only to Personal Data processed by DTC and does not extend to the practices of any third party.
16.2 DTC encourages individuals to review the privacy policies of any third-party websites they visit via links from www.dysontc.com. DTC accepts no responsibility or liability for the content or privacy practices of third-party websites.

17. CHILDREN’S DATA
17.1 DTC’s website and business operations are directed exclusively at business customers, industrial end-users and professional contacts within the refractory ceramics and related industries. DTC does not knowingly collect or process Personal Data relating to individuals under the age of eighteen (18).
17.2 If DTC becomes aware that it has inadvertently collected Personal Data from or about a child, it will take prompt steps to delete such data. Any individual who believes that DTC has collected data relating to a child should contact DTC immediately using the details set out in Clause 14.

18. CHANGES TO THIS PRIVACY POLICY
18.1 DTC reserves the right to amend or update this Privacy Policy at any time to reflect changes in its data processing practices, Applicable Laws (including further provisions of the DUAA as they are brought into force) or guidance issued by the Information Commission.
18.2 The version number and effective date shown at the top of this Privacy Policy indicate when it was last updated. Where changes are material, DTC will take reasonable steps to notify affected individuals, which may include posting a prominent notice on its website or sending an email notification to known contacts.
18.3 DTC encourages individuals to review this Privacy Policy periodically to remain informed about how their Personal Data is protected. Continued use of DTC’s website following notification of any material change constitutes acceptance of the revised Privacy Policy.

19. GOVERNING LAW AND JURISDICTION
19.1 This Privacy Policy and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales.
19.2 The parties irrevocably agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Privacy Policy, save in respect of any individual’s statutory right to bring proceedings before the Information Commission or another competent supervisory authority.