This privacy policy sets out how Confederation of Roofing Contractors 2000 Ltd (CORC) uses and protects any information that you give CORC when you use this website.

CORC is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this privacy statement.

CORC may change this policy from time to time by updating this page. You should check this page from time to time to ensure that you are happy with any changes. This policy is effective from June 2026.

 

What we collect

We may collect the following information:

  • name and company name
  • contact information including email address & telephone number
  • demographic information such as postcode, preferences and interests
  • other information relevant to membership

What we do with the information we gather

We require this information to understand your needs in regards to membership and provide you with a better service, and in particular for the following reasons:

  • Internal record keeping
  • We may use the information to improve our products and services
  • We may periodically send e mails about new products, special offers or other information which we think you may find interesting using the email address which you have provided

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

How we use cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Controlling your personal information

Our Data Protection Officer is Gemma Doherty and e mail address is gemma@corc.co.uk.

You may choose to restrict the collection or use of your personal information in the
following ways:

  • if you have signed up for membership using your personal information for direct marketing purposes, you may change your mind at any time by writing to or emailing us at membership@corc.co.uk

We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so. We may use your personal information to send you promotional information about third parties which we think you may find interesting if you tell us that you wish this to happen.

You may request details of personal information which we hold about you under the Data Protection Act 1998. If you would like a copy of the information held on you please write to membership@corc.co.uk.

 

Legal Basis for Processing Personal Data 

Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Depending on the activity, we rely on the following lawful bases:

  • Performance of a contract – where processing is necessary to deliver services or meet contractual obligations, including obligations involving TransUnion.
  • Legal obligation – where processing is required to comply with applicable laws, regulatory requirements, or statutory obligations.
  • Legitimate interests – where processing is necessary for legitimate business purposes such as system security, fraud prevention, risk management, audit, and compliance, and where such interests do not override the rights and freedoms of individuals.
  • Consent – where required by law, and where individuals have been provided with a clear choice and the ability to withdraw consent at any time.

Where legitimate interests are relied upon, appropriate assessments are conducted to ensure that the rights and freedoms of data subjects are protected.

The legitimate interests pursued by the controller (if processing is based on legitimate interests). 

Our legitimate interests include operating our business, fulfilling contractual obligations, ensuring system and data security, preventing fraud, supporting audit and compliance activities, and protecting TransUnion data. These interests are balanced against the rights and freedoms of individuals, with appropriate safeguards in place.

We may collect personal data about you from:

  • you directly
  • employers/clients when you apply for a role or are considered for an opportunity.
  • referees (where relevant and permitted)
  • publicly available sources (for example professional networking sites, business websites, and public records)
  • credit reference agencies (CRAs) where required for consumer credit, identity, or affordability checks.
  • third party service providers used to support recruitment, screening, and compliance processes.

 

International Data Transfers

We do not transfer, store, or process personal data outside of the United Kingdom.

All personal data is handled exclusively within the UK and is not accessed by individuals, employees, or third-party providers located outside of the UK.

As such, no international data transfer safeguards are required.

exclusively within the UK and is not accessed by individuals or third parties located outside of the UK.

We keep personal data only for as long as necessary for its purpose and to meet legal or regulatory obligations. Data used for credit reference or affordability checks is retained only for as long as required and then securely deleted.

  1. The rights of data subjects, including:
  1. Right of access

 b. Right to rectification

 c. Right to erasure (“right to be forgotten”)

 d. Right to restrict processing.

 e. Right to data portability

 f. Right to object

Under UK data protection law, you have the following rights in relation to your personal data:

  • Right of access – You have the right to request a copy of the personal data we hold about you and information about how it is used.
  • Right to rectification – You have the right to request that inaccurate or incomplete personal data is corrected.
  • Right to erasure (“right to be forgotten”) – You have the right to request that we delete your personal data where there is no lawful reason for us to continue processing it.
  • Right to restrict processing – You have the right to request that we limit how we use your personal data in certain circumstances.
  • Right to data portability – You have the right to receive your personal data in a structured, commonly used, and machine readable format, and to request that we transfer it to another organisation where technically feasible, readable format, and to request that we transfer it to another organisation where technically feasible.
  • Right to object – You have the right to object to the processing of your personal data where we rely on legitimate interests or where data is used for direct marketing.

 

You have the right to complain to the UK Information Commissioner’s Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data.

 

Provision of Personal Data 

 

Is the provision of personal data statutory or contractual?

The provision of cerain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations.

Personal data is required to:

  • enter into and perform contracts with customers, suppliers, or business partners.
  • process orders, manage accounts, and deliver goods and services.
  • verify identity and prevent fraud; and
  • comply with applicable legal, regulatory, accounting, and tax obligations.

 

What are the consequences of not providing personal data?

If you choose not to provide the personal data, we request:

  • we may be unable to enter into a contract with you.
  • we may be unable to fulfil orders, supply goods, or provide services.
  • we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and
  • as a result, our services may be delayed, restricted, or declined.

 

Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us.

 

We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.

These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.

The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.

 

If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible, at the above address. We will promptly correct any information found to be incorrect.

Credit Reference and Affordability Checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

  • Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority
    FCA Firm Reference Number: 742313
  • TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority
    FCA Firm Reference Number: 737740

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

 

CONTACT US

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email at membership@corc.co.uk or by mail using the details provided below:

Association House, Brightlingsea, Essex, CO7 0BX, United Kingdom