Privacy Policy
Who we are
Formation Global is a trading name of Formationlive Ltd, the data controller for the information described in this policy. We design and build exhibition stands, brand experiences, events and commercial interiors for business clients.
This policy explains how we handle business contact information about the people we work with: clients, prospective clients, suppliers, contractors and their staff. We do not collect personal data from consumers for our own marketing.
Company: Formationlive Ltd, registered in England and Wales, company number 09936592
ICO registration number: ZA427321
Address: Croft Court, Croft Lane, Temple Grafton, Alcester, B49 6PW
Data protection contact: GDPR@formationglobal.com
What we collect
We collect only business information about the people we deal with in a work capacity.
- Business contact details: name, job title, company, work email address, work phone number and business address.
- Correspondence: emails, meeting notes and project communications with clients and suppliers.
- Supplier and contractor records: company details, contacts, contracts, invoices and our due diligence questionnaires.
- On-site crew details: for contractors working on our sites, the name, role, nationality, employer and type of right-to-work document of each worker, so we can meet health, safety and modern slavery obligations.
- Website enquiries: the details you give when you contact us through our website.
We do not ask for personal email addresses or home contact details, and we do not knowingly collect special category data such as health, religion or ethnicity. The exception is an accident on one of our sites, where we may need to record health information about the people involved to meet our health and safety duties.
Where we get it
Most information comes directly from you. We also receive it from your employer, for example when a contractor sends us its crew register or a client names its project team, from event organisers and venues, and from public business sources such as company websites.
How we use it
We use business information only to run our business and meet our legal duties. We do not sell it.
|
Purpose
|
Lawful basis under UK GDPR
|
|---|---|
|
Responding to enquiries and preparing proposals
|
Legitimate interests: dealing with businesses that contact us
|
|
Delivering projects and managing client relationships
|
Contract, or legitimate interests where the contract is with your employer
|
|
Appointing and managing suppliers and contractors
|
Contract, or legitimate interests where the contract is with your employer
|
|
Supplier due diligence and on-site crew checks
|
Legal obligation where the law requires it, such as health and safety, and legitimate interests (confirming contractors’ workers can work lawfully and preventing modern slavery)
|
|
Invoicing, accounts and tax records
|
Legal obligation
|
|
Sending business updates about our services to client and prospect contacts
|
Legitimate interests; you can opt out at any time.
|
|
Protecting our legal rights and handling disputes
|
Legitimate interests
|
Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details of that assessment.
Sharing and international transfers
We share business information only where needed to deliver our work or meet the law:
- Group teams in the UK, Poland, the United Arab Emirates and Saudi Arabia who work on your project.
- Suppliers and contractors delivering part of a project, such as fabricators, logistics providers and venues.
- Service providers who host our email, files and systems, and our professional advisers.
- Event organisers and venues where they require exhibitor or contractor details.
- Authorities where the law requires it.
Every supplier that handles personal data for us is bound by a written contract requiring it to keep that data secure and use it only on our instructions.
Some of this information is transferred outside the UK, mainly to our teams and partners in the UAE and Saudi Arabia, and to venues in the countries where events take place. Where the destination is not covered by a UK adequacy decision, we protect the transfer with the ICO’s International Data Transfer Agreement or Addendum, or rely on an exception the law allows, such as where the transfer is needed to perform a contract. Contact us for details of the safeguards used.
Our Group companies in Poland, the United Arab Emirates and Saudi Arabia may also be responsible for information they collect locally, under the laws that apply there, including the EU GDPR in Poland and the data protection laws of the UAE and Saudi Arabia. You can contact all of them through GDPR@formationglobal.com.
How long we keep it
We keep business information only as long as we need it, then delete or anonymise it.
|
Record
|
Kept for
|
|---|---|
|
Enquiries that do not become work
|
2 years from last contact
|
|
Client and supplier contacts and correspondence
|
6 years from the end of the last project or contract
|
|
Contracts, invoices and accounting records
|
6 years from the end of the financial year they relate to
|
|
Supplier due diligence questionnaires
|
6 years from the end of the supplier relationship
|
|
On-site crew registers
|
2 years from the end of the project, unless needed for an incident or claim
|
|
Records relating to a dispute or claim
|
Until it is resolved, plus 6 years
|
Keeping it secure
We protect information with access controls, secure systems and staff training, and we limit access to the people who need it for their work. If a data breach puts your information at risk, we will tell you and the ICO where the law requires.
Your rights
Business contact details still count as personal data, so you have these rights:
- to access a copy of the information we hold about you
- to correct inaccurate information
- to have information erased
- to restrict how we use it
- to object to our use of it, including for business updates, which we will stop straight away
- to receive information you gave us in a portable format
We do not make decisions about you by automated means alone. To use any of these rights, email GDPR@formationglobal.com. We will reply within one month, or tell you within that month if we need up to two more months because your request is complex.
Cookies
Our website uses cookies. You can manage your choices through the cookie banner on our website or your browser settings.
Complaints
If you are unhappy with how we handle your information, please contact us first at GDPR@formationglobal.com. We will acknowledge your complaint within 30 days and respond as quickly as we can. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
We review this policy regularly and will post any changes on this page, with the date it was last updated. This policy was last updated in October 2026.