Privacy Policy

This Privacy Notice is provided by Cornerstone Telecommunications Infrastructure Limited (“Cornerstone” or “we” or “us”) Cornerstone is, for the purposes of the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act 2018, your Data Controller. This means that we are responsible for, and control the processing of, your personal information. We take your privacy very seriously and we ask that you read this Privacy Notice carefully as it contains important information about:

• Your rights;
• The Personal Data we collect about you and why we collect the data;
• What we do with your data, and;
• Who your information will be shared with.

If you have any questions about this Privacy Notice, the information we hold about you, or wish to exercise any of your rights, please contact us via email at: gdpr@cornerstone.network or write to us at Cornerstone, Building Cornerstone, Hive 2, 1530 Arlington Business Park, Theale, Berkshire, RG7 4SA.

Please familiarise yourself with the following words and phrases as they have a particular meaning in Data Protection Laws and are used throughout this Privacy Notice:

• GDPR: General Data Protection Regulation (EU) 2016/679 including as applied in the UK. This legislation works alongside the Data Protection Act 2018.
• Personal data: Any information which can identify a living individual. This includes telephone numbers, names, addresses, e-mail addresses, photographs, voice recordings. It will also include expressions of opinion and indications of intentions about Data Subjects (and their own expressions of opinion/intentions).
• Special categories of data:  Any information relating to racial or ethnic origin, political opinions, religious beliefs or beliefs of a similar nature, trade union membership, physical or mental health or condition, sexual life; or genetic data or biometric data for the purpose of uniquely identifying you.
• Processing: – This covers how your data will be obtained, recorded, retrieved, held, adapted or altering it, disclosing, disseminating or otherwise making it available; and aligning, blocking, erasing or destroying it.
• Data subject: The person whom the data is about.
• Information Commissioner: The UK Information Commissioner who is responsible for implementing, overseeing and enforcing the Data Protection Laws. Also known as “ICO”.
• Data controller: In this instance Cornerstone who determines the purposes and the manner in which personal data is processed.
• Data processor: The person who processes the data on behalf of the Data Controller.

We process your personal information as part of our relationship with you. We collect and hold your personal information if:

1. You are a current or potential supplier to Cornerstone; or
2. You are a current or potential landlord of Cornerstone’s or of our customers; or
3. You provide your contact details to Cornerstone at a business event;
4. You write to us with an enquiry or a complaint. As part of our processing for these purposes, we share your information with other suppliers who provide services to Cornerstone or our customers. This Notice explains what data we process, why we process, how it is legal and your rights.

If you are an individual supplier or landlord (or a potential supplier or landlord) we collect and hold the following information:

Personal data

• Name or Company Name
• Contact details (address, phone number, email address)
• Bank account details (if we pay you)
• Site address (if you are one of our landlords)
• KPI performance data of suppliers
• Supplier staff contact details (name, email address, phone number)
• Complaint data (name, email)
• Images (photo or recording)

Special categories of data

• If there is a health and safety issue at one of our sites, then we may hold information about you and the incident and that may contain health or medical information.

We use your Personal Data for the following purposes listed in this section:

• Contract and lease/licence management – To manage the contract or lease/licence we have with you and to pay you under the terms of the contract or lease/licence.
• Security – To keep your Personal Data secure and prevent unauthorised access, loss, damage, destruction, or corruption.
• Legal and Regulatory Requirements – To comply with regulations and laws governing Cornerstone or our Customers for example health and safety laws and to exercise our rights under the Electronic Communications Code.
• Name, address and email – To communicate with you if we collected your Personal Data at a business event or to respond to an enquiry or a complaint.
• We are allowed to do so on certain legal bases. Please go to the “How is the Processing Lawful” section in this Privacy Notice below which provides more detail.
• Cornerstone may develop new Technologies i.e. Site Management Tools or Mobile Applications to improve operational efficiency and services. Use of such technologies would be subject to registration opt-ins.

The list below provides details about how long we will retain your Personal Data.

• Name and address of an individual landlord – During the lease or licence and for 6 years after the lease or licence terminates or expires.
• Name and address of an individual supplier – During the contract and for 6 years after the contract terminates or expires.
• Landlord or supplier bank account details – During the contract or lease/licence (as applicable).
• Name, address and email of contacts or individuals who contact us with an enquiry or complaint – During our relationship with you. If you have made a compliant then we will retain your information for 6 years after the complaint has been resolved if we consider that there is a risk of further dispute.

We are allowed to process your Personal Data for the following reasons and on the following legal bases:

Legitimate interest

We have a legitimate interest in processing your data, having considered the impact of processing on your interests and rights, and having ensured appropriate safeguards are in place to minimise any intrusion on your privacy. The legitimate interests for which we process your Personal Data are:

• Exercising our legal and regulatory rights under the legislation. If you are a landlord, we may use your information to exercise our rights under the Electronic Communications Code.
• It is necessary for the performance of your contract/lease or license with Cornerstone.
• Establishing and defending our legal rights.
• Responding to enquiries or complaints that you make.

Cookies

• Our website uses cookies, and your consent is required for cookies to be used on your device. If you have given us your consent to receive our newsletter and related updates, we are allowed to process your Personal Data to ensure the material is delivered to you.

Legal Obligations

It is necessary in order to comply with legal obligations we are under for example health & safety at our sites.

We have up-to-date technical security measures and security policies in place to safeguard your Personal Data.

We aim to keep your information safe from external threats such as hackers and malicious software, for example, we use secure connections on our internal systems, to ensure data residing on it is encrypted. This means that we convert your data into a computer code, which will make it harder for hackers to access your data when stored on our internal systems. Whilst we will use all reasonable efforts to safeguard your Personal Data, we cannot guarantee the security or integrity of any Personal Data that are transferred from you or to you via the internet.

If you have any concerns about your information, please contact us (see ‘How you can contact us?’ above).

We may disclose your Personal Data to third parties who provide certain services for us, including:

• Personal Data
• Landlord name, address and bank details
• Supplier name, address and bank details

Who information is shared with:

• Our Estates management provider, and our IT service provider.
• 3^rd Party Customers, who share and have presence on Cornerstone sites.
• Design and Build Suppliers and Maintenance through our internal Site Management Tools.

We may need to transfer your Personal Data to the United States to our IT service provider (but only for the purpose of services that we receive from them. Any transfer of your data will be carried out in accordance with the law to safeguard your privacy rights and give you remedies in the unlikely event of a security breach.

As a Data Subject, you have the following rights under the Data Protection Laws:

• The right of access to Personal Data relating to you;
• The right to correct any mistakes in your information;
• The right to restrict or prevent your Personal Data from being processed in some circumstances;
• The right to have your Personal Data ported to another Data Controller;
• The right to the erasure of your Personal Data; and
• The right to withdraw consent to receive our newsletter.
• The right to lodge a complaint with the Information Commissioners Office (“ICO”)

These rights are explained in more detail below, but if you have any comments, concerns or complaints about our use of your Personal Data, please contact us using the contact details located in the “How to Contact us” section above, on page 1 of the document. We will respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex, in which case we will respond within three months. There are exemptions to many of these rights which we will apply in accordance with the law.

You may ask to see what Personal Data we hold about you and be provided with:

• A copy;
• Details of the purpose for which it is being or is to be processed;
• Details of the recipients to whom it is or may be disclosed, including if they are overseas and what protections are used for those oversea transfers;
• The period for which it is held (or the criteria we use to determine how long it is held);
• Any information available about the source of that data; and
• Requests for your Personal Data must be made in writing.

To assist with this request, we require as much information as possible about the type of information you would like to see.

There are certain types of data which we are not obliged to disclose to you, which include Personal Data which records our intentions in relation to any negotiations with you where disclosure would be likely to prejudice those negotiations.

If to comply with your request, we would have to disclose information relating to or identifying another person, we may need to withhold that information or edit the data to remove the identity of that person if possible.

Right to correct any mistakes in your information

You can require us to correct any mistakes in your information which we hold, free of charge. If you would like to do this, please:

• Email or write to us (see ‘How to contact us?’ above);
• Let us have enough information to identify you (e.g. name or email address); and
• Let us know the information that is incorrect and what it should be replaced with.

Right to prevent the processing of Personal Data

You may request that we stop processing your Personal Data temporarily if:

• You do not think that your data is accurate. We will start processing again once we have checked whether or not it is accurate;

or

• You have objected to processing because you believe that your interests should override Cornerstone’s legitimate interests.

Right to erasure

You can ask us to erase your Personal Data where:

• You do not believe that we need your data in order to process it for the purposes set out in this Privacy Notice;
• You object to our processing and we do not have any legitimate interests that mean we can continue to process your data; or
• Your data has been processed unlawfully or has not been erased when it should have been.

Copies of your Personal Data (Data portability)

You may ask for a copy of your Personal Data which we hold electronically and which we process when we have entered into a contract with you. You can also ask us to provide this directly to another party.

In the instance, please ‘Contact Us’ directly to express your concerns.

If you do not think that we have processed your data in accordance with this Privacy Notice, you should let us know as soon as possible. As part of your request, you will need to provide valid identification to help us verify your identity. Similarly, you may complain to the Information Commissioner’s Office. Information about how to do this is available on the website at www.ico.org.uk.

Changes to the Privacy Notice.

We might change this Privacy Notice from time to time, and if we do and we have your email address we will provide you with notice by email of any forthcoming changes that have an impact on you as an individual.

This notice was last updated March 2024.