CRE Group GDPR and Privacy Policy

Last updated: 25th August 2026


Introduction

CRE Group is dedicated to safeguarding the privacy of your personal information. This Privacy Policy outlines how we collect, use, and protect your personal data, ensuring compliance with the General Data Protection Regulation (GDPR). It details the types of personal data we gather, how and when we collect it - including where we obtain it from sources other than you - the purposes for its use, and how long we retain it. When we refer to "we," "us," or "our" in this policy, we mean CRE Group.


1. Our Privacy Commitment

At CRE Group, your privacy is a priority. We are transparent about how we handle your personal data, ensuring that you understand what data we collect, how we use it, and the choices available to you regarding your information.


2. Who This Policy Covers

This policy applies to anyone whose personal data we hold or process, including:

  • Customers and users of our products and services
  • Visitors to our website
  • Job applicants
  • Business contacts and prospective customers - including people at businesses we believe may benefit from our services, whether or not you have contacted us directly

If you are a business contact or prospective customer and we hold data about you that did not come from you directly, Section 5 below, "Information We Obtain From Other Sources," explains where it came from and how to exercise your rights over it.


3. Data Collection: What We Gather

We collect, store, and use the following categories of personal data, which either identifies you or could be used to identify you:

  • Identification Data: This includes your name, business or personal email address, business or personal address, telephone number, employer or organisation name, and social media handles.
  • Professional Information: Such as your job title, work location, department, and position level.
  • Communications Data: Records of correspondence when you contact us, including email and phone conversations.
  • Transactional Data: Details of transactions you have made with us and the fulfillment of those transactions.
  • Technical Data: Information related to your access to our network and premises, such as IP addresses, location data, and usage information, including CCTV images and website interaction data.


4. How We Collect Your Data

We collect personal data directly from you in various ways, including:

  • Website Interactions: When you visit our website, agree to the use of cookies, or use our contact functionality.
  • Communications: When you sign up for email alerts, marketing communications, or other updates.
  • Direct Engagements: When you report issues, provide feedback, respond to surveys, or use our products and services.
  • Automatic Collection: Some usage data may be collected automatically when you browse our website.

These are the ways we collect data directly from you. Where we hold data about you that we did not collect directly, see Section 5 below.


5. Information We Obtain From Other Sources

Some of the personal data we hold does not come from you. Where we market our services to businesses, we obtain business contact information from sources including:

  • Companies House, the public register of UK companies - company details and the names of directors
  • Publicly accessible business websites - named staff, job titles and published contact details
  • Public business directories and property portals - branch names, addresses and telephone numbers
  • Commercially available business contact databases - business contact details obtained from reputable suppliers
  • Public technical records, such as telephone number allocation data published by Ofcom and publicly published domain records

We combine and cross-check these sources to keep the information accurate, and we record where each item came from.

If we hold information about you that we obtained this way, our full notice explaining your rights is here: Privacy Notice for Business Contacts.


6. Why We Use Your Data ("Processing Activities")

Your personal data is used to perform the following activities:

  • Service Fulfilment: To carry out our obligations from any contracts between you and us, including the provision of communication services.
  • Customer Support: To assist you with transactions, provide education and support for our products and services, and manage our relationship with you.
  • Marketing Communications: To send you information about our products and services, and to make recommendations based on your interests, including marketing to business contacts and prospective customers as described in Section 8. You can opt out of these communications at any time.
  • Recruitment: To assess and communicate with you regarding job applications and maintain records of our recruitment processes.
  • Website Improvement: To enhance your experience on our websites by understanding usage patterns and addressing any technical issues.
  • Legal Compliance and Business Administration: To comply with legal obligations, enforce our rights, defend against claims, and manage business transitions.


7. Legal Basis for Processing Your Data

We process your data based on the following legal grounds:

  • Consent: Where necessary, we obtain your consent to collect and use your personal data. You can withdraw consent at any time by contacting us.
  • Legitimate Interests: We process your data to fulfil our legitimate business interests. This includes providing and improving our services, understanding how you interact with our website, and marketing our telecoms, broadband and IT services to businesses we reasonably believe may benefit from them. Where we rely on legitimate interests, we carry out and document an assessment that balances our interest against your rights and interests, and you can request a summary of that assessment at any time (see Section 17).
  • Contractual Necessity: We process your data to fulfil our obligations under any contracts with you.
  • Legal Obligations: We may process your data to comply with regulatory requirements or respond to requests from authorities.


8. Marketing to Businesses

We market our telecoms, broadband and IT services to businesses we believe may benefit from them, using contact details obtained as described in Section 5. Our lawful basis for this marketing is legitimate interests, as set out in Section 7.

Before making marketing calls, we screen our lists against the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS), and we maintain our own do-not-contact list. Every marketing email we send includes a clear way to opt out.

If you tell us you do not want to be contacted, we add you to our do-not-contact list and stop marketing to you. See Section 9 for your right to object to marketing.


9. Your Rights Regarding Your Data

Under GDPR, you have the following rights concerning your personal data:

  • Right to Access: Request copies of the personal data we hold about you.
  • Right to Rectification: Correct any inaccuracies in your personal data.
  • Right to Erasure: Request the deletion of your data under certain conditions.
  • Right to Restrict Processing: Limit the processing of your data in specific situations.
  • Right to Data Portability: Receive your data in a structured, commonly used format.
  • Right to Object: Object to processing of your data that is based on our legitimate interests, in certain circumstances.
  • Right to Withdraw Consent: Revoke your consent at any time if your data is processed based on consent.

To exercise these rights, please contact us at the information provided in Section 17.

Your Right to Object to Direct Marketing

You can tell us to stop marketing to you at any time, and we will stop. This right is absolute - you do not have to give a reason, and we cannot refuse or ask you to justify it.

Email privacy@cregroup.co.uk or call 01903 952733. One message is enough.


10. Data Retention

We keep personal data for no longer than we need it. In practice:

   What How long     Customer records For the life of the contract and 7 years afterwards, to meet legal and accounting requirements   Prospect and business contact records 24 months from the last meaningful contact, reviewed annually   Do-not-contact records Indefinitely - we have to keep these to make sure we do not contact you again   Recruitment records for unsuccessful applicants 12 months   Website analytics and cookie data As set out in our Cookies Notice   At the end of these periods we delete the data or anonymise it so it can no longer identify anyone.


11. Data Security

CRE Group implements stringent security measures to protect your personal data from unauthorised access, loss, or accidental deletion. We use encryption software and limit access to your data to authorised personnel only.


12. Sharing Your Data

We may share your personal data with:

  • CRE Group Entities: Other entities within our company group for the purposes of processing activities.
  • Third-Party Service Providers: Trusted partners who assist us with IT services, marketing, legal advice, and more. These processors are contractually obligated to protect your data.
  • Regulatory Authorities and Legal Entities: Where required by law, we may share your data with regulatory bodies or other legal entities.

We do not sell or rent your personal information to third parties.

Where Your Data Goes

Some of our service providers operate outside the United Kingdom. Where we transfer personal data outside the UK, we rely on a legally recognised transfer mechanism - either UK adequacy regulations, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses - and we satisfy ourselves that the data will receive an equivalent level of protection.


13. Use of Cookies

Our website uses cookies to enhance your user experience. Cookies are small text files stored on your device that help us remember your preferences and improve your website navigation. For more details, please refer to our Cookies Notice.


14. Complaints

If you are unhappy with how we have handled your personal data, tell us at privacy@cregroup.co.uk. We will acknowledge your complaint within 30 days and work to resolve it without undue delay.

You also have the right to complain to the Information Commissioner's Office at any time - ico.org.uk, or 0303 123 1113. You do not have to raise it with us first.


15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on our website and will take effect immediately unless otherwise specified. The date at the top of this policy shows when it was last updated.


16. CRE Group CTI - Privacy Policy

CRE Group CTI is a Chrome extension that connects your 8x8 phone system to Alto CRM. This policy explains what data the extension handles.

What we collect and store:

  • Your name (entered by you, stored locally on your device)
  • Alto API credentials (Client ID, Client Secret, Agency Reference - entered by you, stored locally on your device)
  • Your display preferences (pop timing, auto-start setting - stored locally on your device)

How data is used:

  • Your name is included in call notes written to your Alto CRM account
  • Your Alto credentials are used solely to authenticate with the Alto API to search for contacts and create call notes
  • Phone numbers from incoming/outgoing calls are used temporarily to search Alto for matching contacts. They are not stored.

Where data is sent:

  • Alto CRM API (api.alto.zoopladev.co.uk) - to search contacts and log call notes
  • 8x8 (cloud8.8x8.com) - call events are received from the 8x8 phone system iframe
  • No data is sent anywhere else. No analytics, no tracking, no third parties.

Data storage:

  • All settings are stored locally on your device using Chrome's built-in storage (chrome.storage.local). Nothing is stored on external servers by this extension.

Data sharing:

  • We do not sell, transfer, or share any user data with third parties.
  • We do not use data for advertising, analytics, or creditworthiness purposes.


17. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your personal data, please contact us at:

CRE Group Limited

Unit 17

Lloyds Court

Manor Royal

Crawley

RH10 9QU


General enquiries: sales@cregroup.co.uk
 Privacy enquiries: privacy@cregroup.co.uk
 Number: 01903 952733
 ICO registration number: ZC078436