Regulatory Engineering & Compliance Services (RECS)

Last updated: 20 October 2026

1. Introduction

Regulatory Engineering & Compliance Services (RECS) respects the privacy, confidentiality and security of the information entrusted to it.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact us, enquire about our services, engage us for regulatory engineering or compliance-related work, or otherwise interact with our business.

We are committed to processing personal information lawfully, fairly and transparently, in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We recognise that regulatory engineering may involve commercially sensitive documentation, proprietary technical information and confidential business relationships. We therefore seek to apply appropriate information-handling practices to both personal data and wider project information.

This Privacy Policy applies to our website at https://www.recs-uk.com and to personal information processed in connection with RECS business activities.

2. Who We Are

Regulatory Engineering & Compliance Services (RECS) is a trading name of JOI ENTERPRISES LIMITED, a company registered in England and Wales under company number 15925637.

JOI ENTERPRISES LIMITED is the data controller responsible for personal information processed in connection with RECS where it determines the purposes and means of that processing.

Information Commissioner’s Office registration: ZB821929.

Website: https://www.recs-uk.com

Privacy enquiries: enquiry@recs-uk.com

Registered ICO address: Basement, 64 Marylands Rd, London, W9 2DR, United Kingdom, subject to any subsequently published address update.

Where RECS processes personal information solely on behalf of a client under that client’s instructions, JOI ENTERPRISES LIMITED may instead act as a data processor. The respective responsibilities will be established where appropriate through contractual arrangements.

3. Personal Information We May Collect

Depending on your relationship with RECS, we may collect and process:

Contact and identification information

Your name, professional role, organisation, business address, email address, telephone number and other contact details you provide.

Enquiry and communication information

Information submitted through our website contact form, email, telephone, WhatsApp Business or other communication channels, including the content of enquiries and subsequent correspondence.

Project and professional information

Information relating to your business, products, projects, regulatory requirements, technical responsibilities, project stakeholders and professional activities.

This may include names, job titles, professional contact details, correspondence, approvals, decisions and other information identifying individuals involved in an engagement.

Technical and commercial documentation

Documents supplied in connection with regulatory engineering activities, such as product specifications, label artwork, ingredients information, manufacturing records, supporting evidence, assessment reports and other technical materials.

Much of this information may concern businesses or products rather than identifiable individuals. Where such documents contain personal information, that information will be handled in accordance with applicable data protection requirements.

Contractual and financial information

Information required to prepare proposals, administer engagements, issue invoices, maintain accounting records and process business transactions.

Website and technical information

Information such as IP addresses, browser and device characteristics, pages visited, approximate geographic information derived from technical data, and relevant website interaction or security records, to the extent collected through our website and its configured services.

We do not ordinarily require special category personal data, such as medical information, religious beliefs or biometric information, to provide our services. We ask that you do not submit such information unless it is genuinely necessary and appropriate arrangements have been agreed.

4. How We Collect Information

We may obtain personal information:

• Directly from you through enquiries, forms, correspondence, meetings and business communications.
• From clients, manufacturers, producers, importers, distributors, assessors, laboratories or other parties legitimately involved in an engagement.
• From documents, records and evidence provided for a defined project.
• From publicly accessible professional or business sources where relevant to a legitimate business purpose.
• Automatically through website functionality, security systems and any cookies or similar technologies used by our website.

Where information is provided by someone other than the individual concerned, we will consider the applicable transparency obligations and any relevant exemptions.

5. Why We Use Personal Information

We process personal information where necessary and appropriate to:

• Respond to enquiries and communicate with prospective clients.
• Assess the nature, suitability and scope of potential engagements.
• Prepare proposals, quotations and contractual arrangements.
• Deliver regulatory engineering, compliance support, technical documentation and associated professional services.
• Coordinate authorised communications with clients, producers, manufacturers, laboratories, specialists and independent assessors.
• Maintain project records, evidence, decisions, version histories and professional correspondence.
• Administer business operations, invoicing, accounting and payment arrangements.
• Manage business relationships and relevant professional communications.
• Operate, maintain, secure and improve our website and business systems.
• Comply with applicable legal, regulatory, tax, accounting and professional obligations.
• Establish, exercise or defend legal claims.
• Protect our business, clients, systems and information from misuse, unauthorised access or other security risks.

We will not use personal information for purposes incompatible with those for which it was collected unless permitted or required by law.

6. Lawful Bases for Processing

Under UK GDPR, we rely on one or more lawful bases according to the circumstances.

Contractual necessity

Where processing is necessary to enter into or perform a contract with an individual.

Legitimate interests

Where processing is necessary for our legitimate business interests or those of another party, provided those interests are not overridden by the individual’s rights and freedoms.

Such interests may include responding to business enquiries, managing professional relationships, delivering services, maintaining appropriate project evidence, protecting information and improving business operations.

Legal obligation

Where processing is necessary to comply with applicable legal requirements, including accounting, taxation and data protection obligations.

Consent

Where consent is required, including for certain electronic marketing activities or non-essential website technologies.

Consent may be withdrawn at any time without affecting the lawfulness of processing undertaken before withdrawal.

Where a client is a company or other organisation, processing the personal information of its employees or representatives will not automatically fall under the contractual necessity basis. An appropriate lawful basis will be identified according to the actual processing activity.

7. Confidentiality and Regulatory Engineering Information

RECS operates in an environment where effective engineering may require access to commercially sensitive, proprietary or otherwise confidential information.

We recognise that access to information does not create unrestricted entitlement to use or disclose it.

Information entrusted to RECS will be handled according to its intended purpose, sensitivity, applicable legal obligations, contractual requirements and legitimate engineering needs.

Our information-handling approach includes the following principles:

Purpose-limited use

Information supplied for an engagement should be used for that engagement and other properly authorised purposes, rather than unrelated activities.

Proportionate protection

Information should receive safeguards appropriate to its nature, sensitivity and the potential consequences of inappropriate access, disclosure, alteration or loss.

Controlled disclosure

Information should be shared only with appropriate recipients where there is a legitimate reason for doing so.

Continuing confidentiality

The completion of an engagement does not automatically remove applicable confidentiality obligations.

Responsible professional learning

RECS may develop its internal methodologies, processes and professional knowledge through legitimate project experience. Such learning must not become an unauthorised secondary use or disclosure of confidential client information or personal data.

Confidentiality obligations may also be established through engagement terms, confidentiality agreements and other applicable contractual arrangements.

8. Independent Assessments and Professional Collaboration

Certain engagements may require specialist input, laboratory testing, independent regulatory assessment or other external professional services.

Where appropriate and authorised, RECS may share relevant project information with independent assessors, laboratories, technical specialists, professional advisers or other parties involved in the engagement.

Information sharing will be limited, as far as reasonably practicable, to what is necessary for the relevant purpose.

Independent assessors may operate under their own professional responsibilities and, depending on the circumstances, may act as separate data controllers.

Where a third party processes personal information on our behalf, we will put appropriate data processing arrangements in place where legally required.

We do not treat the involvement of an independent assessor as permission to disclose information beyond the agreed or otherwise lawful purpose.

9. Third-Party Service Providers

RECS may use trusted third-party providers to support website hosting, email, document storage, business communications, project management, scheduling, payments, accounting, security and other business operations.

Such providers may process personal information to the extent necessary to deliver their services.

Where required, we will use appropriate contractual arrangements, access controls and other safeguards.

Providers may include services used for:

• Website hosting and WordPress website functionality.
• Business email, cloud document storage and collaboration.
• Project and task management.
• Online meetings, scheduling and communications.
• Payment processing and accounting.
• Website security, spam prevention and technical maintenance.

The specific providers used may change as RECS’s operating systems develop. Any material changes affecting the processing of personal information will be reflected in this Privacy Policy where appropriate.

We do not sell personal information.

10. Website Contact Forms and Communications

When you submit an enquiry through our website, we collect the information entered into the form to review your request and respond.

Our contact form may request your name, email address, organisation, project area and a description of your enquiry.

Information submitted through the form may be transmitted to our designated business email system and, depending on the website configuration, retained within the website’s form submission records.

We ask that initial enquiries do not include confidential formulations, sensitive technical documents, unnecessary personal information or commercially restricted material.

Where detailed documentation is required, appropriate arrangements for its exchange can be established during the engagement process.

Communications received by email, WhatsApp Business or other channels may be retained as business records where reasonably necessary.

11. Cookies and Website Technologies

Our website may use cookies and similar technologies to support essential website functionality, security, user preferences and, where implemented, website analytics or other optional services.

Strictly necessary cookies may be used where required for the website to function or remain secure.

Where applicable law requires consent for non-essential cookies or similar technologies, we will seek that consent before deploying them.

Visitors should be able to manage relevant preferences through any cookie consent mechanism provided on the website.

You may also control or delete cookies through your browser settings, although disabling certain cookies may affect website functionality.

Details of specific cookies, their purposes and applicable retention periods may be provided through a separate Cookie Policy or cookie preference interface where required.

12. Marketing and Professional Communications

RECS may communicate with existing clients, prospective clients and professional contacts regarding relevant business matters.

Where we undertake direct electronic marketing, including newsletters or promotional communications, we will comply with applicable UK GDPR and Privacy and Electronic Communications Regulations requirements.

We will obtain consent where required and provide an appropriate means of opting out of direct marketing.

We will not assume that submitting a project enquiry constitutes consent to receive unrelated marketing communications.

You may object to processing for direct marketing purposes at any time.

13. Information Security

We seek to implement technical and organisational measures appropriate to the nature and sensitivity of the information processed.

Depending on the systems and activities involved, measures may include:

• Controlled access to business accounts, documents and project information.
• Appropriate authentication and account security.
• Secure storage and transmission arrangements.
• Access restrictions based on legitimate operational requirements.
• Appropriate software maintenance, updates and security configuration.
• Procedures for handling confidential project information.
• Appropriate safeguards when sharing information with external parties.
• Review and response procedures for suspected information security incidents.

No internet-based service or information system can be guaranteed to be completely secure.

Where a personal data breach occurs, we will assess the circumstances and comply with applicable requirements concerning investigation, mitigation, documentation and notification to the ICO or affected individuals where required.

14. International Data Transfers

Some service providers, professional collaborators or project participants may operate outside the United Kingdom.

Where personal information is transferred internationally, we will assess the applicable legal requirements and use appropriate safeguards where required.

Depending on the destination and circumstances, these may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other legally recognised transfer mechanisms.

We will not assume that using a recognised commercial technology provider automatically removes international transfer obligations.

15. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, regulatory, contractual, evidential and legitimate business requirements.

Retention periods may vary according to the information and the circumstances.

For example:

General enquiries

Information may be retained for a reasonable period to respond, manage subsequent correspondence and maintain an appropriate record of business communications.

Client engagements and project records

Relevant information may be retained for the duration of an engagement and an appropriate period afterwards to support contractual obligations, professional accountability, project traceability, legitimate evidence requirements and potential legal claims.

Financial and accounting records

Records will be retained for periods required by applicable tax, accounting and company law.

Marketing information

Information will be retained while there is an appropriate lawful basis and legitimate purpose, subject to withdrawal of consent, objections and applicable suppression-record requirements.

Website technical and security information

Retention will depend on the specific systems, security requirements and configured retention periods.

We will review retention arrangements and delete, anonymise or securely dispose of information when it is no longer reasonably required, subject to applicable obligations.

Anonymised or appropriately generalised professional learning may be retained where it no longer identifies individuals and does not improperly disclose protected client information.

16. Your Data Protection Rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• Be informed about how your personal information is processed.
• Request access to personal information held about you.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal information in certain circumstances.
• Request restriction of processing in certain circumstances.
• Object to processing based on legitimate interests or to direct marketing.
• Request data portability where applicable.
• Withdraw consent where processing is based on consent.
• Be protected from certain decisions based solely on automated processing, including profiling, where the relevant legal provisions apply.

These rights are not absolute and may be subject to applicable legal restrictions or exemptions.

To exercise your rights, please contact enquiry@recs-uk.com.

We may request reasonable information to verify your identity before responding.

We will respond within the timescales required by applicable data protection law.

17. Automated Decision-Making and Artificial Intelligence

RECS may use digital tools, automation or artificial intelligence-assisted systems to support research, document organisation, drafting, administrative activities or aspects of professional workflows.

Where such tools process personal information, their use must be consistent with applicable data protection obligations, appropriate confidentiality requirements and the purpose for which the information was provided.

We will consider the sensitivity of information and the suitability of the relevant system before using it.

We do not intend to make decisions about individuals that produce legal or similarly significant effects based solely on automated processing without complying with the applicable legal requirements.

The use of an automated or AI-assisted tool does not, by itself, transfer professional responsibility for RECS’s engineering decisions or conclusions to that tool.

18. Publication of Projects, Case Studies and Engineering Observations

RECS may publish educational material, technical insights, engineering observations and case studies through its website or professional communications.

We distinguish between information intended for public recognition or discussion and information entrusted to us through confidential client engagements.

We will not treat possession of client documents, technical specifications, correspondence or assessment materials as automatic permission to publish them.

Where publication involves identifiable individuals, personal information, confidential client material or other protected content, we will establish an appropriate lawful basis and any necessary permissions or authorisations.

Publicly available engineering observations may reference relevant organisations, products, creators and professional sources where appropriate.

Where project experience contributes to general engineering knowledge, we will seek to separate transferable learning from confidential or identifying information that should remain protected.

19. Links to External Websites

Our website may contain links to external websites, professional organisations, regulatory authorities, technical resources or other third-party services.

We are not responsible for the privacy practices of websites or services operated by independent third parties.

We encourage visitors to review the relevant privacy information provided by those organisations.

20. Children’s Personal Information

RECS provides professional services primarily to businesses and professional organisations.

Our website and services are not specifically directed at children, and we do not intentionally seek to collect children’s personal information through ordinary business enquiries.

If we become aware that personal information concerning a child has been collected inappropriately, we will assess the circumstances and take appropriate action.

21. Complaints and the Information Commissioner’s Office

If you have concerns about how we handle your personal information, please contact us in the first instance so that we can investigate and respond.

Email: enquiry@recs-uk.com

You also have the right to complain to the Information Commissioner’s Office (ICO), the United Kingdom’s independent data protection regulator.

Information Commissioner’s Office

Website: https://ico.org.uk

Telephone: 0303 123 1113

Our ICO registration reference is ZB821929.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, business operations, technology providers, legal requirements or information-handling practices.

The latest version will be published on this website with an updated revision date.

Where changes materially affect the processing of personal information, we will take any additional steps required by applicable law.

23. Contact Us

For questions about this Privacy Policy, requests concerning your personal information or concerns about our information-handling practices, please contact:

Regulatory Engineering & Compliance Services (RECS)

A trading name of JOI ENTERPRISES LIMITED

Email: enquiry@recs-uk.com

Website: https://www.recs-uk.com

ICO registration: ZB821929