What is a General Privacy Notice?
This Notice provides information to our customers, suppliers and visitors (“you”) about how their personal data is used.
This means anybody who visits or uses our websites, visits our premises, provides us with unsolicited information (e.g. submitting a query), requests information from us or is a customer or supplier, among others. All references to “we” and “us” refer to any associated companies of Hutchison Port Holdings Limited based in the United Kingdom (each a “Company”, “we” or “us”).
Hutchison Ports UK
Hutchison Ports UK includes the Port of Felixstowe, Harwich International Port and London Thamesport.
More specifically the company names appearing on websites and public facing communications would include:
- The Felixstowe Dock and Railway Company
- Felixstowe Port Container Services Limited
- Hutchison Logistics (UK) Limited
- Harwich International Port Limited
- Thamesport (London) Limited
- Maritime Transport Services Limited
- Hutchison Ports Europe Limited
Each of these companies would be a Data Controller and all of these companies are registered with the Information Commissioner’s Office.
What is personal data?
Personal data is any information about an identifiable living person.
We comply with the General Data Protection Regulation (EU) 2016/679, the UK GDPR (as defined in the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019/419), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Data (Use and Access) Act 2025 and any other applicable laws and regulations that ensure the protection of Personal Data, as the same may be amended from time to time (“Data Protection Laws”).
We will:
process your personal data fairly and lawfully;
- tell you how we will use your personal data;
- only collect personal data about you when we need it for legitimate purposes or legal reasons;
- ensure that your personal data is adequate, relevant and not excessive for the purposes for which we collect it;
- not keep your personal data for longer than we need to for those lawful purposes;
- keep your personal data secure;
- ensure we have robust controls in place to prevent unauthorised access to and use of your personal data;
- ensure that you know how to exercise your rights in relation to your personal data; and
- require any third parties we may share your personal data with to take appropriate steps to protect it.
What types of personal data do we collect, store and use?
The personal data we collect will include, but not be limited to:
| Personal information | Full name, date and place of birth, sex, signature, usernames, photo, citizenship/nationality, passport or visa/ID data, interests and personal preferences, bank account details. |
| Contact information | Home address, home telephone, personal mobile, personal email, business email address, business phone number, language and communication preferences. |
| Information about your working arrangements | Work location, business title, contact details, conflicts of interest information. |
| Data collected whilst on premises | CCTV footage (including but not limited to fixed CCTV cameras, dashcams on vehicles, in cab cameras, body worn cameras)(covert monitoring would only be used in exceptional circumstances and authorised on a case by case basis), photographs taken at events, date and location of visits, internet, email and telephone usage data, network logs, IDACS card logging information (entry and exit from buildings), drivers’ licence information, car registration number. |
| Website information | Internet Protocol address, login information, browser type and version, operating system and platform, time zone setting and location, and other technology on the devices you use to access our websites. |
| Other data collected | Emails, letters and recordings of calls. |
This is described as “Personal Data”.
Special Category and Criminal Offence Data
Special Category and Criminal Offence Data refer to categories of personal data that are subject to additional controls over collection and processing.
Special Category and Criminal Offence Data we collect will include, but not be limited to:
| Health and medical data | Details recorded by Occupational Health or Emergency Response personnel following an accident or medical incident on Company premises. |
| Disability data | Information on disability for the purposes of implementing reasonable adjustments in our premises (e.g. to accommodate a visitor) and for the purposes of assessing diversity and inclusion. |
| Religious affiliations | Where voluntarily provided to the Company for the purposes of assessing diversity and inclusion. |
| Gender, race or ethnicity data | Where voluntarily provided to the Company for the purposes of assessing diversity and inclusion. |
| Biometric data | Fingerprints as part of the IDACS security system (data stored on cards not on Company systems). |
| Criminal record data | As a result of criminal record background checks or additional vetting, and confirmation of no disqualifying criminal convictions. |
This is described as “Special Personal Data”.
How do we collect personal data about you?
You provide some information directly to the Company and other data is collected whilst you visit our premises, our websites or engage with our customer services.
Some data (disability, religious, gender, race, ethnicity, sexual orientation) will be collected on a voluntary basis. Disability data will also be collected if you share it with the aim of the Company making reasonable adjustments.
Criminal record data may result from background checks when you visit our premises or as a result of vetting. There are also security requirements that all visitors to a port (including you) must make declarations in respect of certain disqualifying criminal convictions.
What does the Company do with the collected personal data?
The Company uses Personal Data and Special Personal Data for various purposes, broadly as follows:
| Personal information | To contact you and to comply with laws, regulations and guidance, to keep an up-to-date record of the Company’s interactions and communications with you. |
| Contact information | To provide you with information and services that you request, to provide you with information about other services in the Hutchison Port group or the CK Hutchison group offers that are similar to those that you have already purchased or enquired about. |
| Information about your current working arrangements | To provide you with industry insights, upcoming event information, information about services or our business that may interest you. |
| Data collected whilst on premises | To record visitor logs and screening to maintain security, and for health and safety purposes. |
| Website information | To administer our websites and for internal operations (data analysis, testing, research, statistical and survey purposes). |
| Other data collected | To assist in communicating with you, and for quality assurance and safety purposes |
| Disability data | To support implementing reasonable adjustments in our premises, and for the purposes of assessing diversity and inclusion. |
| Religious affiliations | To monitor diversity. |
| Gender, race or ethnicity data | To monitor diversity. |
| Biometric data | To support safety and security. |
| Criminal record data | To respond to statutory reporting requirements and support safety and security. |
In all instances information would be used in compliance with Data Protection Laws.
This includes the fact that data would only be accessed by individuals who require it to carry out their role (e.g. relevant commercial staff reviewing records, police and safety staff reviewing CCTV of accidents or incidents).
What is the Company’s lawful bases for processing your personal data?
The Company principally relies on legitimate interests when processing your data.
This means that the Company uses information:
- in the way you would reasonably expect;
- in ways that have a minimal impact on your privacy; and
- where there is a compelling justification for doing so.
In considering the processing of data the Company considers both commercial interests and individual interests.
The Company will:
- ensure that the use of personal information is necessary for the purposes identified;
- ensure the interests of the Company are balanced against your interests (so information is not used for reasons you would not expect it to be and will not cause unjustified harm).
Your Personal Data is used to:
- manage the operations of the Company;
- comply with legal obligations;
- ensure the safety and security of the operations of the Company;
- meet the legitimate interests of a third party;
- to exercise and defend legal claims; and
- comply with any contractual terms.
Additional bases, usually explicit consent, will often be required when processing your Special Personal Data. In some instances, the Company will rely on contract, legal obligation or vital interests.
Your Special Personal Data is used to:
- manage the operations of the Company;
- comply with legal obligations;
- ensure the safety and security of the operations of the Company;
- to exercise and defend legal claims; and
- protect someone’s life.
Can the Company use your data to monitor you?
In managing its operations, the Company will monitor the use of its IT and phone systems, and CCTV images. Therefore, you may be recorded on a phone call or by CCTV when you visit our premises or call our customer service line and these recordings may be monitored for safety and security purposes. Monitoring will be carried out for legitimate purposes, including, where appropriate, as permitted by the law, including quality assurance checking, staff training and to prevent and detect crime.
Can the Company use automated decision making?
Automated decision making is when an electronic system uses personal information to make a decision without human intervention. Unless the Company has a lawful basis and has made you aware of it you will not be subject to automated decision making that has a significant impact on you. In any event you will be notified in advance of any automated decision-making and have the option to contact the Company to request human intervention if preferred.
What security measures does the Company have in place to protect your personal data?
The Company has in place appropriate physical (e.g. locks), technological (e.g. passwords and two factor authentication) and organisational security measures (e.g. limiting who has access) to protect your personal data against unauthorised access, disclosure, copying, use or modification as well as loss, theft and destruction.
Additional steps are taken to secure Special Personal Data as appropriate.
Who can the Company share your personal data with?
The Company may transfer your personal data as follows:
- within the Company’s group of companies for business management, auditing and reporting process;
- for necessary communications with third parties in respect of operations or legal compliance;
- when requested by regulators, authorities or courts and other public bodies;
- as part of safety and security monitoring and management; and
- to data processors, to carry out processing on behalf of and as directed by the Company.
Where data is transferred the Company has in place agreements to always ensure that the data is managed, processed and held in compliance with all Data Protection Laws. This includes additional agreements where the data is transferred outside of the UK.
What rights do you have?
In relation to your personal data you have a number of rights:
- the right to access personal data held about you (e.g. to submit a Subject Access Request);
- the right to be informed (this Notice informs you about the collection and use of your data);
- the rights to have your data rectified, erased or restricted;
- the right to object;
- the right to portability of your data; and
- the right not to be subject to a decision based solely on automated processing.
Some rights only arise in certain circumstances.
Some rights are subject to legal limitations or exemptions, especially where it would impact the privacy interests of other individuals or if any requests are excessive or unfounded.
Cookies
The Company websites use cookies to distinguish you from other users of the website. This helps the Company to provide you with a good experience when you browse the website and also allows the Company to improve its websites. For detailed information on the cookies the Company uses and the purposes for which it uses them, please see our Cookie Policy on the Company website. You may reject cookies, although this may affect your ability to use certain parts of the website.
How long will the Company keep your personal data?
The Company has a policy not to keep personal information for longer than necessary or as required by law or regulations.
Who do you contact if you have a question about this Notice?
If you have any questions about this Notice or your personal data in general, please contact the Data Protection Ambassador:
- email: [email protected]
- in writing: Data Protection Ambassador, Tomline House, The Dock, Felixstowe, Suffolk, IP11 3SY
Who do you contact if you have a complaint?
If you have a complaint about how the Company is dealing with your personal data, please contact the Data Protection Ambassador, contact details above.
We will acknowledge your complaint within 30 days of receiving it and take appropriate steps to respond without undue delay, keeping you informed about the progress of your complaint.
If necessary, a complaint may be considered by a senior manager of the Company not related to the complaint.
If you remain unhappy after your complaint has been considered you can contact the Information Commissioner’s Office: Make a complaint about data protection and personal information | ICO.
Changes to this Privacy Notice
This Privacy Notice will be updated from time to time, especially when there are changes to legislation or the Company’s processes.
This Privacy Notice was last updated on 21 July 2026.
