Privacy policy

Balmoral Flat Roofing Limited (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This policy explains what we collect when you use this website, contact us or engage us to carry out work, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Balmoral Flat Roofing Limited is a flat roofing contractor registered in England and Wales under company number 07137842, with its registered office and operating base at Unit 3, Raymond Way, Old Mill Lane Industrial Estate, Mansfield Woodhouse, Nottinghamshire NG19 9EN. We are the data controller for the personal information described in this policy.

2. What information we collect

2.1 Information you give us directly

When you complete our enquiry or quotation form, telephone us, email us or engage us to carry out work, we may collect:

• Your name, telephone number, email address and postal address or postcode
• Details of the property and the work you are enquiring about
• Photographs you choose to send us of a roof or related damage
• Records of our correspondence, surveys, quotations, instructions and invoices
• Payment and transaction details relating to work we carry out for you

2.2 Information collected automatically

When you visit this website, our hosting provider and analytics tools record limited technical information:

• IP address (usually stored in truncated or anonymised form)
• Browser type and version, device type and operating system
• Pages viewed, time on page, and the referring website or search term
• Approximate geographic location derived from IP address (town or region level)

This information is aggregated and is not used to identify you personally.

2.3 Information we do not collect

We do not collect or process special category data (for example health, ethnicity or religious beliefs), and we do not knowingly collect information from children under 13. We do not collect card numbers on this website — any card payment is taken over the telephone or through a payment terminal.

3. Why we use your information, and our lawful basis

Purpose	Lawful basis (UK GDPR Article 6)
Responding to your enquiry and providing a quotation	Legitimate interests (Article 6(1)(f)) and, where you proceed, performance of a contract (Article 6(1)(b))
Carrying out surveys, scheduling and completing work	Performance of a contract (Article 6(1)(b))
Invoicing, payment and accounting records	Performance of a contract and legal obligation (Articles 6(1)(b) and 6(1)(c))
Guarantee administration and aftercare	Performance of a contract and legitimate interests
Health and safety, method statements and site records	Legal obligation and legitimate interests
Understanding how our website is used, so we can improve it	Consent (Article 6(1)(a)) — analytics cookies are only set with your agreement
Marketing to previous customers about similar services	Legitimate interests, with an opt-out in every message (PECR soft opt-in)
Preventing and detecting fraud or misuse of our website	Legitimate interests

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and you may object to that processing at any time (see section 8).

4. Cookies and similar technologies

This website is designed to use as few cookies as possible. Those we do use fall into these categories:

Category	Purpose	Consent required
Strictly necessary	Security, form submission integrity and protecting our site from abuse. Without these the site cannot function.	No
Analytics	Aggregated statistics about which pages are viewed and how visitors arrive, so we can improve the site.	Yes

Analytics cookies are only set after you accept them: the first time you visit, a bar at the foot of the page asks whether we may measure how the site is used, and your answer is remembered on your own device. If you decline, no analytics cookie is set and no measurement request is made. We use Google Analytics 4 with advertising features switched off, so your visit is not used to build an advertising profile.

You can change your choice or withdraw consent at any time by clearing cookies for this site in your browser settings, and you can block cookies entirely through your browser preferences — the website will continue to work. Our server logs record requests to protect the site and are retained for a maximum of 12 months.

5. Who we share your information with

We do not sell, rent or trade your personal information. We share it only where necessary, and only with organisations bound to protect it:

• Our website hosting and IT providers — who host this site and its backups on our behalf
• Analytics providers — receiving aggregated, non-identifying usage data
• Scaffolding contractors and specialist trades — where their involvement is required to complete your work, and only the details necessary for them to attend
• Manufacturers and suppliers — where a product guarantee must be registered in your name
• Accountants, insurers and professional advisers — as required to run the business and handle any claim
• Regulators and public authorities — where we are legally required to disclose information, for example to HMRC or in response to a lawful request

Where a supplier processes data on our behalf (for example our web host), we have a written agreement requiring them to protect it and to act only on our instructions.

6. International transfers

Our website hosting and analytics providers may process data outside the United Kingdom. In those cases we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK adequacy regulations where the recipient country is recognised as providing adequate protection. We do not transfer personal data to countries without such safeguards in place.

7. How long we keep your information

Type of record	Retention period
Enquiries that do not lead to work	12 months, then deleted
Quotations and survey records	3 years from the date of quotation
Job records, photographs and completion documentation	Guarantee period plus 3 years, or 10 years for commercial contracts
Invoices and financial records	6 years plus the current financial year, as required by HMRC
Health and safety records, accident reports and method statements	Up to 40 years where required for statutory purposes
Website server and security logs	Maximum 12 months

8. Your rights

Under UK GDPR you have the right to:

1. Be informed about how we use your data — which this policy sets out.
2. Access the personal data we hold about you, and receive a copy.
3. Rectify information that is inaccurate or incomplete.
4. Erase your information where there is no continuing lawful reason for us to hold it.
5. Restrict processing while a question about accuracy or lawfulness is being resolved.
6. Object to processing based on legitimate interests, including direct marketing, at any time.
7. Data portability — receive data you provided to us in a structured, commonly used, machine-readable format.
8. Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
9. Not be subject to solely automated decision-making that produces legal or similarly significant effects. We do not carry out such decision-making.

To exercise any of these rights, telephone 01623 555 550 or write to us at the address above. We will respond within one calendar month, and we will not charge a fee unless a request is manifestly unfounded or excessive.

9. How we protect your information

We take the security of your information seriously and use appropriate technical and organisational measures, including:

• Encrypted HTTPS connections for all traffic to and from this website
• Access controls so that only staff who need your information to do their job can see it
• Password-protected devices, with screen locking and remote-wipe capability on mobiles
• Secure, regularly updated hosting with firewall and intrusion protection
• Encrypted, access-controlled backups
• Staff awareness of data protection and secure handling of customer records

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and inform you directly where the risk is high.

10. Links to other websites

This website links to third-party services such as Google Maps and our review profiles. Once you follow such a link, that organisation's own privacy policy applies, and we are not responsible for how they handle your information. We recommend reading their policies before providing personal data.

11. Complaints

If you are unhappy with how we have handled your information, please contact us first — most concerns can be resolved with a conversation. If you are not satisfied, you have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Changes to this policy

We review this policy regularly and will update it when our practices change or when the law requires it. The date at the top of this page shows when it was last revised. Where a change materially affects how we use your information, we will make this clear on the website.

13. Contact us

For any question about this policy or about the personal data we hold, please contact Balmoral Flat Roofing Limited, Unit 3, Raymond Way, Old Mill Lane Industrial Estate, Mansfield Woodhouse, Nottinghamshire NG19 9EN — telephone 01623 555 550.