Privacy Notice

Essex Roofing and Repairs Ltd (trading as Essex Roofing & Repairs) is the data controller for the personal information described in this notice. Company number 17514525, registered in England and Wales. Registered office: The Meadows, Ellesmere Road, Rochford, SS4 3JP. This address is for official correspondence only, not a customer-facing location. Customers do not visit the registered office; our roofers travel to customers' properties.

Website: essexroofingandrepairs.co.uk.

Privacy questions: tyler@essexroofingandrepairs.co.uk or 07426 030437.

When you submit our quotation form, we collect:

• your name;
• your phone number;
• your property postcode;
• the description of your roofing issue, and anything else you choose to include in it.

Please do not include sensitive personal information in the description. If you contact us directly by phone, message or email, we may also hold the information you choose to share in that conversation. All four form fields are required so we can assess and respond to your request; if you do not provide them, the form cannot send your enquiry. You can contact us directly instead.

Website services also receive ordinary technical information, such as your IP address, browser details and requested web addresses, when delivering and protecting the site. This is separate from the details you enter in the quotation form.

• To respond to your enquiry, discuss your roofing requirements, arrange a property inspection and prepare a quotation — taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)). The same basis applies to communications necessary to carry out roofing work you have agreed with us.
• For reasonable enquiry management, relevant follow-up, business administration and handling questions or disputes where contractual necessity does not apply — our legitimate interests in managing roofing enquiries and customer relationships (Article 6(1)(f)), balanced against your rights and expectations. You can object to processing based on legitimate interests.
• To meet legal, tax and accounting obligations if you become a customer (Article 6(1)(c)).

We do not currently use quotation-form information for promotional email or SMS marketing. Necessary quotation processing does not depend on a marketing consent checkbox. The quotation process does not involve automated decision-making or profiling with legal or similarly significant effects.

Your request is validated by the website and sent through Lovable's email service to tyler@essexroofingandrepairs.co.uk. The enquiry email is received and stored in our Google Workspace business mailbox. Tyler may telephone or message you to discuss the enquiry, arrange an inspection or provide a quotation.

Tyler may save your name and telephone number in his mobile phone contacts to manage follow-up communication. Contacts may be synchronised or backed up through the device's configured services, where enabled on that device. Contact us if you would like to know whether this applies to your details.

We do not currently maintain a separate CRM, quotation-management database or spreadsheet for these enquiries. The website processes form details temporarily to validate the request and prepare the email; it does not save them to an application enquiry database. Hosting and email services may separately retain operational, security, error and email-delivery records. These are not the same as our business mailbox, and their retention is governed by the providers' services and applicable terms.

Providers involved in delivering or handling quotation requests:

• Lovable — website hosting, enquiry processing and sending the enquiry email. Its email service processes the form content and maintains delivery-related records.
• Cloudflare — hosting-related infrastructure, request delivery and security. It handles connection and request information as part of delivering the site and quotation submissions.
• Google Workspace (Google) — stores enquiry emails and provides business email communication.

Ordinary website visits also involve:

• Google Fonts — the site requests typefaces from Google. These requests share technical information such as your IP address, browser information and the requested font address, not the quotation fields. Google's Google Fonts privacy information explains this processing.

Some of these providers may process data outside the UK, including in the United States. Where they do, UK data protection law requires an applicable transfer mechanism. Provider documentation describes mechanisms such as adequacy decisions (including the UK–US data bridge for eligible certified organisations) and standard contractual clauses with the UK transfer addendum, as applicable. This does not mean that all information stays in the UK or that every mechanism applies to every service.

Details are available in the providers' published terms: Lovable's data processing agreement, Cloudflare's data processing addendum and Google Workspace's data processing terms. Which terms apply depends on each provider's arrangements with us. Contact us for information about the safeguards that apply to your information.

We apply the following retention practices to enquiry and customer records:

• Unsuccessful or inactive quotation enquiries: up to 12 months after the last relevant customer communication, unless a longer period is justified, for example by a dispute or legal requirement.
• Completed roofing jobs: necessary contractual, financial and business records for the applicable legal, accounting and contractual periods, and no longer than needed.
• Mobile phone contacts: kept only while needed for the enquiry or work, applying the relevant enquiry or customer-record period, including any synchronised or backed-up copies where applicable.

Statutory periods take priority. Corporation Tax records generally need to be retained for six years from the end of the company financial year they relate to, rather than simply six years after a job. Longer retention may be required for records of transactions spanning accounting periods, assets expected to last more than six years, late tax returns or an ongoing HMRC compliance check. A legal claim or contractual requirement may also justify keeping relevant records longer. See the government guidance on company and accounting records.

We review customer records held in our Google Workspace mailbox and mobile contacts every three months and securely delete information that is no longer required, covering the business mailbox and mobile contacts. Where a device or account backup is enabled, deleted details may remain in that backup until it is overwritten or expires under the relevant service's retention arrangements. Records held by our service providers follow their own deletion terms.

Customer information is intended for the business representative handling your enquiry and those who need it to manage the work, alongside the service providers described above. It should not be available to people without a legitimate business need.

Our policy requires mobile devices and business email accounts handling customer information to be protected using appropriate device locks, account authentication, access restrictions and security updates, and customer details to be handled and deleted carefully. Contact details saved on a mobile device are used only to manage customer enquiries and legitimate business communications, not for unsolicited marketing. No online service or device can guarantee absolute security.

The current website does not include Google Analytics, advertising trackers or other non-essential analytics scripts. Cloudflare's __cf_bm cookie, which lasts up to 30 minutes, helps distinguish ordinary visits from automated traffic and protect the service; this security technology is not used by us for marketing. Our hosting provider may also set technical cookies as part of delivering the website. We do not use them for tracking or advertising, and we will update this notice if we add cookies that require your consent.

Strictly necessary cookies do not require consent under UK cookie rules. We have not added a consent popup for analytics that are not installed. If non-essential analytics such as Google Analytics 4 are introduced, we will update this notice with the relevant processing and retention details and put the required consent arrangements in place before those technologies are used.

Under UK data protection law you have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• have your information erased in certain circumstances;
• restrict or object to our use of your information in certain circumstances;
• receive your information in a portable format, where applicable.

To exercise any of these rights, email tyler@essexroofingandrepairs.co.uk. We will normally respond within one month. We may need proportionate information to verify your identity. Where the law permits extra time for a complex request or a number of requests, we will explain this within the initial month. Rights have legal limits: for example, some records must be retained to meet a legal obligation or defend a claim. Requests are normally free of charge.

The company must determine whether it is required to pay the ICO data protection fee and register, using the ICO's official self-assessment. ICO registration has not been confirmed, and no registration number is claimed in this notice. This does not affect your right to complain to the ICO.

If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.