GDPR and Data Protection Policy

1. Introduction

Precision Spray Painters is committed to protecting the privacy, confidentiality and security of personal information.

We recognise our responsibilities under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable data protection legislation.

This GDPR and Data Protection Policy explains how we approach the collection, use, storage, protection and handling of personal information in the course of operating our business.

We aim to ensure that all personal information is handled lawfully, fairly, transparently and securely.

2. Business Details and Data Controller

Precision Spray Painters is a trading style of UPVC Spray Painters Ltd.

UPVC Spray Painters Ltd is the data controller responsible for determining how and why personal information is processed.

Our business details are:

Company name: UPVC Spray Painters Ltd
Trading name: Precision Spray Painters
Company registration number: 12301072

Registered business address:

Falcon House
Hutson Street
Bradford
BD5 7LZ
United Kingdom

For the purposes of this policy, references to "we", "us" and "our" mean UPVC Spray Painters Ltd trading as Precision Spray Painters.

3. Our Data Protection Principles

We follow the data protection principles established under UK GDPR.

These principles require us to ensure that personal information is:

Lawful, fair and transparent

We process personal information lawfully and explain clearly how and why we use it.

Purpose limitation

We only collect personal information for specific, legitimate business purposes and do not use it in ways that are incompatible with those purposes.

Data minimisation

We only collect personal information that is relevant and necessary for the services we provide.

Accuracy

We take reasonable steps to ensure personal information is accurate and kept up to date where necessary.

Storage limitation

We do not keep personal information for longer than necessary.

Integrity and confidentiality

We take appropriate measures to protect personal information against unauthorised access, accidental loss, damage or disclosure.

Accountability

We take responsibility for our data protection obligations and aim to maintain appropriate records and procedures to demonstrate compliance.

4. Personal Information We Process

As part of our business operations, we may collect and process personal information relating to prospective customers, existing customers, suppliers and website visitors.

This information may include:

Names and contact details.
Email addresses and telephone numbers.
Property and business addresses.
Postcodes and project locations.
Enquiry and quotation details.
Photographs supplied in connection with spray painting projects.
Customer correspondence and communications.
Booking and appointment information.
Invoices and payment records, where applicable.
Website usage and technical information.

We only process personal information where we have a legitimate and lawful reason to do so.

5. Why We Process Personal Information

We process personal information to support the operation of our spray painting business.

Our purposes include:

Responding to customer enquiries.
Providing quotations and estimates.
Assessing customer requirements.
Arranging appointments and site visits.
Delivering residential, commercial and industrial spray painting services.
Managing customer relationships.
Processing payments and maintaining financial records.
Communicating about existing projects.
Managing suppliers and business relationships.
Improving our website and services.
Meeting legal and regulatory obligations.

We do not sell personal information to third parties.

We do not use telephone numbers or email addresses submitted through our website contact form for marketing purposes.

6. Lawful Basis for Processing

UK GDPR requires us to identify an appropriate lawful basis before processing personal information.

Depending on the circumstances, we rely on the following lawful bases:

Contract

We process information where necessary to fulfil a contract or take steps requested by an individual before entering into a contract.

For example, preparing a quotation or arranging a spray painting service.

Legitimate interests

We may process information where necessary for our legitimate business interests, provided those interests do not override an individual's rights and freedoms.

This may include responding to general enquiries, managing business relationships and improving our services.

Legal obligation

We may process personal information where necessary to comply with legal obligations, including accounting and tax requirements.

Consent

Where required, we obtain consent before processing personal information for specific purposes.

Individuals can withdraw their consent at any time where consent is the lawful basis for processing.

7. Data Security and Confidentiality

We take appropriate technical and organisational measures to protect personal information.

These measures are intended to prevent:

Unauthorised access.
Accidental disclosure.
Loss or destruction of information.
Unlawful processing.
Unauthorised alteration or misuse.

We aim to ensure that personal information is only accessible to people who need it for legitimate business purposes.

We also take reasonable steps to ensure that third-party service providers handling personal information on our behalf maintain appropriate security measures.

8. Data Storage and Retention

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected or to meet applicable legal obligations.

Retention periods depend on the nature of the information and the reason it is held.

For example:

Customer enquiries are retained for as long as reasonably necessary to manage the enquiry.
Quotations and project information may be retained for an appropriate period following the enquiry or completed work.
Financial and transaction records are retained in accordance with applicable legal and accounting requirements.
Website information is retained in accordance with the settings and retention periods of relevant website services.

When personal information is no longer required, we will take appropriate steps to securely delete or anonymise it.

9. Sharing Personal Information

We do not sell, rent or trade personal information.

We may share relevant information with trusted third-party providers where necessary to operate our business.

These may include:

Website hosting providers.
Website maintenance and technical support providers.
Email and communication service providers.
Payment processing providers, where applicable.
Accountants and professional advisers.
Government bodies and regulatory authorities where legally required.

Where third parties process personal information on our behalf, we will take appropriate steps to ensure that suitable contractual and data protection safeguards are in place.

We only share the information necessary for the relevant business purpose.

10. International Data Transfers

Where personal information is transferred outside the United Kingdom, we will ensure that the transfer complies with applicable UK data protection legislation.

Appropriate safeguards will be used where required to protect personal information transferred internationally.

These may include recognised adequacy arrangements or approved international data transfer safeguards.

11. Individual Data Protection Rights

We respect the rights individuals have under UK GDPR.

Depending on the circumstances, individuals have the right to:

Access: Request a copy of the personal information we hold about them.
Rectification: Request the correction of inaccurate or incomplete information.
Erasure: Request the deletion of personal information where the legal conditions are met.
Restriction: Request restrictions on how their personal information is processed.
Data portability: Request certain personal information in a commonly used, machine-readable format.
Object: Object to certain types of personal information processing.
Withdraw consent: Withdraw consent where processing relies on consent.

These rights are subject to certain legal conditions and exemptions.

We will consider and respond to valid requests in accordance with applicable data protection legislation.

Requests should be made using the contact details provided on our website.

We may need to verify an individual's identity before responding.

12. Personal Data Breaches

We take reasonable steps to prevent personal data breaches and protect the information we hold.

A personal data breach may involve:

Unauthorised access to personal information.
Accidental disclosure of customer information.
Loss or theft of devices containing personal information.
Unauthorised alteration of stored information.
Accidental destruction or loss of personal information.

If we become aware of a personal data breach, we will investigate the incident and take appropriate steps to contain and address it.

Where a breach is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) within the applicable legal timeframe.

Where a breach is likely to result in a high risk to individuals, we will also notify affected individuals where required by law.

We will maintain appropriate records of personal data breaches and the actions taken.

13. Third-Party Data Processors

We may use third-party organisations to provide services that involve processing personal information on our behalf.

Where this happens, we will take reasonable steps to ensure that those organisations:

Process personal information only for authorised purposes.
Maintain appropriate technical and organisational security measures.
Protect personal information against unauthorised access and disclosure.
Assist us with relevant data protection obligations.
Delete or return personal information when required under the relevant agreement.

We will use appropriate written data processing agreements where required by law.

14. Cookies and Website Data

Our website may use cookies and similar technologies to support website functionality, performance and visitor experience.

Where applicable, we will obtain consent before using non-essential cookies and tracking technologies.

For more information about website cookies and how personal information is collected through our website, please refer to our Privacy Policy and any separate Cookie Policy published on the website.

15. Children's Personal Information

Our services and website are not specifically directed at children.

We do not knowingly collect children's personal information for marketing purposes.

Where personal information relating to a child is provided to us, we will handle it in accordance with applicable data protection legislation.

16. Staff and Third-Party Responsibilities

Anyone authorised to access personal information on behalf of our business must handle it responsibly and maintain appropriate confidentiality.

Access to personal information should be limited to what is necessary for legitimate business activities.

Where employees, contractors or third parties handle personal information on our behalf, appropriate instructions and safeguards should be in place.

17. Data Protection Complaints

If you have concerns about how we collect, store or use your personal information, we encourage you to contact us first.

We will review your concerns and take appropriate steps to address them.

You also have the right to complain to the Information Commissioner's Office (ICO).

Information Commissioner's Office

Website: https://ico.org.uk/
Telephone: 0303 123 1113

The ICO provides independent guidance and oversight of data protection matters in the United Kingdom.

18. Policy Reviews and Updates

We may review and update this GDPR and Data Protection Policy to reflect changes in our business operations, website functionality, data protection practices or legal requirements.

Any updates will be published on this page with a revised last updated date.

We aim to maintain appropriate data protection practices and ensure that our approach remains consistent with applicable legislation.

19. Contact Information

For questions about this GDPR and Data Protection Policy, or to raise concerns about how your personal information is handled, please contact us.

UPVC Spray Painters Ltd
Trading as Precision Spray Painters