Privacy Policy

1. Company Information

Data Controller

Loft Restore is the data controller for the personal information we collect and process. Our details are:

Data Protection Officer

For data protection queries, you can contact our Data Protection Officer:

Email: dpo@loftrestore.co.uk
Address: Data Protection Officer, Loft Restore Limited, 123 Business Park, Manchester, M1 1AA

2. Information We Collect

Personal Information You Provide

We collect personal information you voluntarily provide when you:

• Request a quote or consultation
• Book an appointment or service
• Contact us via phone, email, or contact forms
• Subscribe to our newsletter or marketing communications
• Create an account on our website
• Leave reviews or feedback
• Apply for employment

Types of Personal Data

Automatically Collected Information

When you visit our website, we automatically collect:

• IP address and general location
• Browser type and version
• Operating system
• Pages visited and time spent
• Referring website
• Device type and screen resolution

Information from Third Parties

We may receive information about you from:

• Lead generation partners
• Social media platforms
• Credit reference agencies (for finance applications)
• Public databases and directories
• Other companies within our group

3. How We Use Your Information

Primary Uses

We use your personal information for the following purposes:

Marketing and Communications

With your consent or legitimate interest, we may use your information to:

• Send marketing emails about our services
• Provide information about special offers
• Send newsletters and educational content
• Contact you about related services you might be interested in
• Invite you to leave reviews or provide feedback

Legal and Compliance

We may process your data to:

• Comply with legal obligations
• Establish, exercise, or defend legal claims
• Prevent fraud and ensure security
• Cooperate with law enforcement
• Meet regulatory requirements

4. Legal Basis for Processing

Under UK GDPR, we must have a legal basis for processing your personal data. Our legal bases include:

Contract Performance

Processing necessary to perform our contract with you or take steps to enter into a contract:

• Providing quotes and estimates
• Delivering loft insulation services
• Processing payments
• Managing appointments and scheduling

Legitimate Interests

Processing necessary for our legitimate business interests:

• Improving our services and customer experience
• Marketing to existing customers about related services
• Fraud prevention and security
• Business development and growth
• Staff training and quality improvement

Consent

Where you have given clear consent for specific processing:

• Marketing emails and newsletters
• Cookies and website analytics
• Sharing information with partners for quotes

Legal Obligation

Processing required by law:

• Tax and accounting records
• Health and safety compliance
• Building regulations compliance
• Consumer protection requirements

5. How We Share Your Information

Service Providers and Partners

We may share your information with trusted third parties who help us deliver our services:

Categories of Recipients

• Installation Teams: Contact and property details for service delivery
• Payment Processors: Financial information for payment processing
• CRM Systems: Customer information for relationship management
• Marketing Platforms: Contact details for email marketing (with consent)
• Analytics Providers: Website usage data for performance analysis
• Cloud Storage: Secure data backup and storage services
• Accountants/Lawyers: As needed for professional services

Legal Requirements

We may disclose your information when required by law:

• To comply with legal proceedings or court orders
• To cooperate with law enforcement investigations
• To meet regulatory or tax obligations
• To protect our rights and interests
• To prevent fraud or other illegal activities

Business Transfers

If we sell, merge, or transfer our business, your information may be transferred to the new owners as part of the transaction. We will notify you of any such transfer.

International Transfers

We primarily process data within the UK. If we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place:

• Adequacy decisions by the UK government
• Standard contractual clauses
• Binding corporate rules
• Certification schemes

6. Data Security

Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

Data Breach Response

In the unlikely event of a data breach:

1. We will contain and assess the breach immediately
2. Notify the ICO within 72 hours if required
3. Inform affected individuals without undue delay
4. Take steps to minimize harm and prevent recurrence
5. Provide support and guidance to affected customers

Your Security Responsibilities

You can help protect your information by:

• Using strong, unique passwords
• Keeping login credentials confidential
• Logging out of accounts when finished
• Reporting suspicious activity immediately
• Keeping your contact information up to date

7. Data Retention

Retention Principles

We keep your personal data only as long as necessary for the purposes it was collected. Our retention periods are based on:

• Legal and regulatory requirements
• Business needs and legitimate interests
• The type and sensitivity of the data
• Risk of harm from unauthorized access

Specific Retention Periods

Data Disposal

When we no longer need your personal data, we securely delete or destroy it using:

• Secure deletion software for digital data
• Physical destruction of paper records
• Certified data destruction services
• Overwriting of storage media

8. Your Data Protection Rights

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Additional Rights

• Right to Restrict Processing: You can ask us to limit how we use your data in certain circumstances
• Right to Data Portability: You can request your data in a structured, machine-readable format
• Right to Object: You can object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision-Making: Protection against purely automated decisions that significantly affect you

Exercising Your Rights

To exercise any of these rights:

1. Contact us using the details provided in this policy
2. Provide sufficient information to verify your identity
3. Specify which right you wish to exercise
4. We will respond within one month (extendable to three months for complex requests)

Right to Complain

If you're unhappy with how we handle your personal data, you have the right to complain to:

9. Cookies and Website Tracking

What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide a better user experience and understand how our website is used.

Types of Cookies We Use

Managing Cookies

You can control cookies through:

• Our cookie banner and preference center
• Your browser settings
• Third-party opt-out tools
• Privacy browser extensions

Third-Party Services

We use the following third-party services that may collect data:

• Google Analytics: Website traffic analysis
• Google Ads: Advertising and conversion tracking
• Facebook Pixel: Social media advertising
• Live Chat Software: Customer support
• CRM Integration: Lead management

10. Marketing Communications

Marketing Consent

We will only send you marketing communications if:

• You have given explicit consent
• You are an existing customer and we're marketing similar services
• You have not opted out of marketing communications

Types of Marketing

Opting Out

You can stop marketing communications at any time:

• Click "unsubscribe" in any marketing email
• Contact us directly to opt out
• Update your preferences in your account
• Use browser tools to block tracking

Legitimate Interest Marketing

For existing customers, we may market similar services based on legitimate interest. You always have the right to object to this processing.

11. Children's Privacy

Age Restrictions

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information from children under 16 without parental consent.

If We Discover Child Data

If we become aware that we have collected personal data from a child under 16 without parental consent:

1. We will delete the information as soon as possible
2. We will not use the information for any purpose
3. We will not share the information with third parties
4. We will implement additional safeguards to prevent future collection

Parental Rights

Parents and guardians have the right to:

• Access their child's personal data
• Request correction or deletion
• Object to processing
• Withdraw consent at any time

12. Changes to This Privacy Policy

Policy Updates

We may update this privacy policy from time to time to reflect:

• Changes in our business practices
• New legal or regulatory requirements
• Updates to our technology systems
• Feedback from customers and regulators

How We Notify You

When we make significant changes, we will:

1. Update the "Last Updated" date at the top of this policy
2. Post a notice on our website homepage
3. Send an email to registered customers (for material changes)
4. Provide a summary of key changes

Your Continued Use

By continuing to use our services after changes are posted, you accept the updated privacy policy. If you disagree with changes, please stop using our services and contact us about data deletion.