Privacy Policy

Who is responsible

Castle Skylights Colchester is the data controller. We are a service area business working from Colchester and about thirty miles around it, so there is no public premises address; correspondence is by email.

• Trading name: Castle Skylights Colchester
• Email: info@castleskylightscolchester.co.uk
• Phone: 01206 673276

What we collect

What you tell us. Your name, contact details, the address the work is at, and whatever you tell us about the roof and what you want done.

Records of our dealings. Notes from the survey, the quotation we issued, dates, photographs of the roof and the messages between us. If the job goes ahead this also includes the glazing specification and the Building Regulations paperwork.

Technical data from the website. Standard server logs recording requests, IP addresses, timestamps and browser identifiers, kept by our host for security and for diagnosing faults rather than for tracking anybody.

WhatsApp. If you message us on WhatsApp the content is end to end encrypted, but WhatsApp and its parent company hold the account and metadata under their own terms. We copy anything relevant into the enquiry record and treat it the same way as an email.

Why we hold it

To answer your enquiry and quote for the work, which is a step you asked us to take before entering a contract. To carry out the work and meet our obligations under it. To keep the accounting and tax records the law requires. And to be able to identify the exact unit and glazing specification years later if you need us under the guarantee.

How long we keep it

Keeping information for ever because storage is cheap is not a policy, it is the absence of one. Each category has its own period and its own reason.

• Enquiries that never became a job: twelve months from the last contact, then deleted.
• Quotations issued but not accepted: twenty-four months, because a roof somebody was pricing last summer is usually still the same roof.
• Job records, survey notes and photographs for completed work: ten years, matching the workmanship guarantee, so we can identify the exact unit and specification if you ever need us to.
• Accounting and tax records: six years from the end of the accounting period they relate to, as required of businesses in the UK.
• Marketing consent records: held until you withdraw consent, plus a short period afterwards so we can evidence that the consent existed.

Who else sees it

The manufacturer or supplier, where a made to size unit has to be ordered against your measurements. Scaffolders and structural engineers where the job needs them. Our accountant. Nobody else, and we do not sell or rent contact details to anyone.

Where it is stored

In the business email account, in the files kept for each job, and in the accounting records. Some of those services are provided by companies that store data outside the United Kingdom. Where a transfer outside the UK takes place it relies on the mechanisms the UK GDPR allows, ordinarily an adequacy decision for the destination country or standard contractual clauses. We check this when we choose a supplier and we prefer UK or EU hosting wherever there is a sensible option.

Keeping it secure

Access to enquiry and job information is limited to the people who need it to do the work, and accounts are protected by passwords. Two-factor authentication is used on the accounts that support it, and devices holding job records are encrypted. No system is perfect, and if a breach occurs that is likely to result in a risk to your rights, the Information Commissioner’s Office will be notified within seventy-two hours of the breach becoming known and you will be told directly where the risk to you is high.

Your rights

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it where we are not required to keep it, object to how we are using it, or ask us to restrict what we do with it while a question is resolved. Ask by email and we will respond within one month.

If you think we have handled your information badly, tell us first, because most of it is fixable in a day. If that does not settle it you can complain to the Information Commissioner’s Office at ico.org.uk, on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Complaining to the ICO is your right regardless of whether you have raised it with us.

Changes

This notice will be updated when the way information is handled changes, or when analytics are added to the site. The version in force is the one published here.

• Date this notice takes effect: 26 August 2026
• Date of the last review: 26 August 2026

The cookie policy covers what this website loads in your browser and what it stores there.