Northgate Construction

Northgate Construction ("we", "us", "our") is committed to protecting the privacy of visitors to our website and customers who engage our services. This Privacy Policy explains in detail what personal information we collect, how and why we use it, how long we retain it, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

By using our website at northgate-construction.co.uk, submitting an enquiry, requesting a quotation, or purchasing a project package, you acknowledge that you have read and understood this Privacy Policy.

1. Who we are (data controller)

The data controller for the purposes of UK GDPR is Taanim Bapary, trading as Northgate Construction, of 78 Whitmore Road, United Kingdom. You can contact us in writing at the address above or by email at taanimnorthgate@gmail.com. Where this policy refers to "we", "us" or "our", it refers to that data controller.

Northgate Construction is a sole-trader business and does not currently have a designated Data Protection Officer; all data protection matters are handled directly by the owner.

2. Information we collect

We collect personal information in the following circumstances:

2.1 Information you provide directly

Enquiry and quotation details — when you complete our enquiry form, email us, or telephone us: your full name, email address, telephone number, property address or postcode area, project type, and any descriptive information or photographs you share to help us understand the work.
Project documentation — measurements, drawings, planning correspondence, surveys, photographs of the site and any specifications or material preferences you supply during the quotation and delivery process.
Correspondence — emails, text messages, written notes and call records relating to your project.
Identity and contractual information — where required for invoicing or for compliance with consumer protection law, we may keep a record of the name and address used for billing.

2.2 Payment information

Payments for our project packages are processed by Stripe Payments Europe, Ltd. ("Stripe"). When you click a Stripe checkout link from our pricing page, you are redirected to Stripe's secure checkout. Stripe collects and processes your card details, billing address and any additional information required for fraud prevention. We receive only a transaction confirmation, the package purchased, the amount paid, and the name and email address associated with the payment. We do not store, view or have access to your full payment card details at any point.

2.3 Information collected automatically

Technical and device information — IP address, browser type and version, operating system, device type, referring URL, language preference and time-zone setting.
Usage information — pages visited, the date and time of access, the duration of each visit, navigation paths through the site, and similar diagnostic data collected for security, troubleshooting and aggregated analytics.
Cookies and similar technologies — see our separate Cookie Policy for a full description of the cookies we and our service providers use.

3. How we use your information (purposes and lawful bases)

We process personal data only where we have a lawful basis under Article 6 of the UK GDPR. The lawful bases we rely on are summarised below for each purpose:

To respond to your enquiry and prepare a written quotation — lawful basis: taking steps at your request prior to entering into a contract, and our legitimate interest in operating our business.
To carry out and document agreed projects — lawful basis: performance of a contract with you.
To process payments and manage refunds — lawful basis: performance of a contract and compliance with legal obligations (including tax and accounting law).
To communicate with you about ongoing or completed projects — lawful basis: performance of a contract and legitimate interest in maintaining the customer relationship.
To maintain accounting and tax records — lawful basis: compliance with legal obligations under HMRC and Companies Act requirements.
To protect our website and detect fraud or abuse — lawful basis: legitimate interest in keeping our systems and customers safe.
To deal with complaints, claims or legal proceedings — lawful basis: legitimate interest in defending our legal rights and compliance with legal obligations.
For occasional service updates — lawful basis: legitimate interest. We currently do not send marketing emails; if this changes we will ask for your explicit consent first.

4. Who we share your information with

We do not sell, rent or trade your personal information. We share data only with trusted third parties strictly to the extent necessary to operate our business:

Stripe Payments Europe, Ltd. — payment processing. Stripe acts as an independent controller for the payment data it collects directly from you. See Stripe's Privacy Policy.
Email and hosting providers — for delivery and storage of correspondence and to keep our website online and secure.
Accountants, tax advisers and insurers — for the limited purpose of managing our financial and insurance obligations.
Suppliers and sub-contractors — where information such as your property address is required to deliver materials or to arrange specialist trades engaged for a portion of the work. Only the minimum information needed is shared.
Regulators, law enforcement and other authorities — where we are required to disclose information by law, court order, or in response to a valid request.
Professional advisers — legal advisers, where strictly necessary for the protection of our rights.

All third parties processing personal data on our behalf are required to do so in accordance with our written instructions, to maintain appropriate security measures, and to respect the rights of data subjects.

5. International data transfers

Wherever possible our service providers store personal data within the United Kingdom or the European Economic Area. Where data is transferred outside the UK or EEA (for example, where a hosting or email provider operates servers in the United States), we ensure that an appropriate safeguard is in place — typically the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or reliance on the UK Government's adequacy decisions.

6. How long we keep your information

Enquiry details that do not result in a project — up to 24 months from the date of last contact, after which they are deleted or anonymised.
Quotation records — 6 years from the date of issue, in line with the limitation period under the Limitation Act 1980.
Project records and contracts — 6 years from project completion.
Invoices, receipts and accounting records — at least 6 years to meet HMRC's record-keeping requirements.
Insurance and health and safety documentation — typically 6 years and, where required by our insurers, longer for projects with a potential latent-defect period.
Complaint records — 6 years after closure of the complaint.
Website analytics and server logs — generally up to 12 months, retained in an aggregated or pseudonymised form where possible.

At the end of the relevant retention period, personal data is securely deleted or anonymised so it can no longer be associated with you.

7. Your data protection rights

Under UK GDPR you have the following rights, which you can exercise free of charge by contacting us at taanimnorthgate@gmail.com:

Right of access — a copy of the personal data we hold about you.
Right to rectification — correction of inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — deletion of your data, subject to legal and contractual retention requirements.
Right to restrict processing — a temporary limit on how we use your data while a question about it is resolved.
Right to data portability — receipt of certain data in a structured, commonly-used, machine-readable format.
Right to object — to processing carried out on the basis of legitimate interests, including any future direct marketing.
Rights relating to automated decision-making — we do not currently carry out any solely automated decision-making that has legal or similarly significant effects on you.
Right to withdraw consent — where we rely on consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.

We aim to respond to all valid requests within one calendar month. We may need to verify your identity before disclosing personal data. If we cannot fulfil a request, we will explain the reason in writing.

8. Right to complain

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, website ico.org.uk.

9. Security

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, accidental loss, alteration or disclosure. These include encrypted email where appropriate, restricted access to project files, secure backups, and the use of reputable hosting providers operating ISO 27001 and SOC 2 certified infrastructure. Payment data is handled exclusively by Stripe, which is certified to PCI DSS Level 1.

While we use reasonable measures to protect data, no transmission over the internet can be guaranteed to be 100% secure. Where you choose to send us photographs or documents by email, we recommend you do not include sensitive personal information beyond what is necessary to describe the project.

10. Children's privacy

Our website and services are intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided personal data to us, please contact us so we can remove it.

11. Cookies

This website uses a limited number of strictly necessary cookies and payment-related cookies. We do not use advertising or profiling cookies. Please see our Cookie Policy for full details.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. When changes are material we will update the "Last updated" date at the top of this page and, where appropriate, notify customers with whom we have an active project by email. The most current version is always published on this page.

13. Contact

For any question about this Privacy Policy or our handling of personal data, please email taanimnorthgate@gmail.com or write to Northgate Construction, 78 Whitmore Road, United Kingdom.