Privacy policy

We use personal data to respond to enquiries, prepare quotations, carry out due diligence, and manage projects. This typically includes contact details, property information, and documents relevant to the work. Our website is hosted using Zoho Sites. When you submit a form, your information is processed so we can respond and keep a record of the enquiry. We do not sell personal data. We only share data where necessary to deliver services, meet legal obligations, or administer projects. You have the right to access, correct, or request deletion of your data, and to object to certain uses.

Who we are

ep8 Ltd is a design and build building company providing renovation, refurbishment, extension, and retrofit services across Oxfordshire, Buckinghamshire, and the Cotswolds. Registered address 30 Bankside, Stationfields, Kidlington, Oxfordshire, OX5 1JE. Email privacy@ep8.co.uk. Website ep8.co.uk. ep8 Ltd is the data controller for personal data collected through this website and our communications.

Our commitment to privacy

We take privacy and data protection seriously. We collect only information that is necessary, use it for clear purposes, keep it secure, and retain it only for as long as required. Our processes are designed to comply with UK GDPR and recognised best practice.

What personal data we collect

We may collect the following information: Name; email address; telephone number; property address or project location; information you provide about your enquiry or project; messages, documents, and attachments you send to us; technical information such as IP address, browser type, and device information. For live projects or due diligence purposes, we may also collect and store the following information where necessary: Identification documents; proof of funds or related financial information; project documents we create, receive, or store; documents you send us; documents project partners send us; drawings, schedules, and specifications; approvals, surveys, and reports; project correspondence and site records. We do not knowingly collect personal data relating to children.

How we collect your data

We collect personal data when you do the following: Submit an enquiry through our website; contact us by email or telephone; engage with us during an enquiry, quotation, or projects; visit our website, through essential cookies only.

Why we use your data

We use personal data for the following purposes: Responding to enquiries and requests. Preparing quotations and proposals. Carrying out reasonable due diligence. Delivering and managing projects. Managing decisions and communications. Maintaining project records and documents. Meeting legal, contractual, insurance, and regulatory obligations. Improving our website and services. We do not use automated decision making or profiling.

Lawful basis for processing

We process personal data under one or more of the following lawful bases: Legitimate interests in responding to enquiries and operating our business. Performance of a contract or steps taken before entering a contract. Compliance with legal obligations. Consent, where explicitly given.

Website hosting and processors

Our website is hosted using Zoho Sites. Zoho acts as a data processor on our behalf, processing personal data only in accordance with our instructions and applicable data protection laws. Appropriate technical and organisational measures are in place to protect personal data.

Who we share data with

We only share personal data where it is necessary and proportionate, including with the following parties: Designers, consultants, and subcontractors involved in your project. Insurers, warranty providers, and building control bodies where required. Professional advisers such as accountants. IT, hosting, and systems providers supporting our operations. We do not sell personal data.

International data transfers

Some service providers may process personal data outside the UK. Where this occurs, appropriate safeguards are used in line with data protection law.

Data security

We use appropriate technical and organisational measures to protect personal data, including access controls and secure storage. Sensitive information, such as identification or proof of funds, is restricted to authorised access and handled with additional care. We carry cyber insurance as part of our wider insurance arrangements. You can read more about our insurance policy here.

How long we keep your data

We retain personal data only for as long as necessary: Enquiry records are retained for a reasonable follow up period. Project records are retained to support warranties, insurance, contractual, and legal obligations. Identification and proof of funds information is retained only where required and only for as long as necessary. Financial records are retained in line with statutory requirements. Data is securely deleted when it is no longer required.

Use of artificial intelligence tools

We may use artificial intelligence tools, to assist with drafting content, analysing information, and improving internal processes. We use ChatGPT for Business, a paid service from OpenAI. OpenAI does not train its models on business data submitted through this service by default. These tools are used as support tools only and are not used to make automated decisions about individuals. We minimise personal data shared with these tools and only include it where necessary for the task. Where personal data is processed, it is handled in line with data protection law and our obligations as data controller. That wording now aligns with: ChatGPT Business data handling. UK GDPR transparency expectations. Your existing policy tone. A one person business setup.

Cookies

Our website uses essential cookies only to ensure it functions correctly. We do not use analytics, tracking, or marketing cookies. Cookie preferences can be managed at any time using the cookie controls on the website or through browser settings.

Your rights

You have the right to do the following: Access your personal data. Correct inaccurate data. Request erasure in certain circumstances. Restrict processing in certain circumstances. Object to processing in certain circumstances. Request data portability. Withdraw consent where consent applies. To exercise your rights, email privacy@ep8.co.uk.

Complaints

If you have concerns about how your data is handled, please contact us so we can address them. You may also complain to the Information Commissioner's Office.