Contents
1 Who we are
Primeline Decor (trading as Primeline Decor Bristol Painting Services) is a painting and decorating business based in Bristol, United Kingdom.
2 What data we collect & why
We collect only the data we genuinely need to quote for, organise, and deliver our services.
| Category | Examples | How collected |
|---|---|---|
| Identity data | Name, company name | Contact form, email, phone call |
| Contact data | Email address, phone number, postal address or site address | Contact form, email, phone call |
| Project data | Property type, scope of works, photos of surfaces, site access notes | Survey visit, email, WhatsApp |
| Contract & financial data | Quotes, invoices, payment records (we do not store card numbers) | Our invoicing and accounting software |
| Communication data | Emails, text messages, WhatsApp messages you send us | Emails, text messages, WhatsApp messages you send us. Note: We use the standard version of WhatsApp. Please do not share sensitive personal information (such as financial or identity documents) via messaging apps. |
| Technical data | IP address, browser type, pages visited, time on site | Website analytics (if enabled) |
3 Our lawful bases for processing
Under UK GDPR (Article 6), we rely on the following lawful bases:
- Contract - processing is necessary to prepare or perform a contract with you (e.g. providing a quote, carrying out works, invoicing).
- Legitimate interests - to respond to enquiries, manage our business relationships, and keep records for our own security and quality purposes, where these interests are not overridden by your rights.
- Legal obligation - to comply with our legal duties, such as retaining financial records for HMRC.
- Consent - where we ask you specifically before sending marketing emails or placing non-essential cookies. You can withdraw consent at any time.
4 How we use your data
We use the data we collect to:
- Respond to your enquiry and prepare quotations
- Plan, schedule and carry out painting and decorating works
- Issue invoices and process payments
- Comply with health & safety and insurance obligations on site
- Maintain records required by HMRC and other regulators
- Improve the quality and performance of our website
- Send you project updates and follow-up communications relevant to your job
- With your consent: send occasional marketing or service updates
We will never use your data for automated decision-making or profiling that produces legal or similarly significant effects.
5 Who we share your data with
We do not sell, rent, or trade your personal data. We share data only where necessary:
Service providers & subcontractors
Where we engage trusted subcontract tradespeople for specific works, we may share your site address and contact name with them solely for the purpose of carrying out those works.
Professional advisers
Our accountant may process financial data on our behalf for bookkeeping and tax purposes, bound by their own professional confidentiality obligations.
Software platforms & Local Storage
We use standard business tools (e.g., email, invoicing software) for our day-to-day operations. Data we collect is stored locally on our secure business devices, accessible only by authorised personnel. We do not use third-party cloud storage services for client data storage.
Legal requirements
We may disclose data where required by law, court order, or to protect the rights and safety of our business, employees, or clients.
6 How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Enquiries that did not become contracts | 12 months from last contact | Legitimate interest in follow-up |
| Contracts, invoices, payment records | 6 years from end of tax year | HMRC / legal obligation |
| Project photographs | 3 years (or longer with consent for portfolio use) | Quality assurance / warranty evidence |
| H&S records (site risk assessments, method statements) | 3 years from project completion | Legal obligation / insurance |
| Marketing consent records | Until consent withdrawn, then deleted within 30 days | Consent |
| Website analytics data | 26 months (standard analytics cycle) | Legitimate interest in website performance |
Once data is no longer needed, we securely delete or anonymise it.
7 Cookies & tracking
Cookies are small text files placed on your device when you visit a website.
Strictly necessary cookies
These are required for the website to function and cannot be switched off. They include session management and security tokens. No consent is required for these.
Analytics cookies
If we use analytics tools (such as Google Analytics), these cookies collect anonymous information about how visitors use the site - pages visited, time spent, device type. We anonymise IP addresses and do not use this data to identify individuals. We will request your consent before placing analytics cookies.
Third-party embeds
This website may include map images or links to social media platforms (e.g. Facebook). These third parties may set their own cookies when you interact with embedded content. We do not control third-party cookies - please review the respective privacy policies of those services.
How to manage cookies
You can control cookies through your browser settings. Disabling cookies may affect the functionality of certain website features. For more information, visit allaboutcookies.org.
8 Your rights under UK GDPR
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights:
- Right of access - you may request a copy of the personal data we hold about you (a "Subject Access Request" / SAR). We will respond within one calendar month at no charge.
- Right to rectification - if information we hold about you is inaccurate or incomplete, you can ask us to correct it.
- Right to erasure ("right to be forgotten") - in certain circumstances you can ask us to delete your data. This right is not absolute - we may need to retain some data for legal reasons.
- Right to restrict processing - you can ask us to pause the processing of your data in certain situations (e.g. while accuracy is contested).
- Right to data portability - where processing is based on consent or contract, and is carried out by automated means, you may request a machine-readable copy of your data.
- Right to object - you can object to processing based on legitimate interests at any time. We must stop unless we can demonstrate compelling legitimate grounds that override your interests.
- Rights in relation to automated decision-making - we do not carry out automated decision-making or profiling with legal or significant effects, so this right is not currently applicable.
- Right to withdraw consent - where processing relies on consent (e.g. marketing), you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us using the details in Section 11. We will verify your identity before actioning your request. We aim to respond within 30 days; complex requests may take up to a further two months, in which case we will inform you of the delay.
9 How to complain
If you are unhappy with how we have handled your personal data, please contact us first so we have the opportunity to put things right.
If you remain dissatisfied, you have the right to lodge a complaint with the UK's supervisory authority:
Website: ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
The ICO is the independent body set up to uphold information rights in the UK.
10 Changes to this policy
We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page.
We recommend checking this page periodically. Continued use of our website or services after changes have been posted constitutes your acknowledgement of those changes.
Previous versions of this policy are available on request.