Privacy Policy
This has been written to match what the website actually does, so it is a realistic starting point rather than generic boilerplate. It is not legal advice and it has not been checked by a solicitor. Have it reviewed, and confirm the company details, retention periods and ICO registration, before publishing.
This policy explains what personal data Stone & Fell collects through stoneandfell.co.uk, why we collect it, and what rights you have over it. We are the data controller for that information.
- Controller
- Stone & Fell Ltd (confirm registered company name and number)
- Registered address
- To be confirmed
- Contact
- studio@stoneandfell.co.uk · 015394 00000
- ICO registration
- To be confirmed. Most businesses processing personal data must register with the Information Commissioner's Office.
What we collect
When you use the enquiry form
We ask for your name, email address, telephone number and the location of your property, all of which are required so we can reply. You may also tell us the type of project, an indicative budget, your intended timescale and a description of the building. That description is free text, so please include only what you are comfortable sharing.
Automatically, when you visit
Our host records standard server logs, which include your IP address, browser type and the pages you requested. These are used to keep the site running securely and to diagnose faults.
What we do not do
We do not use analytics, advertising trackers or profiling on this site. We do not buy or sell contact data, and we do not add enquirers to a mailing list.
Why we use it, and our lawful basis
- To respond to your enquiry and arrange a consultation. Our lawful basis is legitimate interests: you contacted us asking for a reply, and answering you is what you would reasonably expect.
- To prepare a design proposal or quotation if you ask for one. Lawful basis: steps taken at your request before entering a contract.
- To keep the site secure and working. Lawful basis: legitimate interests in preventing abuse and diagnosing faults.
- To meet legal and accounting obligations where a project proceeds. Lawful basis: legal obligation.
Who we share it with
We do not sell your data or share it for marketing. We use a small number of suppliers who process it on our behalf under contract:
- Resend
- Delivers enquiry emails from the website to our inbox. Your form submission passes through their systems. Resend is based in the United States, so this involves a transfer outside the UK, made under the safeguards in their data processing agreement. Confirm the current mechanism when the account is set up.
- Hostinger
- Hosts the website and holds the server logs.
- Google Fonts
- The site loads two typefaces from Google's servers, which means your IP address is disclosed to Google when the page loads. This can be removed entirely by self-hosting the fonts, which we recommend and which is on the build list.
- YouTube
- Only if you press play on a video. Nothing is requested from YouTube otherwise. See the Cookie Policy.
We may also disclose information where we are legally required to.
How long we keep it
- Enquiries that do not proceed: up to 24 months, then deleted. Confirm this period.
- Enquiries that become projects: for the life of the project and for 6 years afterwards, to meet contractual, insurance and tax obligations. Construction records may need longer under a warranty or the Building Safety Act.
- Server logs: as retained by our host, typically a short rolling period.
Your rights
Under UK GDPR you have the right to ask us for a copy of your data, to correct it, to have it erased, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interests, you can object at any time.
To exercise any of these, email studio@stoneandfell.co.uk. We will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.
Security
The site is served over HTTPS. Enquiries are sent from your browser to our server and on to our email provider over encrypted connections. Credentials for that provider are held as server-side environment variables and are never present in the website's code or in your browser. Access to the enquiry inbox is limited to the people who need it.
Children
This site is aimed at people commissioning building work and is not directed at children. We do not knowingly collect data about anyone under 16.
Changes
If we change this policy we will update the date at the top of the page.