GDPR Policy

1. Policy Statement

Johal Architectural Fabrications Ltd is committed to protecting personal information and complying with applicable data protection legislation.

This policy explains how we manage personal information when operating as Shop Front Fitters.

We provide bespoke shop front design and installation, glazing, roller shutter solutions, curtain walling, repairs and maintenance. These activities may involve collecting and processing information about customers, prospective customers, suppliers, contractors and website users.

We process personal information lawfully, fairly and transparently. We take reasonable steps to protect the information we hold and respect the rights of individuals.

2. Data Controller

The data controller is:

Johal Architectural Fabrications Ltd
Trading as Shop Front Fitters
Unit 8 Orwell Close
Marsh Way
Rainham
Essex
United Kingdom
RM13 8UB

Company number: 07075544
Website: https://shopfrontfitters.uk/

The company is responsible for determining the purposes and means of processing personal information.

3. Relevant Legislation

We aim to comply with applicable UK data protection requirements, including:

UK General Data Protection Regulation.
Data Protection Act 2018.
Privacy and Electronic Communications Regulations 2003, as amended.
Other applicable privacy and data protection requirements.

We review our data handling practices when relevant legal or operational requirements change.

4. Personal Information We Process

The information we process depends on how an individual interacts with our business.

Customer and enquiry information

This may include:

Names and contact details.
Business names and job titles.
Email addresses and telephone numbers.
Postcodes and property addresses.
Enquiry details and correspondence.
Project requirements and specifications.
Site survey information.
Measurements, drawings and photographs.
Quotations, orders and contract records.
Payment and invoicing information.

Supplier and contractor information

This may include:

Names and business contact details.
Company details.
Service and contract information.
Payment and invoice records.
Relevant correspondence.

Website and technical information

Depending on the website technologies in use, this may include:

IP addresses.
Browser and device information.
Website usage information.
Cookie identifiers.
Security and diagnostic records.
Website enquiry form submissions.

We do not intentionally collect special category personal data as part of our ordinary shop front services. If such information is received, we will assess whether we have a lawful basis and appropriate safeguards before processing it.

5. Data Protection Principles

We follow the principles set out in UK GDPR. Personal information must be:

Processed lawfully, fairly and transparently.
Collected for specified, explicit and legitimate purposes.
Adequate, relevant and limited to what is necessary.
Accurate and kept up to date where necessary.
Retained only for as long as necessary.
Protected using appropriate security measures.

We are responsible for demonstrating compliance with these principles.

6. Lawful Bases for Processing

We identify and document a lawful basis before processing personal information.

The lawful bases we may rely on include:

Contract

We process information where necessary to provide a quotation, enter into a contract, supply goods or deliver services.

Examples include managing shop front installation projects, arranging site surveys and communicating about repairs.

Legitimate interests

We may process information for legitimate business purposes where those interests do not override the individual's rights and freedoms.

Examples include responding to business enquiries, managing customer relationships, protecting our website and maintaining business records.

Legal obligation

We process information where necessary to comply with legal duties, including tax, accounting and regulatory requirements.

Consent

We rely on consent where required, including for certain marketing communications and non-essential cookies.

Individuals can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. Purposes of Processing

We may use personal information to:

Respond to enquiries.
Prepare quotations and proposals.
Arrange site visits and surveys.
Design bespoke shop fronts.
Supply and install glazing, shutters and curtain walling.
Manage repairs and maintenance.
Process orders and payments.
Communicate about projects and appointments.
Provide customer support.
Manage complaints and disputes.
Maintain business and financial records.
Improve website functionality and security.
Meet legal and regulatory obligations.
Send permitted marketing communications.

We do not use personal information for unrelated purposes without identifying an appropriate lawful basis.

8. Sharing Personal Information

We may share information with third parties where necessary for business operations or service delivery.

These may include:

Manufacturers and material suppliers.
Installation contractors and subcontractors.
Specialist glazing and construction providers.
Website hosting and IT providers.
Email and communications providers.
Payment processors.
Accountants and professional advisers.
Insurers.
Legal advisers.
Government bodies and regulators where legally required.

We do not sell personal information.

Where a third party processes information on our behalf, we will use appropriate contractual and organisational safeguards.

9. Data Processors and Suppliers

We take reasonable steps to ensure that service providers handling personal information have suitable security and data protection arrangements.

Where required, we enter into written data processing agreements that define:

The purpose and duration of processing.
The nature and purpose of the processing.
The types of personal information involved.
The categories of individuals concerned.
Security requirements.
Confidentiality obligations.
Assistance with data subject rights.
Requirements for returning or deleting information.

We review supplier arrangements where appropriate.

10. Data Security

We use appropriate technical and organisational measures to protect personal information.

Depending on the systems and services in use, these measures may include:

Password-protected systems.
Restricted access to business records.
Secure website and hosting arrangements.
Device and software security.
Access controls.
Staff awareness.
Secure disposal of documents.
Appropriate supplier checks.
Back-up and recovery arrangements.

We limit access to personal information to people who need it for legitimate business purposes.

11. Data Retention

We retain personal information only for as long as necessary.

Retention periods depend on the type of information, the purpose of processing and legal requirements.

Examples include:

Enquiry records retained for a reasonable period after the enquiry ends.
Customer and project records retained for the relevant contractual and legal periods.
Financial records retained for applicable tax and accounting requirements.
Marketing records retained until consent is withdrawn or another lawful basis ends.
Website and technical records retained according to operational and security needs.

We periodically review the information we hold and securely delete or anonymise information that is no longer required.

12. International Data Transfers

Some suppliers may process or store personal information outside the United Kingdom.

Before transferring personal information internationally, we assess the transfer arrangements and implement appropriate safeguards where required.

These may include UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the relevant standard contractual clauses.

13. Individual Data Protection Rights

Individuals may have the right to:

Access their personal information.
Correct inaccurate or incomplete information.
Request erasure in certain circumstances.
Restrict processing in certain circumstances.
Object to processing based on legitimate interests.
Object to direct marketing.
Request data portability where applicable.
Withdraw consent where processing relies on consent.
Complain to the Information Commissioner's Office.

We assess each request under the applicable legal requirements. Some rights are subject to conditions and exemptions.

14. Subject Access Requests

Individuals can ask us for a copy of the personal information we hold about them.

We will:

Record the request.
Verify the identity of the requester where necessary.
Identify the relevant systems and records.
Review the information and any applicable exemptions.
Respond within the statutory timeframe.

We generally respond within one month of receiving a valid request. Where a request is complex or multiple requests have been made, the law may allow an extension. We will explain any extension where applicable.

We do not normally charge a fee for responding to a request. A reasonable fee may apply in limited circumstances permitted by law.

15. Personal Data Breaches

A personal data breach may involve accidental or unlawful loss, destruction, alteration, disclosure of or access to personal information.

If we become aware of a suspected breach, we will:

Investigate the incident.
Assess the potential impact.
Take reasonable steps to contain and reduce the risk.
Record the incident and relevant findings.
Notify the Information Commissioner's Office within 72 hours where the law requires.
Inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

We will retain records of personal data breaches in accordance with applicable requirements.

16. Cookies and Electronic Marketing

Our website may use cookies and similar technologies.

We will obtain consent before using non-essential cookies where required by law. Strictly necessary cookies may operate without consent where permitted.

We also comply with applicable electronic marketing requirements.

Marketing communications will only be sent where we have an appropriate lawful basis. Individuals can opt out of direct marketing at any time.

Further information is available in our Privacy Policy and Cookie Policy.

17. Data Protection by Design

We consider data protection when introducing new systems, services or processes that involve personal information.

Where processing is likely to result in a high risk to individuals, we will assess whether a Data Protection Impact Assessment is required.

We aim to collect only the information needed for each business purpose and restrict access appropriately.

18. Confidentiality

Anyone authorised to access personal information must handle it confidentially and only use it for legitimate business purposes.

We take reasonable steps to ensure that employees, contractors and relevant suppliers understand their responsibilities when handling personal information.

19. Data Accuracy

We take reasonable steps to keep personal information accurate and up to date.

Where an individual identifies inaccurate information, we will review it and make corrections where appropriate.

20. Complaints and Regulatory Authority

Individuals should contact us if they have concerns about how we process their personal information.

Individuals also have the right to complain to the Information Commissioner's Office.

Website: https://ico.org.uk/
Telephone: 0303 123 1113

21. Policy Review

We review this policy periodically and when changes to our business, systems or legal obligations make an update necessary.

The latest version will be made available on our website.

22. Contact Details

For data protection enquiries, requests or complaints, contact: