GDPR Policy

1. Introduction

Elite Shop Fronts is committed to protecting the privacy, security and confidentiality of personal information.

This GDPR and Data Protection Policy explains how we collect, process, store, protect and manage personal data in accordance with applicable UK data protection legislation.

We recognise that individuals have rights over their personal information. We take our responsibilities seriously and aim to ensure that all personal data is handled lawfully, fairly, transparently and securely.

This policy applies to personal information collected through our website, business communications, customer enquiries, quotations, projects and other business activities.

2. Business Details and Data Controller

Elite Shop Fronts is a trading style of Johal Architectural Fabrications Ltd, a company registered in England and Wales.

Johal Architectural Fabrications Ltd acts as the data controller for the personal information it collects and processes in connection with its business activities.

Company details:

Johal Architectural Fabrications Ltd trading as Elite Shop Fronts

Unit 8 Orwell Close
Marsh Way
Rainham
Essex
United Kingdom
RM13 8UB

Company registration number: 07075544

For the purposes of this policy, "we", "us" and "our" refer to Johal Architectural Fabrications Ltd trading as Elite Shop Fronts.

3. Data Protection Legislation

We aim to comply with all applicable UK data protection and privacy legislation, including:

UK General Data Protection Regulation (UK GDPR).
Data Protection Act 2018.
Privacy and Electronic Communications Regulations 2003 (PECR), as amended.
Other applicable data protection and privacy requirements.

We review our data protection practices when legislation, regulatory guidance or our business processes change.

4. What Personal Data We Collect

We may collect and process personal information relating to customers, prospective customers, suppliers, contractors, business contacts and website visitors.

The information we collect may include:

Personal identification information

Full name.
Business name.
Job title.
Business or correspondence address.

Contact information

Email address.
Telephone number.
Postal address.

Customer and project information

Enquiry details.
Quotation requests.
Project specifications.
Property and installation addresses.
Measurements and technical drawings.
Photographs and supporting documents.
Contract and order information.
Customer correspondence.

Financial and transaction information

Invoice details.
Payment records.
Transaction references.
Billing information.

We do not intentionally collect more personal information than is reasonably necessary for our business purposes.

5. Data Protection Principles

We follow the seven fundamental data protection principles established under UK GDPR.

5.1 Lawfulness, Fairness and Transparency

We process personal information lawfully, fairly and transparently.

Individuals should understand why we collect their information, how we use it and who may receive it.

We provide privacy information to explain our data processing activities.

5.2 Purpose Limitation

We collect personal information for specified, explicit and legitimate business purposes.

We do not use personal information for unrelated purposes unless the additional processing is lawful and compatible with the original purpose.

5.3 Data Minimisation

We only collect personal information that is adequate, relevant and necessary for the purpose for which it is processed.

We avoid collecting unnecessary personal information.

5.4 Accuracy

We take reasonable steps to ensure that personal information is accurate and kept up to date.

Where information is inaccurate or incomplete, we will take appropriate steps to correct or update it.

5.5 Storage Limitation

We retain personal information only for as long as necessary for the purposes for which it was collected.

When information is no longer required, we securely delete or anonymise it unless a legal obligation requires us to retain it.

5.6 Integrity and Confidentiality

We use appropriate technical and organisational security measures to protect personal information against unauthorised access, accidental loss, destruction, damage or disclosure.

5.7 Accountability

We take responsibility for complying with data protection legislation and maintaining appropriate records and procedures to demonstrate our compliance.

6. Lawful Bases for Processing Personal Data

We only process personal information where we have a valid lawful basis under UK GDPR.

Depending on the circumstances, we may rely on the following lawful bases.

Consent

We may process personal information where an individual has given clear consent for a specific purpose.

Consent must be freely given, specific, informed and unambiguous.

Individuals can withdraw their consent at any time.

Contractual necessity

We may process personal information where necessary to enter into or fulfil a contract.

This includes responding to quotation requests, managing orders, arranging installations and delivering agreed services.

Legal obligation

We may process personal information where necessary to comply with legal requirements.

This includes accounting, taxation, financial record-keeping and regulatory obligations.

Legitimate interests

We may process personal information where necessary for our legitimate business interests, provided these interests do not override the rights and freedoms of the individuals concerned.

Examples include managing business enquiries, maintaining customer relationships, improving services, protecting our website and preventing fraud.

Where we rely on legitimate interests, we consider the potential impact on individuals and their privacy rights.

7. How We Use Personal Data

We may use personal information for the following purposes:

Responding to customer enquiries.
Preparing quotations and estimates.
Managing customer relationships.
Arranging site surveys and installations.
Providing shop front fabrication and installation services.
Managing orders and contracts.
Processing invoices and payments.
Communicating with customers and suppliers.
Managing complaints and disputes.
Maintaining business and financial records.
Improving website performance and functionality.
Protecting business systems and information.
Meeting legal and regulatory obligations.

We will not knowingly use personal information in a way that is incompatible with the purposes for which it was collected.

8. Sharing Personal Data

We do not sell or rent personal information to third parties.

We may share personal information with trusted service providers and other organisations where necessary for legitimate business purposes.

These may include:

Website hosting and maintenance providers.
IT support and security providers.
Email and communication providers.
Accountants and financial advisers.
Payment service providers, where applicable.
Suppliers and subcontractors involved in delivering projects.
Professional advisers.
Government departments, regulators and law enforcement authorities where legally required.

Where a third party processes personal information on our behalf, we will take appropriate steps to ensure that suitable data protection arrangements are in place.

We only share the information necessary for the relevant purpose.

9. Data Security

We take appropriate technical and organisational measures to protect personal information.

These measures may include:

Restricting access to personal information.
Using secure passwords and authentication methods.
Maintaining appropriate website and system security.
Using reputable service providers.
Protecting business devices and systems.
Keeping software and security measures updated.
Securely disposing of information that is no longer required.
Taking reasonable steps to prevent unauthorised disclosure.

Access to personal information should only be available to individuals who need it for legitimate business purposes.

We regularly consider whether our security arrangements remain appropriate for the type and volume of personal information we process.

10. Data Retention

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected.

Retention periods depend on the nature of the information and our legal, contractual and business obligations.

Examples include:

Customer enquiries: Retained for as long as necessary to manage and respond to the enquiry.
Quotation records: Retained for an appropriate period to manage proposed work and related business records.
Customer and project records: Retained where necessary to manage contracts, warranties, disputes and legal obligations.
Financial and accounting records: Retained in accordance with applicable statutory requirements.
Website information: Retained for periods appropriate to website administration, security and analytics.

Where information is no longer required, we will securely delete or anonymise it.

11. International Data Transfers

Some of our third-party service providers may store or process personal information outside the United Kingdom.

Where personal data is transferred internationally, we will ensure that the transfer complies with UK data protection legislation.

Appropriate safeguards may include:

UK adequacy regulations.
The UK International Data Transfer Agreement.
The UK Addendum to the EU Standard Contractual Clauses.
Other legally recognised transfer safeguards.

12. Individual Data Protection Rights

Under UK GDPR, individuals have several rights concerning their personal information.

These rights include:

Right of access

Individuals can request access to the personal information we hold about them.

Right to rectification

Individuals can request that inaccurate or incomplete personal information is corrected.

Right to erasure

Individuals can request the deletion of personal information where the legal conditions for erasure are met.

Right to restrict processing

Individuals can request restrictions on how their personal information is processed in certain circumstances.

Right to data portability

Individuals can request certain personal information in a structured, commonly used and machine-readable format where the right applies.

Right to object

Individuals can object to certain types of processing, including processing based on legitimate interests and direct marketing.

Rights relating to automated decision-making

Individuals have rights in relation to certain solely automated decisions that produce legal or similarly significant effects, where the relevant legal conditions apply.

We do not intend to make solely automated decisions with legal or similarly significant effects as part of our ordinary website enquiry and project processes.

Right to withdraw consent

Where processing is based on consent, individuals can withdraw that consent at any time.

These rights are subject to certain legal conditions and exemptions.

13. Handling Data Subject Access Requests

Individuals can contact us to request access to their personal information or exercise their data protection rights.

We will:

Record the request and the date it was received.
Identify the nature of the request.
Verify the identity of the individual where reasonably necessary.
Locate the relevant personal information.
Assess whether any legal exemptions apply.
Respond within the applicable statutory timeframe.

We will normally respond within one month of receiving a valid request.

Where a request is particularly complex or multiple requests have been received, the response period may be extended by up to a further two months where permitted by law.

We will explain any applicable extension.

Requests are generally handled free of charge. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.

14. Personal Data Breaches

A personal data breach occurs when personal information is accidentally or unlawfully lost, destroyed, altered, disclosed or accessed without authorisation.

Examples include:

Sending personal information to the wrong recipient.
Losing a device containing personal information.
Unauthorised access to business systems.
Accidental disclosure of customer records.
Cyberattacks resulting in personal data exposure.
Theft of documents containing personal information.

If we become aware of a personal data breach, we will take appropriate steps to:

Investigate the incident.
Contain the breach and prevent further unauthorised access.
Assess the potential risks to affected individuals.
Recover or secure affected information where possible.
Record the incident and actions taken.
Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach where the breach is likely to result in a risk to individuals' rights and freedoms.
Inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

We will comply with applicable breach notification requirements under UK GDPR.

15. Cookies and Website Tracking

Our website may use cookies and similar technologies to support website functionality, analyse visitor activity and improve the user experience.

Cookies may collect technical information such as:

IP addresses.
Browser information.
Device information.
Website usage data.
Visitor preferences.

We will obtain consent before using non-essential cookies where required by PECR and applicable data protection legislation.

Visitors can manage their cookie preferences through the website's cookie consent mechanism, where available.

Further information is provided in our Privacy Policy.

16. Direct Marketing

We may use personal information to communicate with customers and prospective customers about our services where we have a lawful basis.

Any direct marketing activity will comply with applicable data protection and electronic marketing legislation.

Where consent is required, we will obtain it before sending marketing communications.

Individuals can object to direct marketing or withdraw their consent at any time.

We will respect marketing opt-out requests and maintain appropriate records to ensure that individuals who have opted out are not contacted for direct marketing purposes.

17. Children's Personal Data

Our services and website are intended primarily for commercial customers, property owners, businesses and adults.

We do not knowingly collect children's personal information for marketing or commercial purposes.

If we become aware that children's personal information has been collected without an appropriate lawful basis, we will take reasonable steps to address the situation.

18. Third-Party Data Processors

Where we use external organisations to process personal information on our behalf, we will take reasonable steps to ensure they provide appropriate data protection guarantees.

Where required by law, we will have written data processing agreements in place.

These agreements will address matters such as:

The purpose and duration of processing.
The types of personal information processed.
Confidentiality obligations.
Appropriate security measures.
Assistance with individual data protection requests.
Personal data breach reporting.
Data deletion or return arrangements.
Restrictions on appointing further processors.

We remain responsible for ensuring that our use of data processors complies with applicable data protection requirements.

19. Data Protection Responsibilities

Johal Architectural Fabrications Ltd is responsible for overseeing the personal information processed through its business activities.

Anyone authorised to access personal information must:

Handle information confidentially.
Use personal information only for legitimate business purposes.
Avoid unnecessary collection or disclosure.
Keep information secure.
Report suspected data breaches promptly.
Follow applicable data protection procedures.
Respect individuals' privacy rights.

We will take reasonable steps to ensure that individuals with access to personal information understand their responsibilities.

20. Data Protection Impact Assessments

Where a proposed processing activity is likely to result in a high risk to individuals' rights and freedoms, we will consider whether a Data Protection Impact Assessment (DPIA) is required.

Where necessary, the assessment will identify potential privacy risks and appropriate measures to reduce those risks.

21. International and Regulatory Compliance

We aim to maintain data protection arrangements that reflect applicable legal requirements and relevant regulatory guidance.

Where our business activities or service providers change, we will review the potential impact on personal information and update our procedures where necessary.

22. Complaints and Concerns

If an individual has concerns about how we collect, use or protect personal information, they can contact us directly.

We will review complaints and aim to resolve them promptly.

Individuals also have the right to complain to the Information Commissioner's Office (ICO).

Information Commissioner's Office

Website: https://ico.org.uk/
Telephone: 0303 123 1113

The ICO is the UK's independent regulator responsible for upholding information rights and data protection standards.

23. Policy Review and Updates

We may review and update this GDPR and Data Protection Policy periodically to reflect changes in legislation, regulatory guidance, our business activities or our data processing arrangements.

The latest version will be published on our website with an updated revision date.

We recommend reviewing this policy periodically to remain informed about how we manage and protect personal information.

24. Contact Information

For questions about this policy, personal information or your data protection rights, please contact us.

Johal Architectural Fabrications Ltd trading as Elite Shop Fronts