JPT Privacy Notice

Version 1.1 | Effective date: 12 September 2026 |

1 Who we are and what this policy covers

JPT BUILDING & PROPERTY SERVICES LTD (we, us or our) provides property maintenance and multi-trade services. We are the controller responsible for deciding how the personal information described in this policy is used. We handle it under the UK GDPR and the Data Protection Act 2018, as amended, and applicable electronic privacy rules.

This policy covers customers and prospective customers, landlords, tenants and other occupiers, property managers, website enquirers, suppliers, subcontractors and their business contacts. It explains what we collect, why we use it and your rights. It does not replace separate staff or recruitment privacy information.

Trading name: JPT BUILDING & PROPERTY SERVICES
Company number: 17441427
Registered office: 28 Hawthorn Road, Ripley, Woking, England GU23 6LH
ICO registration reference: ZC246275

Privacy contact: Daniel Lilley | daniel.lilley@jptpropertyservices.uk

2 What data we collect

We collect only information relevant to the enquiry, job or business relationship. Depending on our dealings with you, this includes:

·        Identity and contact details: name, address, email, telephone number, business name, role and preferred contact method.

·        Property and access information: job address, ownership or management contact, occupier details, appointment times, access instructions, key or alarm arrangements and relevant site hazards.

·        Job records: enquiries, measurements, specifications, quotations, agreed work, materials, schedules, progress notes, relevant photographs, completion records, guarantees and complaints.

·        Financial and supplier records: invoices, cash receipts, bank payment references, payment status, supplier bank details, relevant qualifications and insurance information, and tax or CIS details where required.

·        Communications and preferences: emails, messages, call notes, feedback, marketing choices and consent records. Website information may include IP address, browser details and pages visited, depending on the technologies described in section 10.

3 How we collect your data

You provide information when you contact us by telephone, email, messaging, social media, our website or in person; request a quote; arrange a visit; instruct or discuss work; pay an invoice; or supply services to us. We also create records during site visits and while completing jobs.

We may receive relevant contact, property and job information from landlords, letting agents, property managers, customers, suppliers, subcontractors and people referring an enquiry. Banks and payment providers supply transaction information. Where relevant, we check public business registers or trade accreditation records.

Where another person supplies your information, we normally provide this policy at our first contact and no later than one month after obtaining it, or before first disclosure if earlier, unless a lawful exception applies. You can ask us where your information came from.

4 How we use your data and our lawful bases

We identify a lawful basis for each use. Contract applies where you personally are party to the contract, or ask us to take steps before entering it. For tenants and contacts acting for another customer or supplier, we generally rely on legitimate interests instead. These interests are subject to a balancing assessment against your rights.

Enquiries quotes and work

We use contact, property, access and job details to answer enquiries, assess work, prepare quotes, arrange visits, coordinate trades, provide services and deal with defects or guarantees. Our basis is contract for individual customers, or legitimate interests in responding to enquiries and delivering and coordinating services for business customers, landlords and occupiers.

Payments suppliers and business administration

We use order, invoice and payment information to bill customers, record cash or other payments, pay suppliers and manage accounts. Our basis is contract where applicable, or legitimate interests in administering business relationships. We use relevant records to meet tax, accounting and applicable CIS obligations on the basis of legal obligation.

Safety disputes and protection of the business

We use necessary site, communication and transaction records to work safely, investigate complaints, recover debts, prevent fraud and establish or defend claims. Our basis is legitimate interests in protecting people, property and our business, or legal obligation where a specific safety or disclosure duty applies.

Optional uses and information you need to provide

Marketing and optional website tracking are explained in sections 8 and 10. Necessary website security logs rely on legitimate interests in protecting our website; optional tracking that needs consent relies on consent. We seek separate consent before publishing identifiable customer testimonials or job photographs for promotion. Refusing this does not affect your service. We avoid recording people, private possessions or security details in job photographs unless necessary.

If you do not provide information needed to assess, access, carry out or invoice work, we may be unable to quote or provide the service. We explain what is needed at the time. Before using information for a new purpose, we will explain that purpose and the lawful basis.

5 Who we share your data with

We share only information needed for the relevant task or legal requirement. Depending on the job, recipients may include:

·        Subcontractors and specialist trades carrying out work, and suppliers arranging deliveries. They receive only necessary job, contact and access details.

·        The instructing customer, landlord, letting agent or property manager, where necessary to arrange access, authorise repairs, report progress or evidence completion. We limit any occupier information included.

·        Banks, payment providers, accountants and bookkeepers supporting payments, accounts and tax compliance; insurers and legal advisers dealing with cover, complaints or claims.

·        Providers of email, messaging, website hosting, online enquiries, job management, document storage, backup, accounting and IT support, where we use those services.

·        HMRC, courts, regulators or law enforcement where disclosure is required by law or otherwise lawful and necessary.

Service providers processing information on our instructions are subject to appropriate data processing terms. Some recipients, such as banks, professional advisers or independent contractors, may act as separate controllers for their own purposes and provide their own privacy information.

We do not sell personal information or share customer lists with other businesses for their own marketing.

6 How we store and protect your data

We use safeguards proportionate to the information and the risks, and limit access to people who need it for their work. Property access information is particularly sensitive and is shared only with authorised people who need it for the job.

We respond to suspected personal data breaches and notify the regulator and affected people where the law requires. No storage or transmission method can be guaranteed completely secure.

Information processed outside the UK

Where we make a restricted transfer, it must be covered by UK adequacy regulations, appropriate safeguards or another lawful transfer mechanism. Where required, we assess the protection provided and put additional measures in place. You can contact us for information about the applicable safeguards or a copy, with confidential information redacted where necessary.

7 How long we keep your data

We retain personal information only for as long as needed for its purpose, taking account of legal duties, guarantees, disputes and applicable claim periods. The periods below run from the stated event. We review records and delete, securely destroy or anonymise them when no longer needed.

Record type

Enquiries and unsuccessful quotes

6 months after the last substantive contact or quotation expiry, whichever is later, unless a continuing enquiry or dispute justifies longer retention.

Customer contracts and core job records

Normally 6 years after completion or termination. We retain relevant records longer where needed for a continuing guarantee, applicable building-related or other claim period, legal duty or insurer requirement. We review the need for longer retention and limit it to relevant records.

Accounting tax and payment records

Normally 6 years from the end of the last company financial year they relate to; longer where legally required.

Tenant contacts and access codes

Keep operational contact details only while needed to arrange access or continuing maintenance. Remove obsolete access codes and unnecessary security instructions promptly. Necessary contact information in core job records follows the core job-record period.

Job photographs and site notes

Keep photographs and notes needed to evidence the work, defects or guarantees with the core job records, normally for 6 years after completion and longer only for the reasons above. Delete duplicates, unnecessary images and incidental personal details sooner.

Supplier and subcontractor records

Core contracts, work, qualification and insurance evidence: normally 6 years after the relationship or relevant work ends, whichever is later; longer where needed for legal, claim or insurer requirements. Tax and payment records follow the accounting rule. Delete obsolete routine contact details sooner.

Complaints insurance and claims

Normally 6 years after final resolution or closure, whichever is later. Retain relevant records longer where necessary for continuing proceedings, applicable claim periods, legal duties or insurer requirements. Review records and remove unnecessary personal information.

Marketing consent and opt outs

Review active marketing records at least every 6 months and remove contacts when marketing is no longer justified. Keep consent or soft-opt-in evidence while relying on it and afterwards only as needed to demonstrate compliance or address a complaint. Keep minimal suppression details for as long as needed to honour an opt out.

Website logs cookies and backups

Keep security logs only as long as needed to detect and investigate security events, taking account of their sensitivity and system risks. Cookie durations are stated in section 10 or linked cookie information. Deleted records leave backups through the normal documented replacement cycle; pending removal they remain protected and are not used routinely. If a backup is restored, relevant deletions are reapplied.

A relevant complaint, investigation or legal claim may require us to preserve specific records beyond the normal period. Such records are restricted to that purpose and reviewed. Data awaiting removal from backups is protected and is not used for routine business purposes.

8 Marketing

For marketing by email, text or direct message to individuals, including sole traders and some partnerships, we use consent unless the customer soft opt-in applies. We use that exception only where we obtained your details directly during a sale or negotiations, promote our own similar services, and offered a clear, free opt out when collecting your details and in every message. Our UK GDPR basis is consent or, for the soft opt-in, legitimate interests in promoting relevant services.

You can stop direct marketing at any time by using the unsubscribe option or contacting us. We keep a minimal record of your opt out. Consent can be withdrawn without affecting earlier lawful use. Essential quote, appointment, job and payment messages are service communications and continue where needed.

9 What are your data protection rights

Depending on the circumstances and our lawful basis, you have the following rights:

·        Access: ask for a copy of your personal information and information about how we use it.

·        Rectification: ask us to correct inaccurate information or complete incomplete information.

·        Erasure: ask us to delete information in certain circumstances. This does not always apply where we must retain it for legal obligations or claims.

·        Restriction: ask us to limit how we use information in certain circumstances, for example while its accuracy is checked.

·        Objection: object, for reasons connected with your situation, to processing based on legitimate interests. We must stop unless we demonstrate overriding compelling legitimate grounds or need the information for legal claims. You have an absolute right to object to direct marketing.

·        Portability: where processing is automated and based on consent or contract, ask to receive information you provided in a structured, commonly used, machine-readable format, or for transfer to another controller where technically feasible.

·        Withdrawal of consent: withdraw consent at any time where we rely on it. This does not affect the lawfulness of processing before withdrawal.

Contact us using section 13 to exercise a right; you do not need to use a special form or legal wording. We may ask for proportionate information to verify your identity or an authorised representative. We normally respond without undue delay and within one calendar month. Where the law permits an extension for complex or multiple requests, we may take up to two further months and will explain this within the initial month. We will explain any lawful timing adjustment, such as necessary identity checks or clarification of an access request.

Requests are normally free. A reasonable fee or refusal is permitted only in limited circumstances, such as a manifestly unfounded or excessive request; a fee may also apply to extra copies. If we cannot comply fully, we explain why and tell you about complaint and court remedies.

Automated decisions

We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

Sensitive personal information

Please avoid sending health details or other sensitive information unless necessary. We aim to record practical access needs without recording diagnoses. If sensitive information is necessary, we explain the purpose and identify both a lawful basis and an additional condition for special category data, such as explicit consent or necessity for legal claims, as applicable.

10 Cookies and our website

Cookies and similar technologies store information on, or access information from, your device.

Where consent is required, we ask for it before placing or accessing the technology. You can reject optional technologies and withdraw consent as easily as giving it. We do not treat continued browsing as consent. Technologies that meet a legal exception may operate without consent; we explain any applicable exception and provide a way to object where required.

You can also delete or block cookies using your browser settings. Blocking cookies needed for a requested feature may prevent that feature from working.

11 Privacy policies of other websites

If our website or messages link to another organisation, its privacy information explains its own processing. Read that information before supplying personal details. Our responsibility for information we collect or disclose remains as described in this policy.

12 Changes to our privacy policy

We review this policy when our services, systems or legal requirements change. We publish the latest version at [POLICY URL OR OTHER LOCATION] and make a copy available on request. We draw material changes to your attention where appropriate. The effective and last updated dates appear at the start.

13 How to contact us

For questions, rights requests or privacy complaints, contact Daniel Lilley at:
Email: daniel.lilley@jptpropertyservices.uk
Telephone: 07471 196 747
Post: 28 Hawthorn Road, Ripley, Woking, England GU23 6LH

14 Complaints and the ICO

You can complain to us by email, telephone or post using the details above. We acknowledge ICO privacy complaints within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. This complaints process does not replace the separate deadlines for rights requests.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at any time. The ICO recommends giving us an opportunity to resolve the issue first. Visit https://ico.org.uk/make-a-complaint/ for the current complaint routes.