Privacy Policy
This Privacy Policy explains how T40 Renovations Ltd ("T40 Renovations", "we", "us", "our") collects, uses, stores and protects personal data when you visit our website t40renovations.com, submit one of our forms, or contact us about a bathroom renovation.
1. Who we are (Data Controller)
The data controller for any personal data you share with us is:
- Company name: T40 Renovations Ltd
- Company number: 16317497 (Companies House, England and Wales)
- Registered address: 56 Esthwaite Avenue, St Helens, WA11 7HQ, United Kingdom
- Contact email: contact@t40renovations.com
- Data protection enquiries: mark the email "Data protection" in the subject line — see section 11 below.
- Phone / WhatsApp: 07979 479709
- ICO registration number: ZC127252
2. What personal data we collect
Depending on how you interact with us, we collect some or all of the following:
2.1 Information you give us through our forms
We operate three forms on our website:
- Bathroom Planner — for free quote estimates based on your requirements.
- Get a Quote — for requesting a detailed quote and free home visit.
- Contact Us — for general enquiries.
Across these forms we may collect:
- Name and, where given, last name
- Email address
- Phone number
- Postcode and house number / address
- Bathroom size (in m²), preferred package, timeframe
- Any notes, photos, or free-text details you voluntarily include
- The subject of your enquiry and where you found us (lead source)
2.2 Information we collect automatically
- Basic technical data when you visit our site: IP address, browser type and version, device type, pages viewed, referring URL, and approximate location (country / region). This is used for security, analytics and to improve the site — see section 8 on cookies.
- When you open our marketing emails, our email platform (MailerLite) records whether the email was opened and whether links were clicked, so we can tell which content is useful.
2.3 Information from third parties
- If you message us through Facebook, Instagram, TikTok, Google Business Profile or WhatsApp, we receive the information those platforms pass to us (typically your name/handle and the content of your message). Your use of those platforms is governed by their own privacy policies.
3. Why we use your data and our legal basis
Under the UK GDPR we must have a "lawful basis" for every use of your personal data. Ours are:
| What we do | Why | Lawful basis |
|---|---|---|
| Respond to your enquiry, give you a quote, arrange a home visit, and carry out the renovation work | To deliver the service you have asked for | Contract (Article 6(1)(b) UK GDPR) or steps taken at your request before entering a contract |
| Send you a short sequence of follow-up emails after you submit a form (e.g. confirmation, reminder, case study) | To complete the conversation you started with us | Legitimate interests (Article 6(1)(f)) — responding to your enquiry is a reasonable expected use of your email. You can opt out at any time using the unsubscribe link in every email. |
| Send occasional marketing emails about new services, offers or project examples | To keep existing and interested customers informed | Consent (Article 6(1)(a)) captured at the point you give us your email, plus a clear unsubscribe link on every message. For previous customers who have had a renovation with us, we may also use the "soft opt-in" under PECR to send information about similar services, always with an easy opt-out. |
| Send you occasional WhatsApp updates (offers, seasonal content) | Marketing | Consent (Article 6(1)(a)) — opt-in when you share your number specifically for this purpose — or the "soft opt-in" under PECR for existing customers for similar services, with an easy "STOP" opt-out on every message. |
| Keep records of quotes, invoices and completed work | Accounting, tax and warranty obligations | Legal obligation (Article 6(1)(c)) and legitimate interests |
| Show before / after photos or videos of completed work | Marketing the quality of our work | We do this only with your specific consent (Article 6(1)(a)). Photo consent is captured through a separate opt-in on your renovation contract (Section 12a of our Terms & Conditions). You may withdraw consent at any time — we will stop using your images in new publications but cannot retract posts already made public. |
| Protect the website from fraud, spam and abuse (honeypot, logs) | Security | Legitimate interests (Article 6(1)(f)) |
4. Who we share your data with
We do not sell your personal data. We share it only with the following categories of recipients, all acting as our data processors under contract:
| Recipient | Purpose | Location |
|---|---|---|
| MailerLite (UAB "MailerLite") | Storing your contact details and sending automated follow-up and marketing emails | European Union (Lithuania). See MailerLite Privacy Policy. |
| GoDaddy.com, LLC / GoDaddy Europe GmbH (WordPress hosting) | Hosting the website and storing form submissions before they are passed to MailerLite | EU (Germany, via GoDaddy Europe) and/or US (with UK–US Data Bridge safeguards) |
| Meta Platforms Inc. (Facebook / Instagram) and TikTok Technology Ltd | Only if you contact us through these platforms, or if we run advertising — see section 8 on cookies | EU / US (see transfer mechanisms below) |
| Google LLC (Google Business Profile, and Google Analytics if enabled) | Customer reviews and website analytics | EU / US (see transfer mechanisms below) |
| Our accountant and bookkeeping software | Invoicing, tax and accounting | UK |
| Legal or regulatory authorities | Only where required by law (e.g. HMRC, court order) | UK |
4.1 International transfers
We transfer personal data outside the United Kingdom only where an adequate safeguard applies:
- To the European Economic Area (e.g. MailerLite in Lithuania, GoDaddy EU in Germany): the UK recognises the EEA as providing an adequate level of data protection until at least December 2031.
- To the United States: we rely on the UK–US Data Bridge (UK Extension to the EU–US Data Privacy Framework) where the recipient is self-certified under that framework (e.g. Meta Platforms Inc., Google LLC).
- Where neither of the above applies (e.g. messages via TikTok), we use the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
5. How long we keep your data
| Type of data | Retention period |
|---|---|
| Form submissions that do not result in a quote | Up to 12 months from last contact, then deleted |
| Marketing contact details in MailerLite | Until you unsubscribe, or until 24 months of no engagement (opens / clicks), whichever comes first |
| WhatsApp conversation history | Retained on T40's device for the duration of the customer relationship + 24 months, then deleted. WhatsApp itself retains metadata per its own policy. |
| Customer records (quotes, contracts, invoices, warranty documents) | 6 years after the end of the financial year in which the work was completed, in line with HMRC record-keeping requirements |
| Before / after photos and videos of your home | Only used in marketing with your consent; you may withdraw consent at any time and we will remove identifiable images from future publications |
| Website server logs | Up to 90 days |
6. Your rights
Under the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) you have the following rights in relation to your personal data:
- Right to be informed — this notice tells you how we use your data.
- Right of access — you can ask for a copy of the personal data we hold about you.
- Right to rectification — ask us to correct anything that is wrong or incomplete.
- Right to erasure ("right to be forgotten") — ask us to delete your data in certain circumstances.
- Right to restrict processing — ask us to pause using your data while we sort out a concern.
- Right to data portability — ask for your data in a commonly used machine-readable format.
- Right to object — in particular to direct marketing and to processing based on legitimate interests.
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time.
- Rights in relation to automated decision-making — we do not use automated decision-making or profiling that has legal or similarly significant effects.
To exercise any of these rights, email contact@t40renovations.com. We will respond within one calendar month. There is no charge.
7. How we keep your data safe
We take reasonable technical and organisational measures to protect your data, including:
- TLS / HTTPS encryption on our website and all form submissions.
- Limiting access to your data to the people who actually need it (currently the founder of T40 Renovations and, where relevant, our accountant).
- Using reputable processors (MailerLite, GoDaddy hosting, our accounting software) who maintain their own recognised security standards.
- A honeypot field and server-side validation on our forms to reduce spam and abuse.
8. Cookies and similar technologies
Our website uses cookies and similar technologies. A cookie is a small text file stored on your device that helps a site work properly or understand how it is used.
8.1 Categories of cookies we use
| Category | Purpose | Consent required? |
|---|---|---|
| Strictly necessary | Make the site work — e.g. remembering your cookie choice, keeping forms secure against spam | No (PECR Regulation 6(4) exemption) |
| Analytics / statistical (if enabled) | Measure aggregated visitor numbers and improve the site | Where these are first-party and used solely for that purpose, UK law (Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025) exempts them from consent. You will still be told they are running and offered a simple way to object. If we use third-party analytics that share data with the provider for their own purposes (e.g. Google Analytics 4), we will ask for your prior consent through the cookie banner. |
| Marketing / advertising (if enabled) | Meta Pixel, TikTok Pixel or Google Ads tags — used to measure the effectiveness of adverts and to show you relevant adverts on other sites | Yes — we will only set these cookies after you give explicit consent via the cookie banner. |
8.2 Managing cookies
When you first visit our site you will see a cookie banner where you can accept all, reject non-essential cookies, or change your choices at any time via the "Cookie settings" link in the footer. You can also block or delete cookies in your browser settings — see aboutcookies.org for instructions.
9. Children's data
Our services are aimed at homeowners and our marketing is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted personal data to us, please contact us and we will delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in the law or in our practices. When we do, we will update the "Last updated" date at the top. For significant changes we will also highlight the update on our homepage or, where appropriate, notify you by email.
11. Contact us
If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:
- Email: contact@t40renovations.com (for data-protection requests, please mark the email "Data protection" in the subject line)
- Phone / WhatsApp: 07979 479709
- Post: T40 Renovations Ltd, 56 Esthwaite Avenue, St Helens, WA11 7HQ
11a. How to complain
If you are not happy with how we have handled your data, please contact us first so we can try to put things right. Under the Data (Use and Access) Act 2025, you have a right to complain directly to us before going to the regulator.
- How to complain: email contact@t40renovations.com, or write to T40 Renovations Ltd, 56 Esthwaite Avenue, St Helens, WA11 7HQ.
- Acknowledgement: we will acknowledge your complaint within 5 working days.
- Full response: we will respond in full within one calendar month. If your complaint is complex we may extend this by up to two further months, and we will let you know within the first month if we need to.
You also have the right to complain to the UK's supervisory authority:
- Information Commissioner's Office (ICO)
- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Helpline: 0303 123 1113
- Website: ico.org.uk/make-a-complaint
Version history
- v1.0 — 23 April 2026 — First published.