Privacy Policy

This privacy policy explains how CGS Construction handles personal data collected through this website. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

Who we are

CGS Construction is a construction company registered in England & Wales (company number 11420578). Our registered office is Enterprise House, Maxted Road, Hemel Hempstead, HP2 7BT, United Kingdom. For the purposes of UK GDPR, CGS Construction is the data controller for personal data processed through this website.

You can contact us about anything in this policy at administrator@cgs-construction.com, by phone on +44 01442 914366, or by post at the address above.

What personal data we collect

We only collect personal data that you actively give us. The website does not use tracking cookies, advertising pixels, or behavioural profiling tools.

When you submit our contact form, we collect:

• Your first and last name
• Your email address
• Your phone number (optional)
• The contents of your message
• Your consent to be contacted about your enquiry

Our hosting provider records standard server logs (IP address, request URL, timestamp, user agent) for security and operational purposes. These logs are retained for a short period and not linked to other personal data.

How we use your data

We use the data you submit through the contact form solely to respond to your enquiry and, where it leads to a project, to manage that project. We do not use it for marketing, do not share it with unrelated third parties, and do not sell it under any circumstances.

Lawful basis

Our lawful bases under UK GDPR Article 6 are:

• Article 6(1)(b) — performance of a contract, or steps taken at your request prior to entering a contract. This applies when you contact us about a specific project.
• Article 6(1)(f) — legitimate interests, where you contact us with a general enquiry. Our interest is in responding to potential clients and partners. You can object to processing on this basis at any time; see "Your rights" below.

How long we keep your data

We retain enquiry records for as long as is necessary to respond to your enquiry and for a reasonable period afterwards in case of follow-up questions. Where an enquiry leads to a project, the relevant correspondence is retained for the duration of the project plus six years for legal and accounting purposes (this aligns with the statutory limitation period under the Limitation Act 1980).

Enquiries that do not progress to a project are reviewed periodically and deleted when no longer needed.

Who processes your data on our behalf

We use a small number of carefully chosen suppliers (data processors) to operate this website and respond to enquiries. Each is bound by data-processing terms and only processes your data on our instructions.

• Vercel Inc. hosts this website and operates the contact form endpoint. Vercel may process server logs in the United States. Vercel relies on the UK Data Bridge / EU-US Data Privacy Framework for transfers from the UK.
• Resend, Inc. delivers email from the contact form to our inbox. Resend processes email content and metadata in the United States, also under the EU-US Data Privacy Framework.
• Plausible Insights OÜ provides aggregate, anonymous analytics about site traffic. Plausible does not collect personal data, does not set cookies, and does not transfer data outside the European Economic Area. See our Cookie Policy for detail.

International transfers

Some of our processors are based in the United States. Where this is the case, transfers are made under the UK Data Bridge to the EU-US Data Privacy Framework or equivalent appropriate safeguards under UK GDPR Articles 45–47. We are happy to provide further detail on request.

Your rights

Under UK GDPR you have the right to:

• Be informed about how your data is used (this policy)
• Access the personal data we hold about you (Article 15)
• Have inaccurate data corrected (Article 16)
• Have your data deleted, where applicable (Article 17, "right to be forgotten")
• Restrict processing in certain circumstances (Article 18)
• Receive your data in a portable format (Article 20)
• Object to processing based on legitimate interests (Article 21)
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us using the details at the top of this policy. We will respond within one calendar month, in line with UK GDPR requirements.

Complaints

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator. The ICO can be contacted at ico.org.uk, by phone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would appreciate the chance to address your concerns first.

Cookies and analytics

This website uses Plausible — a privacy-first analytics service that does not set cookies or collect personal data. We do not run Google Analytics, advertising pixels, or any other behavioural tracking. Full detail is in our Cookie Policy.

Security

The website is served over HTTPS. The contact form endpoint validates and escapes submitted data, applies a honeypot field to deter automated abuse, and delivers messages over an authenticated API. Personal data is held only on systems with industry-standard access controls.

Changes to this policy

We may update this policy from time to time — for example, when we change a processor or when the law changes. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be highlighted in this section.