This notice explains how personal information is handled when you visit the Archex Build website or contact us about a building project. It covers the UK GDPR, the Data Protection Act 2018 and applicable Privacy and Electronic Communications Regulations (PECR), as amended.
Planned Google services
Google Analytics, Google Tag Manager and Google Search Console are planned services. Analytics and Tag Manager are not currently installed on this website. We will update this notice and provide the required privacy choices before activating optional tracking.
1. Who is responsible for your information?
Estera Franczewska is the data controller for personal information processed through the Archex Build website. In this notice, “we”, “us” and “our” refer to the controller responsible for this website.
For privacy questions, requests to exercise your rights or data protection complaints, use the email address below. You do not need to use a particular form.
2. Information we collect
- Enquiries: your name, email, telephone number, postcode, project types, drawings status, intended timing and budget, preferred consultation method, and any project details or correspondence you provide.
- Technical and security information: IP address, browser/device information, request times, security-check results, enquiry references and delivery status. Our service providers may process connection and operational logs.
- Optional analytics, if activated with the required permission: pages viewed, interactions, visit times, referral source, broad location, device/browser details and cookie-based identifiers.
We receive enquiry information directly from you, and technical information from your browser and our service providers. The website form does not accept file uploads. Please avoid sending identification documents, bank details, health information or unnecessary information about other people.
Fields marked with an asterisk are required to process the online form. Providing information is voluntary, but without sufficient contact and project details we may be unable to respond or prepare a quotation. You can also contact us directly.
3. Why we use information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Assessing a project and preparing a quotation you request as an individual. | Taking steps at your request before entering a contract — Article 6(1)(b). |
| Answering general or business enquiries and managing relevant correspondence. | Legitimate interests in responding to enquiries and managing business relationships — Article 6(1)(f). |
| Operating and protecting the website, preventing spam and investigating technical problems. | Legitimate interests in keeping our services secure and available — Article 6(1)(f). |
| Responding to data protection requests and complying with applicable legal duties. | Compliance with a legal obligation — Article 6(1)(c). |
| Optional website analytics, when introduced. | Your consent — Article 6(1)(a), alongside applicable PECR requirements. |
Where we rely on legitimate interests, we consider your interests, rights and reasonable expectations. You may object to that processing. Sending a project enquiry does not subscribe you to a marketing list or give consent to analytics.
4. Google Analytics, Tag Manager and Search Console
Google Analytics 4 is planned to help us understand which pages are useful and improve the website. Our intended approach is opt-in analytics: optional measurement will remain off until suitable consent controls are available and you choose to allow it. We will not treat continuing to browse as consent.
Google Tag Manager is planned to manage website tags. It is not itself a consent-management tool. Any analytics tags added through it must respect your choice. Google describes limited Tag Manager diagnostic data and HTTP request logs separately from the information collected by individual tags.
Google Search Console is planned for checking indexing and search performance, including impressions, clicks and search queries reported by Google. It is separate from visitor analytics and does not require us to install an Analytics tracking tag on your device.
Before activation we will describe the actual analytics configuration, cookie names and durations, data-retention settings and how to change or withdraw permission. No advertising or remarketing tags are included in the current website. Contact-form contents must not be sent to Google Analytics or the Tag Manager data layer.
6. Hosting, email, security and third parties
- Cloudflare is the intended website/backend and security provider. When the protected enquiry form is enabled, Turnstile processes technical signals such as IP address and browser information to distinguish visitors from bots. Cloudflare also describes its separate processing to improve its bot detection.
- Resend sends enquiry messages from the website to our business inboxes, and Hostinger Mail hosts our mailbox. Messages are routed to the business recipient; your email is used as the Reply-To address so that we can respond.
- Google Maps is embedded on the Contact page. When that map loads, your browser connects to Google and sends connection/device information, including your IP address. Google may use cookies or other storage under its own policies.
- Authorised people helping us operate the website or deal with your enquiry may access information they need for that task. We may disclose information when required by law or necessary to establish or defend legal claims.
Our use of the map does not imply that Google is prevented from receiving information before interaction. You can contact us by email without opening the Contact page. Links to Google reviews, Checkatrade and WhatsApp take you to separate services with their own privacy notices. We do not sell your enquiry details.
7. International processing
Our providers and their authorised subprocessors may process information outside the UK, including in the European Economic Area and the United States. The applicable arrangements depend on the service, contracting entity and account configuration.
Where we make a restricted international transfer, we must use an applicable UK adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, with any required assessment. You can contact us for information about the safeguards applying to your information or a copy, subject to necessary redactions.
8. How long information is kept
| Information | Retention period or criteria |
|---|---|
| Enquiry emails and correspondence | For the time needed to assess and answer the enquiry and handle related follow-up. If you commission work, relevant information becomes part of the project record. Longer retention must be justified by outstanding contractual, legal or dispute-related needs. |
| Form abuse-prevention and duplicate-send records | Active backend records have a maximum 24-hour lifetime. They contain references, keyed fingerprints, timestamps and status, rather than an archive of your enquiry. This does not delete emails already delivered to the mailbox. |
| Operational/security logs and provider backups | According to the applicable provider settings and the period needed to investigate faults, abuse or security incidents. Backup copies follow the provider's recovery/deletion cycle and are not used for routine marketing. |
| Google Analytics data, if introduced | The selected user/event-data retention period and cookie lifetimes will be disclosed before activation. Google's aggregated reports can follow different retention rules. |
We review whether information is still needed and delete or anonymise it when its purpose ends, unless a legal duty or active claim requires retention. Contact us if you need details about the retention criteria for a particular record.
9. Security and automated checks
We use proportionate technical and organisational safeguards, including encrypted connections, server-side validation, restricted credentials and spam/rate-limit checks. No system can guarantee absolute security.
Automated anti-spam checks may prevent a form submission, in which case you can contact us directly. We do not use this website to make solely automated decisions with legal or similarly significant effects, or to create advertising profiles.
10. Your data protection rights
Depending on the circumstances and lawful basis, you can request access to your personal information, correction, erasure, restriction, or a portable copy. You can object to processing based on legitimate interests. These rights are subject to the conditions and exemptions in applicable law.
Where processing relies on consent, you can withdraw it without affecting processing that was lawful before withdrawal. Optional analytics will need an accessible withdrawal control before it is activated.
Email us to make a request. We may ask for proportionate information to verify your identity. We normally respond without undue delay and within one month; where the law permits an extension or clarification, we will explain the reason and applicable timing. Requests are normally free.
11. Questions and complaints
You can raise a data protection complaint directly with Estera Franczewska at site@archexbuild.co.uk. Tell us what happened and how you would like us to respond; no special form is required. We will acknowledge your complaint within 30 days, investigate appropriately and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. Its website explains how to raise concerns with an organisation and escalate a complaint.
12. Children and changes to this notice
This website is intended for adults arranging building work. We do not knowingly seek information from children. If you believe a child has provided unnecessary personal information, please contact us.
We will review this notice when our services or processing change and update the date above. Material new purposes or optional tracking will be explained before the new processing begins, with fresh permission where required.