Privacy policy
Canopy Care (“we”, “us”) is committed to protecting your personal data. This policy explains what we collect through this website and when you engage us, why we collect it, how long we keep it, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who we are (data controller)
- Business: Canopy Care
- Email: enquiry@canopycare.uk
- Phone: 01483 904 954
2. What we collect and why
Enquiries and quotes
When you use our contact form, phone or email us, we collect your name, contact details, the address of the work and a description of the work you’d like done. Lawful basis: taking steps at your request before entering a contract (Art. 6(1)(b)) and our legitimate interest in responding to enquiries (Art. 6(1)(f)).
Customers
If you become a customer we also process quote and job records, invoices, payment records and correspondence. Lawful basis: performance of a contract (Art. 6(1)(b)) and legal obligation for tax and accounting records (Art. 6(1)(c)).
Marketing
We only send marketing emails if you have opted in, and every message includes an unsubscribe option. Lawful basis: consent (Art. 6(1)(a)), which you may withdraw at any time.
Website analytics and advertising
With your consent (see our cookie policy) we use Google Analytics to understand how the site is used, and may use Google Ads conversion measurement. IP addresses are truncated/anonymised where the tools allow. Lawful basis: consent (Art. 6(1)(a)).
Reviews and testimonials
If you give us a testimonial we publish your first name and general location only with your consent, which you can withdraw at any time by contacting us.
Photographs of work
We photograph work we carry out (for example before-and-after images) for our records and, where images do not identify a person or private location beyond the work itself, for our portfolio. Tell us if you would prefer images of your property not to be used and we will not publish them, or will remove them.
3. Who we share data with
We never sell your data. We share it only with service providers who help us run the business, under contracts that protect it:
- Our website and business-management platform (hosted on Cloudflare infrastructure, with data stored in the EU/UK/US under appropriate safeguards)
- Email delivery providers (to send confirmations, quotes and invoices)
- Stripe, if you pay online (we never see or store your full card details)
- Google (analytics/advertising), only where you have consented to those cookies
- Our accountant and HMRC where required by law
Where a provider processes data outside the UK, transfers are protected by adequacy regulations or International Data Transfer Agreements / Standard Contractual Clauses.
4. How long we keep data
- Enquiries that don’t become jobs: up to 24 months, then deleted
- Quotes, job records and correspondence: 6 years after the work (limitation periods)
- Invoices and payment records: 6 years from the end of the financial year (HMRC requirement)
- Marketing consent records: for as long as you are subscribed, plus a record of withdrawal
- Analytics data: per Google Analytics retention settings (14 months maximum)
5. Your rights
You have the right to:
- access a copy of your personal data
- have inaccurate data corrected
- have data erased where there is no lawful reason for us to keep it
- restrict or object to processing (including direct marketing, which we will always stop on request)
- data portability for data you provided to us
- withdraw consent at any time, where consent is the basis
To exercise any right, contact us at enquiry@canopycare.uk. We respond within one month. We may need to verify your identity first.
6. Complaints
If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk, or 0303 123 1113.
7. Security
Data is encrypted in transit (HTTPS) and at rest, access is limited to those who need it, sign-in to our systems uses single-use email links or strong passwords with optional two-factor authentication, and we keep audit records of access to personal data.
8. Changes
We’ll post any changes to this policy here and update the date at the top.