Privacy Policy.

Last updated: 1 May 2026

1. Who we are

This privacy policy explains how A.P Roofing Services Ltd ("we", "us", "our") collects, uses and protects your personal data when you visit our website at www.ap-roofing.co.uk or contact us about our services.

We are the data controller responsible for your personal data. Our contact details are:

2. What personal data we collect and why

2.1 Contact and enquiry data

When you complete the enquiry form on our website, we collect:

• First name and last name
• Email address
• Phone number
• Postcode
• Property type (optional)
• Type of roofing service required (optional)
• A free-text message describing your enquiry
• Any photographs you choose to upload of your roof or property

Lawful basis: We process this data on the basis of legitimate interests (Article 6(1)(f) UK GDPR) — specifically, to respond to your enquiry and provide you with a roofing quotation. Where processing is necessary to take steps prior to entering into a contract with you, we rely on pre-contractual necessity (Article 6(1)(b)).

We will only use the information you submit to respond to your enquiry and, if you become a customer, to administer your roofing project. We do not use it for any other marketing purposes and we will not sell or share it with third parties for their own marketing.

2.2 Website analytics data

We use Google Analytics 4 (GA4) to understand how visitors use our website — for example, which pages are visited most, how long visitors stay, and where they came from. GA4 collects anonymised usage data including:

• Pages visited and time spent on each page
• Approximate geographic location (country/region level only)
• Device type, browser and operating system
• Referral source (e.g. Google Search, direct)

We have configured GA4 with IP anonymisation enabled. Google does not receive your full IP address. We do not use GA4 for advertising or remarketing purposes, and we have not linked GA4 data to any personally identifiable information.

Lawful basis: Legitimate interests (Article 6(1)(f)) — to understand and improve our website's performance. Google's privacy policy is available at policies.google.com/privacy.

2.3 Map data (Leaflet / OpenStreetMap)

Our website uses Leaflet.js with OpenStreetMap (via CARTO map tiles) to display an interactive map of our service areas. When the map loads, your browser makes a request to CARTO's servers to fetch map tile images. This may involve your IP address being transmitted to CARTO's servers. We do not receive or store this data ourselves.

OpenStreetMap's privacy notice is available at osmfoundation.org/wiki/Privacy_Policy. CARTO's privacy policy is available at carto.com/privacy.

3. How your data is shared

3.1 Basin (form submission processor)

Enquiry forms on our website are processed by Basin (usebasin.com), a third-party form submission service. When you submit an enquiry, your data is transmitted securely to Basin's servers before being forwarded to us. Basin acts as a data processor on our behalf under a data processing agreement. They do not use your data for their own purposes. Basin's privacy policy is available at usebasin.com/privacy.

3.2 Google (analytics)

As described in Section 2.2, we use Google Analytics 4. Google acts as a data processor when processing analytics data on our behalf. Google may transfer data internationally; however, such transfers are subject to appropriate safeguards under Google's data processing terms.

3.3 No other third-party sharing

We do not sell your personal data. We do not share your enquiry data with any other businesses, marketing platforms or data brokers. We may disclose personal data if required to do so by law or in connection with legal proceedings.

4. How long we keep your data

We retain enquiry and customer data for a period of 3 years from the date of your initial enquiry or the completion of any work we carry out for you, whichever is later. This retention period allows us to:

• Respond to any questions or follow-up queries about work carried out
• Comply with our obligations regarding workmanship guarantees
• Maintain accurate business records

After this period, your personal data will be securely deleted or anonymised.

Website analytics data (Google Analytics) is retained for 14 months by default, in line with GA4's data retention settings.

5. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may ask us to correct it.
• Right to erasure ("right to be forgotten"): You may ask us to delete your personal data where there is no compelling reason for us to continue processing it. Note that we may need to retain certain information for legal or contractual reasons.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request that your data be provided to you in a structured, commonly used and machine-readable format.
• Right to restrict processing: You may ask us to suspend processing of your personal data in certain circumstances (for example, while we verify its accuracy).
• Right to object: You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds which override your interests.

To exercise any of these rights, please contact us using the details in Section 1. We will respond within one month. There is no charge for making a request.

6. Cookies

Our website uses only functional and analytics cookies. We do not use advertising cookies, tracking pixels or any third-party ad network technologies.

• Google Analytics cookies (_ga, _ga_*): These are first-party analytics cookies set by GA4 to distinguish unique users and sessions. They do not contain personally identifiable information.

You can control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Note that disabling cookies may affect the functionality of some websites.

7. Security

All data transmitted through our website forms is encrypted in transit using TLS/HTTPS. We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss or destruction. Access to enquiry data is restricted to A.P Roofing Services Ltd personnel who need it to respond to and manage your enquiry.

8. International transfers

Google Analytics may involve the transfer of data outside the UK and European Economic Area. Google relies on the EU-US Data Privacy Framework and Standard Contractual Clauses to provide appropriate safeguards for such transfers. Basin is a US-based service; data transfers to Basin are subject to Standard Contractual Clauses.

We do not otherwise transfer your personal data outside the UK.

9. Changes to this policy

We may update this privacy policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

10. How to complain

If you have any concerns about how we handle your personal data, please contact us in the first instance using the details in Section 1 and we will do our best to resolve the issue.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator: