Privacy Policy – Just Lofts & Build

Last updated: 22 October 2025

Who we are (Data Controller)

We’re Just Lofts & Build — the Cardiff team that prefers tidy lofts to messy legalese.
Website: https://justlofts.wales/
Address: Unit 1, Fitzroy Street, Cardiff, CF24 4BL
Phone: 029 2252 3483 / 07514 795 000
Email: data@justlofts.wales

We process personal data in line with UK GDPR and the Data Protection Act 2018. In short: we respect your privacy, we don’t flog your details to strangers, and we only use your info to do our job properly.

What we collect and why

When you contact us for a quote, we ask for your name, email, phone, address, a few job details and any photos or files you upload. We use this to price the job, schedule a visit, and keep you updated. That’s contract stuff, including the steps before a contract.

If you email, call, text or WhatsApp us, we’ll see your contact details and whatever you tell us. That’s for customer service, planning and records, and falls under contract and legitimate interests. If we’re on site, we may take notes and photos or short videos of the work area with your permission. It helps us plan, keep quality high, honour warranties and prove what we did.

Our website keeps basic security logs like IP addresses, pages visited and timestamps. That’s for running the site, improving performance and stopping spam and fraud. Cookies that keep the site running are essential. If we switch on analytics or marketing cookies, we’ll ask first via the cookie banner and you can change your mind anytime.

We don’t generally enable public comments. If they’re ever switched on, we’ll collect what you type, plus IP and browser info for spam control, and a hashed version of your email may be sent to Gravatar to check for an avatar. If you upload images to the site or send them to us, please avoid embedded location data, as clever people on the internet can sometimes read it.

Pages may include embedded content like maps, videos or reviews. Those behave exactly as if you visited the other site, which may set its own cookies and tracking according to its policy. If we enable analytics (for example, Google Analytics 4), it’s consent-based and used in aggregate to make the site better.

Our lawful bases

We rely on contract to give quotes and carry out work. We rely on legitimate interests to run, secure and improve our services and website and to respond to enquiries. We rely on consent for any optional analytics or marketing. We rely on legal obligation for tax, accounting and compliance. Not very rock ’n’ roll, but important.

Who we share data with

We don’t sell your data. Not even for a pallet of loft boards. We use trusted providers who process data on our instructions, such as our web host (site and database), our email provider (like Microsoft 365), and our form software (ARForms — your entries live in our site database). If we enable analytics or embed reviews, maps or videos, services like Google may process limited data when you interact with those features. If any provider sits outside the UK/EEA, we use recognised safeguards such as the UK IDTA or EU SCCs.

How long we keep things

Enquiries and quotes are kept for up to 24 months so we can follow up sensibly. Customer records and invoices are usually kept for seven years to meet tax rules. Server and security logs can live for up to 12 months. If comments are ever enabled, approved comments and their metadata may stick around so future comments can be auto-approved. If you have a user account, we keep the profile data you give us until you ask us to remove it, except for your username which our system needs to function.

Your rights

You can ask us for a copy of your data, to correct it, to delete it where appropriate, to restrict or object to processing, and to have your data in a portable format. You can withdraw consent for anything that’s based on consent. Email data@justlofts.wales and we’ll sort it. If you’re unhappy, you can complain to the Information Commissioner’s Office at https://ico.org.uk/.

Where your data is sent

Entries may be checked by automated spam and security services. If a provider stores data outside the UK/EEA, we use recognised safeguards to keep it protected on its travels.

How we protect your data

We use HTTPS/TLS, secure hosting, access controls, regular updates and backups. Only staff or contractors who need access to do their jobs can see your data. We’re a small trades business, so our security is practical and proportionate — more “sensible boots” than “spy movie,” but it does the job.

Data breaches

If something goes wrong that risks your rights and freedoms, we’ll investigate, minimise the impact, and let you and/or the ICO know where the law says we must.

Third-party data sources

We don’t usually get your details from other people. If you ask a landlord, tenant, agent or anyone else to liaise with us, we’ll process what they provide so we can fulfil your request.

Automated decision-making

We don’t make decisions about you using only automated processes that have legal or similarly significant effects. Robots don’t run this loft.

Industry disclosures

Sometimes we need to keep or share limited information to prove what we did, honour warranties, or comply with health and safety, insurance or legal requirements. We keep it minimal and sensible.

Changes to this notice

If we update this policy, we’ll post the new version here with a fresh “Last updated” date. We hate spammy surprises as much as you do, so we keep changes clear and in plain English.