Who we are
This privacy policy explains how Omni Construction Group collects, uses, shares and keeps personal data. It covers our website at www.omniconstructiongroup.co.uk and the way we work with the people we deal with in our business. We have written it to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
In this policy, "we", "us" and "our" mean the business trading as Omni Construction Group, run by Shahan Abbas and Bilal Khan. We are the "controller" of the personal data described here. That means we decide why and how it is used, and we are responsible for looking after it.
You can contact us about anything in this policy:
- Email: shahan@omniconstructiongroup.co.uk
- Phone: +44 7736 666567
We have not appointed a Data Protection Officer. The law does not require one for a business of our size and type. Shahan Abbas handles data protection questions for the business.
What this policy covers
This policy applies to personal data about:
- people who visit our website;
- people who enquire about our work, whether by the website form, phone, email or message;
- our customers, including private homeowners, landlords and property managers;
- people who work at the businesses we do work for, such as directors, managers, site contacts and accounts staff;
- suppliers and subcontractors we deal with, and the people who work for them;
- anyone else who appears in correspondence about a project, for example a tenant, a neighbour, an architect, a surveyor or a building control officer.
"Personal data" means any information that identifies a living person or could be used with other information to identify them. This policy does not cover information about a business itself, except where that information also identifies a person.
What personal data we collect and where it comes from
When you use the website form
Our enquiry form asks for:
- your name (required);
- your email address (required);
- your phone number (optional);
- the type of project (Commercial, Landlord / property manager, Residential or Other; required);
- your message (required).
The form also sends two pieces of information you do not type in: the address of the page you sent the form from (so we know which service or sector you were reading about) and a fixed subject line for the email we receive. There is also a hidden anti-spam field that a person never sees. If that field is filled in, which only automated programs do, the submission is discarded and nothing is sent to us.
The form is sent to our own server first, which passes the details on to Formspree, the service that emails the enquiry to us. Because the message is passed on by our server rather than by your browser, your IP address is not sent to Formspree. Formspree records the date and time of the submission alongside the details above. See "Who we share your personal data with" below.
We need your name, email address, project type and message to reply to you. If you leave them out, the form will not send. Your phone number is optional; if you give it, we may call you rather than email.
When you phone, email or message us
If you phone us, we will note your name, number and what you asked about. If you email us, we keep the email and any attachments. If you choose to contact us by text message or through a messaging app, we hold that conversation on the phone it was sent to, and the provider of that service also processes the message under its own privacy policy.
When we visit your property and prepare a quote
To quote for a job we usually visit the property. From that point we collect and create:
- the address of the property and access details;
- notes, measurements and sketches of the work you have asked for;
- photographs of the property that show the areas we will work on;
- anything you tell us that affects the job, such as who lives at the property, when it is occupied, or a known hazard;
- the quote itself and any drawings, specifications and correspondence about it.
Our photographs are of buildings and work areas, not people. We do not use photographs of your property in our marketing unless you have agreed to it.
When we carry out your project
While the work is under way we create and keep project records: the contract, variations, progress photographs, site notes, health and safety documents, building control correspondence, certificates, sign-offs, and emails, messages and letters exchanged with you and with others involved in the project.
Payments
We keep invoices, receipts, statements and records of payments you make to us and payments we make to suppliers and subcontractors. We do not take payments through the website and we never ask for card details on it.
People at client businesses, suppliers and subcontractors
For business customers we hold the names, job titles, work contact details and correspondence of the people we deal with. For suppliers and subcontractors we hold contact details, quotes, invoices, certificates and, where the law requires it, tax and insurance details.
Website visitors
Our website is hosted by Vercel. When you load a page, Vercel's servers record the ordinary technical details of the request: your IP address, the type of browser and device you are using, the page requested and the date and time. This is standard for every website and is used to deliver the pages and keep the site secure. We do not run analytics on the site and we do not track visitors. The site sets no cookies (see "Cookies" below).
Where the data comes from
Most of the personal data we hold comes directly from you. Sometimes it comes from someone else: for example a landlord or property manager may give us a tenant's name and phone number so we can arrange access, a main client may pass on a site contact, or an architect may send us drawings that name the owner. When that happens we use the details only for the project, and we will tell the person who we are and point them to this policy the first time we contact them.
Information we do not collect
We do not collect special category data (such as health, religion or ethnicity), criminal records data, biometric data or CCTV footage. If you tell us something of this kind in passing, for example that someone at the property has a health condition that affects when we can work, we use it only to plan the job with proper care and we do not record more than we need.
Why we use your personal data and our lawful basis
UK GDPR requires us to have a lawful basis for each thing we do with personal data. The table below sets out each purpose, the data involved and the basis we rely on.
| Purpose | Data we use | Lawful basis |
|---|---|---|
| Replying to your enquiry, arranging a site visit and preparing a quote | Your name, contact details, project type, message, property address, site notes and photographs | Taking steps at your request before entering into a contract. For people at business customers we rely on our legitimate interest in responding to business enquiries. |
| Delivering your project: planning the work, ordering materials, arranging subcontractors, dealing with building control, invoicing and keeping you informed | Your contact details, the contract and quote, property details, project records and correspondence | Performance of our contract with you. For people at business customers we rely on our legitimate interest in performing the contract with their employer. |
| Keeping accounts, tax and other records the law requires, including records for HM Revenue and Customs, health and safety records and building regulations records | Invoices, payment records, contracts, project records, subcontractor and supplier details | Compliance with our legal obligations. |
| Running, securing and improving the website, and detecting spam and abuse of the enquiry form | IP address, browser and device details, pages requested, timestamps, the anti-spam field and the page the form was sent from | Our legitimate interest in keeping the site available and secure and in stopping automated spam. We have weighed this against your privacy: the data is technical, is kept for a short time, is not used to profile you, and you would reasonably expect any website to handle requests in this way. |
| Dealing with complaints, claims and disputes, including defending or bringing legal claims, and answering insurers, regulators and courts | Project records, correspondence, photographs, contracts and payment records | Our legitimate interest in being able to show what was agreed and what was done, and, where a law or a court requires us to act, compliance with our legal obligations. |
| Answering your rights requests and data protection complaints, and keeping a record of them | Your request or complaint, our reply and the correspondence about it | Compliance with our legal obligations under UK GDPR and the Data Protection Act 2018. |
Marketing
We do not send marketing emails or newsletters. We do not add enquirers or customers to any mailing list. We do not sell personal data and we do not share it with anyone for their own marketing. If we ever ask whether you would like to hear from us, we will ask first, you will be able to say no, and you will be able to change your mind at any time.
Automated decisions
We do not make any decision about you by automated means, and we do not profile you. Every enquiry is read and answered by one of the two owners.
Who we share your personal data with
We share personal data only where we need to in order to run the website, run the business and deliver your project. We do not sell it. The organisations below process data for us or receive it from us.
| Recipient | Why | Where they are |
|---|---|---|
| Formspree, Inc. | Processes the website enquiry form. Formspree receives what you type, passed on by our server rather than by your browser, so it does not receive your IP address. It adds the date and time, stores a copy of the submission in its dashboard for 30 days on the plan we use, and emails it to us. | United States. Formspree's servers are hosted with Amazon Web Services in the United States. |
| Vercel Inc. | Hosts the website and serves its pages. Vercel's servers record the technical details of each request (IP address, browser, page, time) in short-lived server logs. | United States. |
| Google LLC (Google Workspace) | Provides our @omniconstructiongroup.co.uk email. Every enquiry the form sends us, and all email correspondence with you, is read and stored in our Google Workspace mailboxes. | United States. Google Workspace data is stored in Google's data centres around the world, including in the United States. |
| Subcontractors and suppliers | Only where needed for your project. For example, a registered gas or electrical installer needs the property address and a contact number to book and certify their part of the work, and a materials supplier may need a delivery address. | United Kingdom. |
| Professional advisers | Our accountant, and where needed a solicitor or other adviser, so we can keep proper accounts, take advice and deal with disputes. | United Kingdom. |
| Insurers | If there is a claim or incident on a project that an insurer needs to know about. | United Kingdom. |
| HM Revenue and Customs, local authority building control, the Health and Safety Executive, the police, courts and other authorities | Where the law requires us to provide information, or where we need to in order to establish, exercise or defend legal rights. | United Kingdom. |
| A buyer of the business | If the business, or a substantial part of it, is ever sold or transferred, the records needed to carry on the business would pass to the new owner, who would have to use them in line with this policy. | To be confirmed at the time; we would tell you if it affected you. |
Formspree, Vercel and Google act as our "processors": they may only use the data to provide their service to us and under their data processing terms with us. Subcontractors, advisers, insurers and authorities are separate controllers of the data we give them and are responsible for it under their own privacy notices.
International transfers
Three of our providers are based in the United States, so personal data leaves the United Kingdom when you use the website form, when you load a page, and when we receive and store your email. UK GDPR only allows this where the data is protected by an approved safeguard. The safeguard for each transfer is:
- Vercel Inc. is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK government has recognised as giving adequate protection. Vercel's data processing terms also include the UK International Data Transfer Addendum as a fallback if that certification ever lapses.
- Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework. Google's data processing terms for Google Workspace also include standard contractual clauses with the UK Addendum where a transfer is not covered by an adequacy decision.
- Formspree, Inc. is not certified under the Data Privacy Framework. Transfers to Formspree rely on the standard contractual clauses with the UK International Data Transfer Addendum (or the UK International Data Transfer Agreement) in Formspree's data processing terms.
We check the Data Privacy Framework list when we review this policy. If a provider's certification ends, we will rely on the contractual safeguard instead or change provider.
How long we keep your personal data
We keep personal data only for as long as we need it for the purposes above, and then delete or securely destroy it. The periods below are the rules we apply. Where a period runs from a particular event, the count starts at the end of that event.
| Records | How long | Why |
|---|---|---|
| Enquiries that do not lead to a quote (form submissions, emails, messages and call notes) | 12 months from our last contact with you, then deleted | Long enough to answer a follow-up or a repeat enquiry, short enough to respect the UK GDPR rule that data is not kept longer than needed. Formspree's own copy expires after 30 days; the copy in our mailbox is the one we delete. |
| Quotes that are not accepted, with the site visit notes and photographs behind them | 2 years from the date of the quote | Customers often come back to a quote within that time, and it lets us answer any question about what was quoted. |
| Project files for work we carry out: contracts, quotes, variations, drawings, specifications, photographs, certificates, sign-offs, health and safety records and all correspondence, including any complaint or claim about the work | 15 years from practical completion of the job, or from completion of any later rectification work if that is later | Claims about work to a dwelling can be brought for up to 15 years under the Defective Premises Act 1972 as amended by the Building Safety Act 2022, and negligence claims have a 15-year long-stop under the Limitation Act 1980. Contract claims can be brought for 6 years, or 12 years if the contract is a deed. One period for the whole file means we can show what was agreed and done for as long as either side could raise it. |
| Invoices, receipts, payment records and other accounting and tax records | 6 years from the end of the financial year they relate to | HM Revenue and Customs requires self-employed people and partners to keep records for at least 5 years after the 31 January filing deadline for the tax year; 6 years covers that rule and the 6-year rule that applies to companies. |
| Website server logs | Set by Vercel, not by us. Vercel's published retention for the logs we can see is one hour on its Hobby plan and one day on its Pro plan. We do not download or keep separate copies. | The logs exist only to deliver the site and detect problems, and we have no need to keep them. |
| Data protection rights requests and complaints, and our replies | 3 years from the date we close the request or complaint | So we can show the Information Commissioner's Office how we handled it if asked. |
If a complaint, claim or investigation is open when a period ends, we keep the records concerned until it is finished. The same periods are used in our terms of business.
Security
We take practical steps to keep personal data safe, in proportion to the size of our business and the kind of data we hold:
- the website is served over HTTPS, and the enquiry form is sent over an encrypted connection;
- our email, form and hosting accounts are password protected, and we use two-step verification wherever the provider offers it;
- access to those accounts, and to project files, is limited to the two owners;
- phones and computers used for the business are locked with a passcode or password;
- we choose providers that encrypt data in transit and at rest;
- we do not take card details on the website or by email.
No system is completely secure and we cannot promise that data will never be lost, misused or accessed without permission. If a security breach ever puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
Your rights
Under UK GDPR you have the following rights over your personal data. Some of them apply only in certain situations, and we will explain if that is the case when you ask.
- Access: you can ask for a copy of the personal data we hold about you, and for information about how we use it.
- Rectification: you can ask us to correct data that is wrong or to complete data that is incomplete.
- Erasure: you can ask us to delete your data. We may have to keep some of it, for example accounting records the law requires us to keep or project records we need to defend a claim, and we will tell you if so.
- Restriction: you can ask us to stop using your data, but keep it, while a question about its accuracy or our use of it is resolved.
- Portability: where we hold data you gave us and use it under a contract with you, you can ask for it in a common machine-readable format so you can pass it to someone else.
- Objection: you can object to our use of your data where we rely on legitimate interests. We will stop unless we have compelling grounds that override your interests, or we need the data for a legal claim.
- Automated decisions: you have the right not to be subject to a decision based only on automated processing that has legal or similarly significant effects on you. We do not make any such decisions.
- Withdrawing consent: where we rely on your consent for anything, for example to use a photograph of your property in our marketing, you can withdraw it at any time. That does not affect anything done before you withdrew it.
How to exercise your rights
Email shahan@omniconstructiongroup.co.uk or phone +44 7736 666567. You do not need to use any particular form or wording.
There is normally no fee. We may charge a reasonable fee, or decline to act, only if a request is clearly unfounded or excessive, for example if it repeats a request we have already answered.
We will reply within one month. If your request is complex or you have made several, we may take up to two further months; we will tell you within the first month if so. We may ask you to confirm your identity before we act, so that we do not give your data to someone else. If we do, the one month runs from the day we receive that confirmation.
How to complain
Complain to us first
You have the right under the Data Protection Act 2018 to complain to us if you think we have not handled your personal data properly. Please contact Shahan Abbas by email at shahan@omniconstructiongroup.co.uk or by phone on +44 7736 666567. We accept complaints in whatever form they arrive. We will acknowledge your complaint within 5 working days, look into it, and aim to give you our answer within 30 days. If it will take longer we will tell you why and when to expect our reply. We keep a record of each complaint and its outcome.
Complain to the Information Commissioner's Office
If you are not happy with our answer, or you would rather not raise it with us, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. The ICO usually expects you to have complained to the organisation first.
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113 (Monday to Friday, 9am to 5pm, excluding bank holidays)
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
You also have the right to take a claim to court if you believe your data protection rights have been breached. Complaining to us or to the ICO does not take that right away.
Children
Our website and services are not aimed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us their details, please contact us and we will delete them.
Cookies
This website sets no cookies and stores nothing on your device. Our cookie policy explains this in more detail and what would change if that were ever to alter.
Links to other websites
Our website currently contains only phone and email links, but we may add links to other websites in future, for example to a building control body or a certification scheme. We are not responsible for how other websites collect or use personal data. Their own privacy policies apply, and we suggest you read them.
Changes to this policy
We review this policy at least once a year and whenever we change how we handle personal data, for example if we change a provider or add analytics to the website. When we make a change we update the "Last updated" date at the top of this page. If the change is significant, we will say so clearly on this page for a reasonable period, and where we hold your contact details and the change affects you directly we will tell you by email.
Contact
For any question about this policy, or about how we use your personal data:
- Email: shahan@omniconstructiongroup.co.uk
- Phone: +44 7736 666567
Our contact page has the same details. Our website terms of use and terms of business set out the rest of the legal position between us.