On this page
1. Who we are
This website is operated by Jurassic Bathrooms Ltd, a company registered in England & Wales (company number 17366221), which trades as Jurassic Bathrooms & Heating. Jurassic Bathrooms Ltd is the data controller for the personal information described in this notice.
| Registered company name | Jurassic Bathrooms Ltd |
|---|---|
| Trading name | Jurassic Bathrooms & Heating |
| Company number | 17366221 (England & Wales) |
| Registered office | Merchant Chambers, 427–431 London Road, Sheffield, S2 4HJ |
| Responsible person | The Director, James Steven Andrews, is the owner of the data we hold and is responsible for data protection within the company. |
| Contact | website@jurassicbathrooms.co.uk · 01202 934240 · 07985 192554 |
We are a small business and are not required to appoint a Data Protection Officer. Responsibility for data protection sits with the Director.
2. What information we collect
When you use the enquiry form
The form on our website asks for:
- Your name and phone number — required, so we can reply
- Your email address and the area you live in — optional
- The type of project and anything you tell us about it in the message box
Alongside this, our server records the IP address the enquiry was sent from and the date and time. This is a security measure: it lets us identify and block spam and abusive submissions. Please only include information in the message box that you are comfortable sharing — there is no need to send us financial details, and we will never ask for them by email.
When you simply browse
Our web server keeps standard access logs (IP address, page requested, time, browser type). Fonts and images are served from our own server, so simply reading the site does not share your details with any third party.
What we do not collect
- We do not ask for, or store, payment or card details through this website
- We do not knowingly collect information about children
- We do not buy personal data, or build profiles from other sources
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Answering your enquiry — calling or emailing you back, arranging a visit, preparing a quotation | Article 6(1)(b) — steps taken at your request before entering into a contract |
| Carrying out work you have booked and keeping the records that go with it | Article 6(1)(b) — performance of a contract |
| Keeping accounting and tax records | Article 6(1)(c) — legal obligation |
| Protecting the form from spam and abuse (IP logging, rate limiting) | Article 6(1)(f) — legitimate interests in keeping our systems secure |
| Advertising and measurement cookies (Google Ads, Google Analytics) | Article 6(1)(a) — your consent, which you may withdraw at any time |
In short: the details you send through the enquiry form are used purely to answer that enquiry and, if you go ahead, to carry out the work. We do not sell your information, and we do not pass it to other companies for their own marketing.
4. How long we keep it
| Information | Kept for |
|---|---|
| Enquiries that do not lead to work | Up to 24 months, then deleted |
| Customer and project records (quotes, invoices, correspondence) | 6 years after the end of the work, to meet HMRC and limitation-period requirements |
| Guarantee and warranty records | For the length of the guarantee |
| Website server logs | Typically 30 days |
| Anti-spam rate-limiting data | 1 hour, and the IP address is stored only in a hashed (scrambled) form |
5. Who we share it with
We keep the list of people who can see your information as short as possible. It is limited to:
- Google Workspace — our email provider. Enquiries arrive in our inbox and are stored there.
- Our web hosting — the server that runs this website and sends the enquiry email.
- Google Ads and Google Analytics — only if you have accepted advertising cookies.
- Our accountant, and HMRC — where we are legally required to keep or produce records.
- Suppliers or trades working on your project — and then only the details they genuinely need, such as a delivery address.
Some of these providers, including Google, may process data outside the UK. Where that happens, transfers are covered by the safeguards permitted under UK data protection law, such as the UK International Data Transfer Addendum or an adequacy decision.
6. Cookies and tracking
A cookie is a small file stored by your browser. When you first arrive, we ask whether you are happy for us to set advertising cookies. Nothing optional is set until you agree — we use Google Consent Mode, which keeps advertising and analytics storage switched off by default.
| Type | What it does | Set without consent? |
|---|---|---|
| Essential | Remembers your cookie choice so we do not ask on every visit, and helps protect the enquiry form from spam. | Yes — the site cannot work properly otherwise, and no tracking is involved |
| Advertising & measurement | Google Ads and Google Analytics cookies, which tell us which of our adverts led to an enquiry so we do not waste money on advertising that does not work. | No — only if you choose "Accept all" |
You can change your mind whenever you like using the Cookie settings link in the footer of every page, or by clearing cookies and site data in your browser. Declining does not limit the site in any way.
7. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your information — that is what this notice is for
- Request a copy of the personal information we hold about you
- Have it corrected if it is wrong or incomplete
- Have it erased, where we have no continuing legal reason to keep it
- Restrict or object to how we use it, including any use based on legitimate interests
- Data portability — receive your information in a transferable format
- Withdraw consent at any time, where we relied on it — such as for advertising cookies
Exercising these rights is free, and doing so will never affect the service you receive from us.
8. Making a request about your data
A request to see, correct or delete your information is known as a Data Subject Access Request. You can make one in either of these ways:
By letter — the surest route, and the one we recommend for access requests:
The Director (Data Protection)
Jurassic Bathrooms Ltd
Merchant Chambers
427–431 London Road
Sheffield
S2 4HJ
Or through the enquiry form on our contact section — please write "Data Protection Request" in the message box so it reaches the right person quickly.
We will respond within one month. If a request is especially complex we may extend this by up to two further months, and we will tell you if that happens. We may ask you for proof of identity first, so that we never disclose someone's personal information to the wrong person.
9. How we protect your information
- The whole website is served over an encrypted HTTPS connection
- Enquiries are delivered to a mailbox protected by Google Workspace security
- The enquiry form is rate limited and validated to block automated abuse
- Access to enquiries and customer records is limited to the Director and the people working on your project
No system can be guaranteed completely secure, but we take these measures seriously. If a breach ever occurred that put your rights at risk, we would tell you, and report it to the Information Commissioner's Office where required.
10. Complaints
If you are unhappy with how we have handled your information, please tell us first — most things are quickest to put right directly. You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk
Changes to this notice
If we change how we use personal information, we will update this page and revise the date at the top. This notice was last updated on 19 August 2026.