Legal
Privacy Policy
How Jamestead Group Ltd handles personal information collected through this website, what we do with it, and what rights you have over it.
Who we are
This website is operated by Jamestead Group Ltd, a company registered in England and Wales under company number 16333010. Our trading address is Unit 1, Birchy Cross Business Centre, Broad Lane, Tanworth In Arden, B94 5DN, and our registered office is [CONFIRM: registered office address].
Jamestead Group Ltd is the data controller for personal information collected through this website. That means we decide what is collected and what happens to it, and we are responsible for it under UK data protection law.
For anything in this policy, or to exercise any of the rights set out below, contact us at info@jamesteadgroup.com or on 0121 389 4473.
What this policy covers
This policy explains what personal information we collect through jamesteadgroup.com, why we collect it, who we share it with, how long we keep it, where it is stored and what rights you have over it.
It does not cover information we hold about you under a contract for construction management, project management or consultancy services, which is dealt with in the terms of that appointment, and it does not cover other companies’ websites that we link to.
The information we collect
Information you give us. If you send us an enquiry through the contact form, or email or call us, we collect what you choose to provide. That is usually your name, email address, telephone number, the organisation you work for, and whatever you tell us about your project.
Payment information. If you make a payment to us, we collect the billing name, billing address, contact details and the amount, date and reference of the payment. We do not collect or store full card numbers. Card details are entered directly with our payment provider and never reach our website or our systems. More on this in the Payments section below.
Information collected automatically. Our web server keeps access logs, as almost all web servers do. These record the IP address making the request, the pages requested, the date and time, and the browser being used. We use them to keep the site secure and available, not to build a profile of you.
Information from cookies and analytics. See the Cookies section and the Google services section below, which set out exactly what is and is not in use on this website today.
We do not buy personal data from third parties, and we do not collect special category data such as health information through this website.
Why we use it, and our lawful basis
Under the UK GDPR we have to have a lawful basis for each thing we do with your information. Ours are as follows.
Responding to enquiries: legitimate interests. You have contacted us about a possible appointment, and we have a clear and proportionate interest in replying properly, working out whether we are the right people for the project, and having the conversations that follow.
Delivering a project and taking payment: performance of a contract. Where an enquiry becomes an appointment, we use your information to carry out that contract, including invoicing and payment.
Accounting, tax and record keeping: legal obligation. We are required to keep certain financial records, and to retain project records for the periods set out below.
Site security and availability: legitimate interests. Server logs and the security measures our host applies.
Analytics and advertising: consent. Nothing in this category runs unless you agree to it through the cookie banner, and you can withdraw that agreement at any time.
Where we rely on legitimate interests, you have the right to object. Where we rely on consent, you have the right to withdraw it. Both are covered under Your rights.
Cookies and similar technologies
Cookies are small files a website stores on your device. They fall into three groups on a site like this one.
Essential cookies. These make the site work and cannot be turned off. On this website they are set by WordPress and by Elementor, the page builder the site is built with, and they do things like remember that you have submitted a form, or keep you signed in if you are an administrator. They are not used to track you across other websites, and under UK law they do not require your consent.
Analytics cookies. These tell us how the site is used, which pages are read and where people arrive from. They require your consent before they are set.
Advertising cookies. These measure whether an advert led to an enquiry, and allow advertising to be shown to people who have visited the site. They also require your consent.
What is actually running today: essential cookies only. There is no analytics, advertising or social media cookie set by this website at the moment, which is why you have not been asked to accept anything. When analytics or advertising are added, a consent banner will appear and none of those cookies will be set until you have made a choice. This policy will be updated on the same day.
You can block or delete cookies through your browser settings at any time. Blocking the essential ones may stop parts of the site working.
[CONFIRM for Dialekt: the consent banner has to be live before the first Google tag fires, not after. Under PECR, consent is required before a non-essential cookie is set, and a banner that only records a choice after the tag has already run does not comply.]
Google services
Status: not currently in use. No Google tag, tracking pixel or analytics script runs on this website today. This section sets out what will apply once they are, so that nothing is added without it being written down first.
Google Analytics. We intend to use Google Analytics to understand how the site is used: which pages are read, how long people stay, what they do next, and which sources bring people to the site. Google Analytics sets cookies and collects a truncated version of your IP address, your approximate location at city level, your device and browser, and the pages you view. We use it in aggregate, to improve the site. It runs on consent only.
Google Ads and conversion tracking. Where we advertise, we intend to use conversion tracking to see which adverts lead to enquiries, and remarketing to show adverts to people who have already visited. This also runs on consent only.
Google Search Console. We use, or will use, Search Console to see how the site performs in search results. It reports on search queries and pages in aggregate and does not identify individual visitors, and it sets no cookies on your device.
Google acts as our processor for Analytics and as an independent controller for some advertising purposes. Google’s own privacy policy is at policies.google.com/privacy, and you can opt out of Google Analytics across all websites using Google’s browser add-on at tools.google.com/dlpage/gaoptout.
Google processes data outside the UK. See International transfers below.
Payments
Status: we do not currently take payments through this website. This section sets out what applies when we do, and what applies now to payments made to us by invoice.
When you pay us, your card details are collected directly by our payment provider, [CONFIRM: payment provider, for example Stripe, GoCardless or a bank card terminal provider], on their systems. We never see or store your full card number, expiry date or security code. Our provider is responsible for the security of that data and is certified to the PCI DSS standard that applies to it.
What we do hold is the record of the transaction: the billing name and address, the amount, the date, the reference, the last four digits of the card where our provider shows them, and whether the payment succeeded. We hold that because we have to, for accounting and tax, and to answer questions about an invoice.
If you pay by bank transfer, we hold the payment reference and the details that appear on our bank statement.
We do not use your payment information for marketing, and we do not make automated decisions about you on the basis of it.
Who we share it with
We do not sell personal information, and we do not share it for anyone else’s marketing.
We share it only where running the business requires it, with:
SiteGround, who host this website and therefore store the site and its enquiry records.
[CONFIRM: email provider, for example Microsoft 365 or Google Workspace], who carry our email.
[CONFIRM: payment provider], who process payments.
Google, for analytics and advertising, once those are live and where you have consented.
Our accountants and professional advisers, where relevant.
Anyone we are legally required to share it with.
Each of these is bound by a contract that limits what they may do with the information, and none of them may use it for their own purposes except where they act as a controller in their own right, which is noted above for Google advertising.
Where an enquiry relates to a live project, information may be shared with the client, the professional team and supply-chain partners on that project, because that is what running a construction project involves.
How long we keep it
Enquiries that do not lead to an appointment are kept for [CONFIRM: retention period, 24 months is a common and defensible choice] and then deleted.
Where an enquiry leads to an appointment, project records are kept for the duration of the project and then for as long as we may need them for legal, insurance, warranty and limitation purposes. For construction projects that is typically twelve years from completion, because that is the limitation period for a contract executed as a deed.
Accounting and payment records are kept for six years from the end of the financial year they relate to, as required by law.
Analytics data, once analytics is live, will be retained for fourteen months, which is the shortest retention Google Analytics offers.
Server logs are kept for a short period and then overwritten.
Where your information is stored, and international transfers
This website is hosted by SiteGround. Our site and its enquiry records are stored in SiteGround’s [CONFIRM: which SiteGround data centre region, for example London or Frankfurt] data centre.
Some of the providers we use process data outside the UK. Google in particular processes data in the United States. Where information leaves the UK we rely on the safeguards UK data protection law permits: an adequacy decision where one covers the country in question, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, together with any additional measures the transfer requires.
If you want to know which safeguard applies to a particular provider, ask us and we will tell you.
Keeping it secure
The site runs over an encrypted HTTPS connection, so information you send through the contact form is encrypted in transit. Our host provides server-level security, backups and monitoring. Access to enquiry records and to the website itself is limited to the people who need it, and is protected by individual accounts rather than shared logins.
No system is completely secure. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell you directly where the law requires it.
Your rights
Under the UK GDPR you have the right to:
ask us for a copy of the personal information we hold about you;
have inaccurate information corrected;
ask us to delete information where there is no good reason for us to keep it;
ask us to restrict how we use it while a question about it is resolved;
object to us using it on the basis of legitimate interests;
withdraw your consent at any time, where we rely on consent, which includes analytics and advertising cookies;
ask for it in a portable format, where you provided it and we rely on consent or contract;
and not be subject to a decision made solely by automated means that has a legal or similarly significant effect on you.
To exercise any of these, email info@jamesteadgroup.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
Automated decisions and profiling
We do not make decisions about you by automated means, and we do not profile you. Analytics, once live, is used in aggregate to understand how the site is used, not to make decisions about individuals.
Children
This website is aimed at businesses and professional clients. It is not directed at children, and we do not knowingly collect information about anyone under 18. If you believe a child has given us their information, tell us and we will delete it.
Complaints
If you are unhappy with how we have handled your personal information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113.
[CONFIRM: ICO registration number. A company that processes personal information on a computer generally has to pay the data protection fee and appear on the ICO register, and taking payments and running analytics puts Jamestead firmly in that bracket. If there is a registration, the number belongs here. If there is not, that needs sorting before any of this goes live.]
Changes to this policy
We update this policy when what we do with personal information changes, and in particular before adding analytics, advertising or payments rather than after. The date below is when it was last reviewed.
Last updated: September 2026.