Privacy Policy

---

This policy explains how personal data we collect from you, or that you provide to us, will be processed by CAWS Property Services Ltd, the Data Controller.

Our Contact Details (Data Controller):

• Legal Name: CAWS Property Services Ltd (Registered Company Number: 12460201)
• Registered Address: 9 Lynn Road, Wiggenhall St. Mary Magdalen, King's Lynn, Norfolk PE34 3AZ
• Contact Email: Info@cawspropertyservicesltd.co.uk

Please read the following carefully to understand how we will treat your personal data in accordance with the UK General Data Protection Regulation (UK GDPR).

We collect and process the following categories of personal data, each justified by a specific lawful basis under UK GDPR:

Identity & Contact Data: Information provided by filling in forms on our website (e.g., name, address, email, phone). This includes data provided when registering an account, purchasing services, or requesting further information. Contract (for purchasing/account registration) or Legitimate Interest (for pre-contract enquiries and quotes).

Correspondence Records: If you contact us by letter, message, or email, records of the correspondence, including your identity and the content of the communication, may be kept. Legitimate Interest (to handle enquiries, improve service, and maintain a business record of interactions).

Transaction Data: Details of transactions you carry out through our site and information required for the fulfilment and administration of your orders (e.g., services purchased, date, payment status). Contract (to fulfill the service we are contracted to provide to you).

Technical & Usage Data: Your operating system, browser type, referring / exit pages and URLs, number of clicks, domain names, and pages viewed, recorded in our server logs. Legitimate Interest (for security purposes, system administration, debugging, and improving website functionality). Consent (for any non-essential analytical tracking - see Cookies section).

Call Recording: Telephone conversations may be recorded. You will be informed prior to the recording starting. Legitimate Interest (for training purposes, quality assurance, and accurate record-keeping of contractual discussions).

To register a customer account. = Contract 

To handle customer service enquiries and manage complaints. = Legitimate Interest

To process orders and fulfill our obligations arising from any contracts entered into between you and us (e.g., scheduling work, ordering materials). = Contract

To ensure that content from our site is presented in the most effective manner for you and your computer. = Legitimate Interest

To provide you with information, products, or services that you request from us or which we feel may interest you. = Consent (where you have explicitly opted in for marketing) or Legitimate Interest (for existing customers regarding similar services/products).

To notify you about changes to our service, terms, or policies. = Legitimate Interest

To carry out statistical analysis and perform marketing analysis to improve our service offerings.= Legitimate Interest

We will never sell your personal data to third parties.

We use certain trusted third-party providers (Data Processors) to help us operate our business. We only share the minimum personal data necessary for them to perform their functions. These parties are contractually bound to keep your data secure and process it only according to our instructions.

The categories of recipients include:

• Payment Processors: To securely handle payment transactions (e.g., Stripe, PayPal).
• IT and System Providers: Companies that host our website, manage our customer database (CRM), and provide email services.
• Accounting and Legal Firms: To assist with financial compliance and legal requirements.
• Marketing Platforms: To manage email communications (where you have consented).

We do not intentionally transfer your personal data outside the UK or the European Economic Area (EEA). If a third-party service provider (such as a cloud provider) is located outside the UK/EEA, we ensure adequate safeguards are in place, such as relying on adequacy decisions or using approved Standard Contractual Clauses (SCCs) to protect your data.

We only retain your personal data for as long as we need it to fulfil the purposes for which we initially collected it, unless otherwise required by law. We will retain and use information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Invoice and Financial Data = Minimum of 6 years from the end of the last financial year they relate to. Why? Legal Obligation (HMRC and UK Law).

Customer/Account Data (Non-Financial) = 6 years after the contract ends or the account is closed. Why? Legitimate Interest (to defend against legal claims under the Limitation Act 1980).

Correspondence Records = Up to 2 years after the enquiry is resolved. Why? Legitimate Interest (for service improvement and record-keeping).

Marketing Consent Records = Retained until you withdraw consent, plus 3 months. Why? Legal Obligation (to demonstrate we had consent).

Technical & Server Logs = Up to 6 months.Why? Legitimate Interest (for security analysis).

Unless subject to an exemption under the UK GDPR, you have the following enhanced rights with respect to your personal data:

1. Right to Be Informed: You have the right to be provided with clear, transparent, and easily understandable information about how we use your data (which is the purpose of this policy).
2. Right of Access: The right to request a copy of your personal data we hold about you (a Subject Access Request).
3. Right to Rectification: The right to request that we correct any personal data if it is found to be inaccurate or out of date.
4. Right to Erasure (Right to be Forgotten): The right to object to our use of your personal data and request your personal data is erased where it is no longer necessary for us to retain such data. Please note that there may be legal reasons (e.g., financial retention) as to why we will need to keep some data, but we will inform you if this is the case.
5. Right to Restrict Processing: The right to 'block' or suppress the processing of your personal data in certain circumstances (e.g., while the accuracy of the data is being checked).
6. Right to Data Portability: The right to request that we transfer the personal data you have provided to us to another party, where technically feasible and where processing is based on consent or contract.
7. Right to Object: The right to object to our processing of your personal data, particularly where we rely on Legitimate Interest or for direct marketing.
8. Right to Withdraw Consent: Where we rely on Consent as our lawful basis, you have the right to withdraw that consent at any time.
9. 
   

You have the right to ask us not to process your personal data for marketing purposes. We will always seek your explicit consent before collecting your data for such purposes. You can easily exercise your right to object by clicking the unsubscribe link in any marketing email.

The right to lodge a complaint with the Information Commissioners Office (ICO). Please see https://ico.org.uk/concerns/ for further information.

We may obtain information about your general Internet usage by using a cookie file which is stored on the hard drive of your computer.

• Essential Cookies: These cookies are necessary for the website to function (e.g., managing your account session). We can use these without your consent.
• Non-Essential Cookies: These include cookies for analytics, performance, and Remarketing (e.g., seeing adverts to remind you of our services or products).

We will seek your explicit, affirmative consent (via a cookie banner or pop-up) before placing any non-essential cookies on your device.

You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you select this setting, you may be unable to access certain parts of our site.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, the affected individuals will be contacted within the timescales specified in the UK GDPR (72 hours of becoming aware of the breach), and a full report – highlighting any risks – will be provided.

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers, and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

We keep our privacy policy under regular review and we will place any updates on this web page