Privacy Policy

1. Who we are

West Country Concrete Products Limited (company number 06987338) — referred to in this policy as "we", "us" or "WCCP" — is the data controller responsible for any personal data you share with us through this website, by phone, by email or in person.

Registered address: Off Andigestion Lane, Chilsworthy, Holsworthy, Devon, EX22 7HH, United Kingdom.

2. What we collect

• Contact data — name, company, email, phone, postcode and any free-text notes you send us via the quote form, contact form or by email.
• Project data — drawings, specifications, photographs and site information you share with us so we can quote and manufacture for you.
• Transaction data — purchase orders, delivery addresses, invoices and payment records (we do not store card details — payments are handled by our bank).
• Technical data — IP address, device type, browser type, pages visited and approximate location, collected via essential cookies and (with your consent) analytics.
• Recruitment data — your CV, cover letter, employment history, references and anything else you send us when you apply for a job, whether through the careers form, by email or on paper.

3. Why we use it (lawful bases)

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

• Contract — to quote, manufacture and deliver products you've asked us for.
• Legitimate interests — to respond to enquiries, run our business, prevent fraud, and improve the website. We've balanced these interests against your rights.
• Legal obligation — to keep accounting and tax records under the Companies Act 2006 and HMRC rules.
• Steps prior to a contract / legitimate interests — to assess job applications, contact applicants and keep speculative CVs on file in case a suitable role comes up.
• Consent — for non-essential cookies and any marketing emails (you can withdraw consent at any time).

4. Who we share it with

We do not sell your data. We share it only with:

• Hauliers and installers contracted to deliver or fit your order.
• Our accountants, auditors and bank (for invoicing and payment).
• Hosting and email providers acting under written processor agreements (UK / EEA-based where possible).
• Our website and marketing agency, who help us manage enquiries and the website under a written processor agreement.
• Law enforcement or regulators where we are legally required to do so.

5. How long we keep it

• Quote enquiries that don't proceed: 24 months then deleted.
• Customer records and contracts: 7 years after final transaction (HMRC / Companies Act).
• Website analytics: 14 months maximum.
• CCTV at the yard: 31 days on a rolling overwrite.
• Job applications and CVs: see our careers page for how long we keep these.

6. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you.
• Rectification — ask us to correct anything that's wrong.
• Erasure ("right to be forgotten") where we no longer need the data.
• Restriction of processing in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Objection — to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time where we rely on it.

To exercise any of these rights, email info@westcountryconcreteproducts.co.uk or write to us at the address above. We'll respond within one calendar month.

7. Data Protection Officer

We are not required to appoint a statutory DPO, but our designated privacy contact is the Managing Director. Email info@westcountryconcreteproducts.co.uk with "Data protection" in the subject line.

8. Complaints

If you're unhappy with how we've handled your data, please tell us first — we'd rather put it right. You also have the right to complain to the Information Commissioner's Office (ICO):

ico.org.uk/make-a-complaint · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow SK9 5AF

9. International transfers

Where our processors store data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement (IDTA). We do not use providers in jurisdictions without appropriate safeguards.

10. Changes to this policy

We review this policy at least once a year and after any material change to our processing. The "last updated" date at the top reflects the most recent revision.