Privacy Notice
Last updated: 24 August 2026 · Version 1 (draft for owner review)
This notice explains how HJE Group Ltd handles personal data through this website. It has been drafted from what this website technically does. Items marked [OWNER INPUT REQUIRED: example] still need to be confirmed by us before this notice is treated as final.
Who we are
- Controller: HJE Group Ltd — [OWNER INPUT REQUIRED: confirm full registered legal name and company number]
- Trading name: HJE Group
- Address: Unit 3a, Cornstores, Heol Ty Gwyn, CF34 0HP
- Telephone: 07817 665408
- Privacy contact: [OWNER INPUT REQUIRED: privacy contact email address]
- Data Protection Officer: [OWNER INPUT REQUIRED: confirm whether a DPO is required and appointed]
- ICO registration: [OWNER INPUT REQUIRED: ICO data protection fee registration number, if registered]
- EU/UK representative: [OWNER INPUT REQUIRED: confirm whether an Article 27 representative is required]
Personal data we collect
Information you give us — through the enquiry form on our Contact page: your name, email address, telephone number (optional), the service you are interested in (optional), and the contents of your message. If you tick the optional marketing box, we also record that preference.
Information collected automatically — your IP address, browser user agent and the pages you request, recorded in our hosting and database provider's standard server logs for security and reliability. We run no analytics or advertising tracking on this website.
Staff accounts — for our own team only: email address, authentication credentials (stored hashed by our provider), role, and sign-in timestamps.
Information from third parties — none is collected through this website.
We do not intentionally collect special category data. Please do not include health, criminal or other sensitive details in an enquiry message unless we ask for them. If a service you enquire about could involve such information, we will explain separately how we handle it. [OWNER INPUT REQUIRED: confirm whether any service intake involves special category data, e.g. hoarding or hospital discharge work]
How we use personal data and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to your enquiry and quoting for work | Name, email, phone, service, message | Steps taken at your request prior to entering a contract, or legitimate interests in responding to business enquiries. [OWNER INPUT REQUIRED: confirm which basis; if legitimate interests, keep a Legitimate Interests Assessment] |
| Providing the services you engage us for | Contact and job details | Performance of a contract |
| Keeping the website secure and available | IP address, user agent, request logs | Legitimate interests (network and information security) |
| Remembering your cookie choice | Category flags, timestamp, policy version | Legal obligation / strictly necessary to provide the choice you made |
| Optional marketing emails | Name, email, marketing preference | Consent (only if you tick the optional box). You can withdraw at any time. |
| Business records, invoicing and legal compliance | Customer and transaction records | Legal obligation. [OWNER INPUT REQUIRED: confirm accounting/records obligations relied on] |
We do not carry out profiling, behavioural advertising, or automated decision-making producing legal or similarly significant effects through this website.
Who we share personal data with
- Supabase — Database, authentication and API hosting for site content and enquiries. Role: Processor (acting on our instructions). Data shared: Enquiry name, email, phone, service interest, message; staff account email; connection IP addresses in provider logs.
- Lovable (hosting / CDN) — Website hosting, image asset delivery and TLS. Role: Processor (acting on our instructions). Data shared: IP address, user agent and requested URL, in standard server logs.
- Unsplash — Stock photography image CDN. Role: Independent controller for its own CDN logs. Data shared: Your IP address and browser user agent, as part of the image request. Unsplash sets no cookies on our domain and none were observed in the runtime audit.
- We may also share information with professional advisers, insurers or authorities where we are legally required to do so.
We do not sell personal data and we do not share it with advertising networks.
International transfers
Some of our providers may process data outside the UK/EEA. Where that happens we rely on UK adequacy regulations, the UK International Data Transfer Agreement, or Standard Contractual Clauses with the UK Addendum, as applicable. [OWNER INPUT REQUIRED: confirm each provider's hosting region and the specific transfer mechanism in your contract with them (Supabase, hosting/CDN, Unsplash image CDN)]
How long we keep it
- Website enquiries: [OWNER INPUT REQUIRED: retention period for unsuccessful enquiries]
- Customer records: [OWNER INPUT REQUIRED: retention period]
- Financial and invoice records: [OWNER INPUT REQUIRED: retention period based on your accounting/tax obligations]
- Marketing preferences: kept until you withdraw consent, plus a record of the withdrawal
- Staff admin accounts: for the duration of employment/engagement plus [OWNER INPUT REQUIRED: period]
- Server logs: as retained by our providers by default
- Cookie consent record: 6 months, then you are asked again
Your rights
Depending on the lawful basis that applies, you have the right to be informed; to access your data; to rectification; to erasure; to restrict processing; to data portability; to object to processing (including a right to object to direct marketing at any time); rights relating to automated decision-making; and the right to withdraw consent where we rely on consent. Some rights only apply in certain circumstances.
To make a request, contact us using the details above ([OWNER INPUT REQUIRED: privacy contact email address]). We may need to verify your identity. We will respond within one month.
You can also complain to the Information Commissioner's Office — ico.org.uk, helpline 0303 123 1113. If you are in the EEA you may also complain to your local supervisory authority.
Children
This website is aimed at businesses and property owners and is not directed at children. [OWNER INPUT REQUIRED: confirm this statement is accurate for your services]
Cookies
See our Cookie Notice for the full inventory and to change your preferences at any time.
Changes to this notice
We will update this page when our processing changes and change the version number and date at the top. Material changes to cookie use will also trigger a fresh consent request.