Introduction

Profile Surveying Services Ltd ("we", "us", or "our") is committed to protecting the privacy of individuals who visit our website and interact with us. This Privacy Policy describes how we collect, use, store, and protect personal data obtained through our website (the "Site"), including data submitted via our contact form. It also outlines your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 regarding the personal information we hold about you.

We are a UK-based surveying firm operating exclusively within the United Kingdom, and we act as the "data controller" for any personal data collected via our Site. This means we determine the purposes and means of processing that personal data. If you have any questions about this Privacy Policy or our data practices, you can contact us using the information provided at the end of this document.

By using our Site or submitting information through our contact form, you acknowledge that you have read and understood this Privacy Policy. We encourage you to read this policy carefully. If you do not agree with any part of it, please do not use the Site or provide personal information.

Data We Collect

We may collect and process the following categories of personal data:

• Information You Provide via the Contact Form: When you fill out the contact form on our website, we collect the information you submit. This typically includes your full name, email address, phone number, the type of surveying service you require, and any relevant project details or messages you include. This data is provided directly by you and is necessary for us to understand and respond to your enquiry.

• Correspondence Data: If you contact us by email, telephone, or other means (outside of the contact form), we may keep records of that correspondence, which could include your contact details and any personal information you choose to provide during the communication.

• Automatically Collected Data (Website Usage Information): When you visit our Site, certain information may be collected automatically by our web services or third-party analytics tools. This information can include your IP address, browser type and version, device identifiers, pages visited, time and date of visit, and other technical data. We use Google Analytics (a web analytics service provided by Google) to help analyze how users use the Site. Google Analytics may use cookies and similar technologies to collect this usage information. This usage data is generally aggregated and does not directly identify you, but it may be considered personal data in some cases (for example, IP addresses or unique IDs).

• Cookies and Similar Technologies: Our Site uses cookies and similar technologies for functionality and analytics. For instance, as mentioned, Google Analytics sets cookies to collect usage data. We may also use essential cookies as part of our Wix website platform to ensure the site operates correctly (including cookies that support the contact form functionality and the CAPTCHA spam prevention tool). For detailed information about the cookies we use, please refer to our Cookie Policy (if available) or contact us. (Note: If no separate cookie policy is provided, you can request more information about cookies via our contact details below.)

• reCAPTCHA Data: Our contact form is protected by Google reCAPTCHA to prevent spam and automated abuse. When reCAPTCHA is active, it may collect hardware and software information, such as device and application data, and send it to Google for analysis. This data collection is subject to Google's Privacy Policy and is used solely for the purpose of spam prevention.

Providing your personal data via our contact form or through other means on the Site is voluntary. However, if you choose not to provide the information requested on the contact form, we may not be able to respond to your enquiry or provide the information or services you are seeking.

We do not knowingly collect any special categories of personal data (such as information about health, racial or ethnic origin, political opinions, etc.) or any data about children via our website. Our Site and services are not intended for use by anyone under the age of 18. If you are a parent or guardian and believe your child has provided personal data to us, please contact us so we can remove it.

How We Use Your Data

We will only use your personal data when the law allows us to. The main purposes for which we use the data collected from our website are:

• To Respond to Enquiries: The primary use of the contact form data (your name, contact details, and enquiry information) is to respond to your specific request or question. For example, if you ask for a quote or more information about our surveying services, we will use your provided contact information and project details to formulate a response and get in touch with you. We will not use these details for any purpose unrelated to your enquiry.

• Provision of Services (Pre-Contractual Steps): If your enquiry leads to further discussions or arrangements for us to provide surveying services, we will use your information to take the necessary steps you request prior to entering into a contract. For instance, using your details to schedule a consultation or to prepare a proposal for you would be considered part of pre-contractual engagement.

• Internal Record Keeping: We may retain the correspondence and information from enquiries in order to maintain an internal record of communications. This helps us manage our relationship with current and prospective clients, follow up on enquiries, and improve our customer service. For example, if you contact us multiple times, we can refer to previous communications to better assist you.

• Website Operation and Security: Automatically collected data (like IP address and browsing information) is used to ensure our website operates smoothly and to maintain security. It helps us diagnose technical issues, administer the Site, and prevent fraud or abuse. For example, IP addresses may be used to detect unusual activity (such as multiple failed form submissions that might indicate spam).

• Analytics and Improvements: We use Google Analytics to analyze how users navigate and use our Site. This helps us understand website traffic patterns and user behaviors in an aggregated way, so we can improve the structure, content, and functionality of the Site. For instance, analytics can tell us which pages are most visited or if users encounter errors, which informs our decisions on what to update or enhance.

• Compliance and Legal Obligations: In some cases, we may need to process or retain your information to comply with legal obligations or to establish, exercise, or defend legal claims. For example, we might retain certain communications to fulfill our obligations under business record-keeping laws, or we might disclose information if required by law enforcement or a court order.

We do not use personal data collected through our contact form or any other part of our Site for unsolicited marketing purposes, and we do not engage in profiling of users in any manner not described above. We do not sell your personal data to third parties. We do not use automated decision-making or profiling based on the data you provide via the website (all decisions involving your enquiry and our services involve human review).

Legal Basis for Processing

Under UK GDPR, we must have a valid lawful basis to process your personal data. Depending on the context of your interactions with us, we rely on one or more of the following bases:

• Consent: By voluntarily providing us with your information via the contact form (and clicking submit), you are giving consent for us to use that information to respond to you. If we ever ask for information for a new purpose, we will seek your consent where required. You have the right to withdraw your consent at any time (for example, if you no longer want us to hold or use your enquiry data, you can request us to delete it).

• Legitimate Interests: We have a legitimate interest in responding to inquiries from potential clients and in ensuring our website runs securely and effectively. When you contact us for information about our services, it is within reasonable expectations that we will use your data to reply – this is a legitimate interest that does not override your rights. We also rely on legitimate interests to use data for security monitoring and analytics (improving our services), as we believe it's important to maintain the integrity and efficiency of our operations. In all cases where we rely on this basis, we consider your rights and will not use your data in ways you would not reasonably expect or that would cause unjustified harm.

• Contract (Pre-Contractual Steps): If you submit information with the intention of engaging our services, processing your personal data can be necessary to take steps at your request before entering into a contract. For instance, using your details to discuss your project requirements or to prepare a quote is directly related to a potential service contract with you.

• Legal Obligation: In rare scenarios, we may need to process certain data to comply with a legal obligation. For example, if we receive a lawful request from authorities or need to keep transaction records for tax purposes, that processing would be based on legal obligation rather than your consent or our legitimate interests.

How We Store and Protect Your Data

We implement appropriate security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. Here are key aspects of our data storage and protection practices:

• Data Storage Locations: Personal data submitted through our contact form is stored in two primary locations: (1) within the Wix platform (our website host) and (2) in our business email system. Wix stores form submission data in its secure databases, allowing us to view and manage your enquiry through their platform. Additionally, when you submit a form, an email copy of your submission is sent to us, which means your data also resides in our email inbox.

• Security Measures: Wix is a reputable hosting provider that employs security measures such as encryption and firewalls to protect data on its servers. Any personal data stored in Wix is subject to their security protocols, including encryption at rest and secure (HTTPS) transmission. Our own email accounts are protected with strong passwords and (where available) two-factor authentication, and our devices are secured and kept updated with antivirus and other security tools. We also utilize SSL/TLS encryption on our website, which means that the data you enter in the contact form is encrypted in transit to prevent eavesdropping.

• Limited Access: Access to personal data collected via the contact form (whether on Wix or in our email) is restricted to authorized personnel at Profile Surveying Services Ltd who need to process that data in order to respond to your enquiry or perform their job duties. We do not share login credentials or grant access to our Wix database or email inbox to any unauthorized individuals. Our staff are trained to handle personal data confidentially and are bound by obligations to protect it.

• Third-Party Data Processors: We have agreements or terms in place with our third-party service providers (like Wix and Google) to ensure they also protect your data. These providers are bound by data protection obligations, meaning they must only use the data for the purposes we've specified and must apply appropriate security measures. For example, Wix acts as our data processor and is contractually committed to safeguarding personal data and complying with GDPR requirements. Google, in providing Analytics and reCAPTCHA, is also required to protect data according to their published terms and data processing addenda.

• No Guarantee of Absolute Security: While we use commercially reasonable efforts to safeguard your personal data, no method of transmission over the internet or method of electronic storage is completely secure. Therefore, we cannot guarantee its absolute security. In the unlikely event of a data breach that affects your personal data, we will follow legal requirements to inform the Information Commissioner’s Office (ICO) and, where required, notify you as well.

Data Sharing and Third-Party Processors

We do not sell or rent your personal information to marketers or unrelated third parties. However, we do share certain data with trusted third parties who help us operate our website and deliver our services. These third parties act on our behalf (as "data processors") or in partnership with us (for example, Google may act as an independent controller for some analytics data). We ensure that any third party we share data with is bound to comply with privacy laws and to protect your information. The main third parties we work with are:

• Wix.com (Website Hosting Platform): Our website is built on and hosted by Wix.com. All data that you submit through the Site (including contact form entries) is transmitted to and stored on Wix's servers. Wix provides us with the online platform that allows us to manage our content and communications. Wix may process this data for the purpose of storage and enabling us to access it, but they do not use your form submission details for their own purposes. Wix’s infrastructure may involve servers outside the UK; however, Wix is GDPR-compliant and implements safeguards (like data encryption and adherence to approved international transfer mechanisms) to protect your data. (See the International Data Transfers section below for more on how Wix handles global data storage.)

• Email Service Provider: Our contact form submissions are forwarded to us via email. We use [Name of Email Provider] as our email service (e.g., Outlook/Microsoft 365, Gmail/Google Workspace, or another provider). This means that when you submit a form, the content of your enquiry (including personal details) is handled by our email provider and stored on their servers as part of our mailbox. These providers typically have strong security measures and comply with data protection standards. They will not access or use the content of our emails except as needed for service provision (for instance, spam filtering or technical support) or if required by law.

• Google Analytics: We use Google Analytics to collect information about how visitors use our Site. Google Analytics uses cookies and similar technologies to gather data such as your IP address (which we have set to anonymize), browser type, pages visited, and time spent on the Site. This information is processed by Google and presented to us in aggregate form (for example, total number of visitors, average time on page, etc.), helping us improve the website. Google acts as a data processor for this analytics data under our agreement with them. We do not send Google any personally identifiable information like your name or contact details. You can opt out of Google Analytics tracking by using Google's opt-out browser add-on or by adjusting your cookie settings to refuse analytics cookies.

• Google reCAPTCHA: Our use of Google reCAPTCHA means that when you use our contact form, the reCAPTCHA widget may collect certain information from your device and send it to Google to help determine if the submission is made by a human. This typically includes checking any Google cookies stored on your browser, your IP address, and mouse movements or other behavioral cues. Google processes this information solely to provide the spam protection service. We do not receive any of the data that Google collects for reCAPTCHA beyond the simple result (pass or fail). Google’s role in this is as a service provider focused on security, and information collected by reCAPTCHA is handled in accordance with Google's Privacy Policy. By using our form, you implicitly agree to this exchange of data with Google for security purposes.

• Legal Compliance or Protection: We may disclose personal information to third parties if required to do so by law or if we believe such action is necessary to: (i) comply with a legal obligation (e.g., a court order or subpoena), (ii) protect and defend our rights or property, (iii) prevent or investigate possible wrongdoing in connection with our services, (iv) ensure the personal safety of users of the Site or the public, or (v) protect against legal liability. In such cases, we will only share the information that is necessary and will do so in accordance with data protection law.

• Business Transfers: In the event that Profile Surveying Services Ltd is involved in a merger, acquisition, restructuring, or sale of assets, personal data held by us may be transferred to the other party as part of that transaction. The new owner (or merging entity) would continue to be bound by the terms of this Privacy Policy (or one with equivalent protections) in relation to your personal data. We will notify you of any such change in ownership or control of your personal information, if it occurs.

In all cases where a third party processes your data on our behalf, we ensure they only process it for specified purposes and under our instructions, and that they protect it to the standard required by law. We do not share your data with any third parties for marketing or profiling purposes.

International Data Transfers

As a UK-based business, we primarily process personal data within the UK. However, some of our service providers are international companies, which means your data may be transferred to, or accessed from, servers located in other countries. Whenever personal data is transferred out of the UK, we will ensure that appropriate safeguards are in place to protect it, in accordance with UK GDPR requirements.

• Wix.com: Wix is headquartered in Israel and also utilizes servers and infrastructure in other countries (such as the EU and the United States). Israel is recognized by the UK government as providing an adequate level of data protection (meaning that personal data can flow from the UK to Israel just as it would within the UK). When Wix transfers data to other jurisdictions (for example, to the US for backup or processing), it relies on mechanisms like Standard Contractual Clauses (SCCs) to ensure that the data remains protected to UK/EU standards. In short, any personal data stored in Wix is safeguarded regardless of where their servers are physically located.

• Google (Analytics and reCAPTCHA): The data collected by Google Analytics and Google reCAPTCHA may be processed on servers outside the UK, including in the United States. Google is certified under the EU-US Data Privacy Framework (as of 2023) and in any case, Google uses SCCs and other legally valid mechanisms for data transfers from the UK/EEA to the US. We've also enabled IP anonymization in Google Analytics to add a layer of privacy protection. While using our Site will result in some data being transferred to Google’s systems in other countries, these transfers are covered by agreements and safeguards designed to protect your information.

• Email and Cloud Services: If our email service provider or any other cloud-based tools we use (for example, data backup or customer relationship management tools) store or process data outside the UK, we will ensure that such transfers are protected. Many enterprise email providers (e.g., Microsoft, Google) store data in data centers across Europe and the US. We rely on their compliance measures (such as SCCs and robust security certifications) to protect any data that might cross borders. In any case, the nature of data in our emails from the contact form is the same information you provide, and we treat it with the same care wherever it is stored.

By submitting your personal data to us (e.g., via the contact form), you acknowledge that it may be transferred, stored, and processed outside of the UK by our service providers. We will always take steps to ensure your data is handled securely and in line with this Privacy Policy and applicable laws, regardless of where it is processed.

If you would like more information about our international data transfer practices or specific details about safeguards in place, please contact us using the information at the end of this Privacy Policy.

Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including for satisfying any legal, accounting, or reporting requirements.

• Contact Form Enquiries: By default, we keep the information you submit through the contact form indefinitely, unless you request deletion. This is to ensure that if you contact us again in the future or have follow-up questions, we have a record of your initial enquiry and our response. It also helps us track our communications history. However, we regularly review stored enquiries. If we find that certain enquiry records are no longer needed (for instance, inquiries that did not lead to any business and are several years old), we may remove those from our systems as part of good data hygiene.

• Email Records: If your enquiry was sent to us via email (including the auto-generated emails from the contact form), those emails may be stored in our email archives. We typically retain emails for our records, but we will delete them when they are no longer necessary. We also honor deletion requests by searching for and removing your correspondence from our email archive, unless retention is required for legal reasons.

• Analytics Data: Data collected through Google Analytics is retained as per Google's policies and our configuration (commonly, aggregated analytics data is kept for 14 months or more, but it does not directly identify individuals). We don't hold this data in an identifiable form ourselves; it's managed within our Google Analytics account.

• Legal and Contractual Records: If your enquiry leads to a contract or if we otherwise have to retain your information for legal purposes, such information may be retained in accordance with applicable laws (for example, contract details or invoices might be kept for six years for tax purposes). Such data would be outside the scope of a basic enquiry and handled under our client data protection procedures.

Importantly, if you ask us to delete your personal data, we will do so (see "Your Rights" below for more details on the right to erasure). For example, if you submitted a contact form and later request that we remove your information, we will delete your submission from Wix and our email records, provided we have no overriding requirement to keep it.

We also periodically audit the personal data we hold to ensure we are not keeping it longer than necessary. Our retention practices are thus subject to regular review to ensure compliance with data protection principles.

Your Rights Under Data Protection Law

As a user interacting with us and as a data subject under UK GDPR, you have certain rights regarding your personal data. We are committed to respecting and facilitating these rights:

• Right of Access: You have the right to request access to the personal data we hold about you, and to request information about how we process it (commonly known as a "Subject Access Request"). We will provide you with a copy of your data, along with relevant details (such as the purposes of processing and the categories of data involved), usually within one month of your request.

• Right to Rectification: If any personal data we have about you is incorrect or incomplete, you have the right to have it corrected. You can ask us to update or correct inaccurate information (for example, to correct a misspelled name or update contact details).

• Right to Erasure: You have the right to request that we delete your personal data. This right (also known as the "right to be forgotten") applies in certain circumstances – for instance, if the data is no longer necessary for the purpose it was collected, if you withdraw consent and no other legal basis for processing applies, or if you object to processing and we have no overriding legitimate grounds to continue. If you request deletion of data obtained through the contact form, we will delete your information from both Wix and our email records, unless we are required by law to keep it. Keep in mind that we may need to retain some information if you became a client, for contractual or legal reasons, but enquiry data can generally be erased on request.

• Right to Restrict Processing: You can ask us to restrict the processing of your data in certain situations. This means we would store your data but not use it further (beyond maintaining the restriction). You might request restriction if you contest the accuracy of your data and want us to verify it, or if you have objected to our processing (see below) and want us to stop processing while your objection is being considered. If processing is restricted, we will inform you before lifting the restriction.

• Right to Object: You have the right to object to our processing of your personal data when we are relying on legitimate interests as the lawful basis. If you object, we will stop processing your data for that purpose unless we have compelling legitimate grounds to continue (such as a legal requirement or a strong justification that overrides your rights). Note that if you object to processing needed to respond to your enquiry (for example, you object to us using your email to reply to you), we may not be able to fulfill your request. Importantly, you have an absolute right to object to any use of your data for direct marketing purposes. However, as stated, we do not use your data for unsolicited marketing.

• Right to Data Portability: For data that you have provided to us and that we process by automated means based on your consent or in order to fulfill a contract with you, you have the right to obtain a copy of such data in a structured, commonly used, machine-readable format, and to have it transmitted to another data controller where technically feasible. In practice, the data you provide via the contact form (name, contact info, project details) can be provided in a simple format (like a CSV or text file) upon request. This right is intended to allow you to reuse your data across different services.

• Right to Withdraw Consent: Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. For example, if you gave consent for us to keep your details on file for future contact and you change your mind, you can notify us to remove your data. Withdrawing consent will not affect the lawfulness of any processing we carried out before your withdrawal. If you withdraw consent, we will cease the processing for which consent was required (and, as appropriate, delete the data) unless another lawful basis applies.

• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions made solely on automated processing (including profiling) that produce legal or similarly significant effects on you. We do not engage in any solely automated decision-making processes that would adversely affect you. There is no profiling or algorithmic decision affecting your access to our services; all decisions (such as responding to enquiries or offering services) involve human involvement.

To exercise any of your rights, please contact us using the contact information in the "Contact Us" section below. We may need to verify your identity before fulfilling certain requests, to ensure that we do not disclose personal data to anyone who is not entitled to receive it.

We will respond to your request as quickly as possible, and in any event within the time frame required by law (generally one month, with the possibility of extension by two further months for particularly complex requests – we will inform you if an extension is needed). There is no fee for exercising your rights unless the requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request with an explanation.

Complaints and Contacting Authorities

If you have any concerns or complaints about how we handle your personal data, we encourage you to contact us first so that we can try to resolve the issue. We take privacy complaints very seriously and will do our best to address your concerns.

However, if you are not satisfied with our response or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK supervisory authority for data protection matters, which is the Information Commissioner’s Office (ICO).

• Information Commissioner's Office (ICO): You can find guidance on their website https://ico.org.uk/ or contact them by phone at 0303 123 1113. Their postal address is Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. The ICO can provide independent advice and will investigate your complaint if necessary.

Again, we would appreciate the opportunity to address your concerns before you approach the ICO, so please consider reaching out to us with any issues.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we update the policy, we will post the new version on this page and update the "Last Updated" date below. If the changes are material, we may also provide a more prominent notice (such as a banner on our website or an email notification, if we have your email address).

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data. Your continued use of our Site or services after any changes to this Privacy Policy constitutes your acceptance of the updated terms (to the extent permitted by law).

Contact Us

If you have questions about this Privacy Policy, or if you wish to exercise any of your rights or make a request regarding your personal data, please contact us as follows:

Profile Surveying Services Ltd
Queen Mary Lodge, Duffield Road, Derby, DE22 1AA
Email: info@surveywithprofile.co.uk
Phone: 01332 480526

You may also contact us through our website’s contact form for any privacy-related inquiries or requests.

We will do our best to address your questions and resolve any issues to your satisfaction.

Last Updated: April 14, 2025