This Privacy Policy describes how insulationcontractorslondon.com may collect and process personal data when visitors access the website or use its features. The site publishes educational information about energy efficiency, floor insulation, loft insulation, roof insulation, and wall insulation.
This document is a template and must be adapted to the website’s actual operations before publication. The identity of the data controller, purposes of processing, legal bases, retention periods, service providers, and applicable rights must be confirmed rather than assumed.

2. Categories of Personal Data

Depending on the website’s configuration, technical data may be processed when a visitor opens a page. This may include an IP address, browser and device information, requested pages, timestamps, and server logs. Such information may be used to deliver the website, maintain security, investigate technical problems, and prevent misuse.
If a contact form or feedback tool is provided, information voluntarily submitted by a visitor may also be processed. This could include a name, message, or other details entered into the form. The website should request only information necessary for the stated purpose.
Cookies and similar technologies may process additional information if they are implemented. The final policy must accurately describe the tools actually used.

3. Purposes and Legal Bases

Personal data should be processed for specified and legitimate purposes, such as operating the website, responding to relevant inquiries, protecting systems, meeting legal obligations, or understanding website performance.
Under the General Data Protection Regulation (GDPR), each processing activity must have an appropriate legal basis. Depending on the circumstances, this may include consent, steps requested by the individual, compliance with a legal obligation, or legitimate interests where those interests have been properly assessed. The controller must identify the correct basis for each activity.

4. Cookies and Similar Technologies

The website’s use of cookies depends on its technical configuration. Technologies that are strictly necessary for a service requested by the visitor or for permitted technical purposes may be treated differently from non-essential tracking tools.
Where required by law, analytics, advertising, or other non-essential technologies must not be activated before valid consent is obtained. Visitors should be able to manage their preferences and withdraw consent as required.
If the website uses analytics platforms, advertising services, embedded videos, maps, social media features, or other third-party tools, the policy must identify the relevant providers and explain the purposes and associated data processing. Remove any descriptions of technologies that are not actually used.

5. Sharing Personal Data

Data may be made available to hosting providers, technical support providers, security services, or other processors where necessary to operate and protect the website. Appropriate data-processing agreements and safeguards should be established where required by law.
Personal data should not be disclosed to unrelated parties without a valid legal basis. Any actual recipients or categories of recipients must be accurately described in the final published policy.

6. International Transfers

If personal data is transferred outside the European Economic Area, the controller must ensure that the transfer complies with the GDPR. Depending on the destination and circumstances, this may require an adequacy decision, appropriate safeguards, or another lawful mechanism. The final policy should describe relevant transfers and safeguards where applicable.

7. Retention and Security

Personal data should be retained only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by law. The website operator should establish actual retention periods for server logs, messages, and other data categories.
Appropriate technical and organisational measures should be used to protect personal data from unauthorised access, accidental loss, alteration, or disclosure. No method of electronic storage or transmission can be guaranteed to be completely secure.

8. Data Protection Rights

Depending on the circumstances and subject to legal conditions, individuals may have the right to access their personal data, correct inaccurate information, request erasure or restriction, object to certain processing, and receive data in a portable format where applicable.
Where processing is based on consent, individuals may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Individuals may also have the right to lodge a complaint with a competent supervisory authority.
The final policy must provide a valid way to contact the data controller to exercise these rights. The controller may need to verify a requester’s identity before disclosing or changing personal data.

9. Children’s Privacy

The website provides general educational information and is not specifically designed to collect children’s personal data. The operator should not knowingly process children’s information in a way that breaches applicable law. If such information is identified, appropriate action should be taken in accordance with legal obligations.

10. Third-Party Websites

The website may contain references or links to third-party websites. Those websites operate under their own privacy policies and practices. Visitors should review those policies before sharing personal data with external providers.

11. Policy Updates

This Privacy Policy may be revised when the website’s features, data-processing activities, or legal obligations change. The latest version and its effective or updated date should be made available on the website.

12. Controller Information and Compliance Review

Before publication, the operator must add the data controller’s identity and valid contact details, confirm the hosting provider and server-log practices, list actual cookies and third-party tools, define retention periods, and identify the legal basis for each processing activity. This template alone does not guarantee GDPR compliance. Compliance depends on the website’s actual practices and the legal requirements that apply.