Privacy policy

This policy explains what personal information Fanneran & Sons collects through this website, why we collect it, how long we keep it, and what rights you have over it under UK data protection law.

Who we are

Fanneran & Sons is a family-run decorating and home improvements business operating across London. For the purposes of UK GDPR and the Data Protection Act 2018 we are the “data controller” for information collected through this website.

You can contact us about anything in this policy:

• Email: quotes@fanneranandsons.co.uk
• Phone: 07956 658896

What we collect, and when

When you submit the quote form

We collect the information you type into it: your name, email address, phone number, the service and area you select if you fill those in, and the project description you write. Alongside that, our server records your IP address and the time of submission, which we use to detect and block automated spam.

When you simply browse the site

Our web host keeps standard server logs, which include IP addresses, the pages requested and the time of the request. These are generated automatically by the hosting infrastructure and are used for security and troubleshooting.

Cookies

This site sets one cookie of its own, named fanneran_session. It is a strictly necessary session cookie that exists solely to protect the quote form against cross-site request forgery — it holds no personal information, is not used for analytics or advertising, and expires when you close your browser. Because it is strictly necessary for a service you have requested, it does not require consent under the Privacy and Electronic Communications Regulations.

We do not use advertising cookies, tracking pixels, or third-party analytics on this site.

Why we are allowed to use it (lawful basis)

• Responding to your enquiry — our lawful basis is legitimate interests: you have asked us for a quote, and we cannot provide one without your contact details. Where an enquiry leads to work, our basis becomes performance of a contract.
• Preventing spam and abuse — legitimate interests in keeping the site and our inbox usable and secure.
• Server logs and security — legitimate interests in operating the site safely.

We do not use your information for marketing, and we will not add you to a mailing list because you asked for a quote.

Who we share it with

We do not sell your data and we do not share it for marketing. It is handled by the following, each acting on our behalf or as an independent controller for their own limited purpose:

• IONOS — our web hosting and email provider. Your form submission passes through their servers and arrives in our mailbox with them.
• Cloudflare — provides the Turnstile anti-spam check on the quote form. Cloudflare receives technical information from your browser, including your IP address, in order to distinguish a person from a bot. Cloudflare states that Turnstile does not use this data to build advertising profiles.
• Google Fonts — the site’s typeface is served from Google’s font network, which means your browser makes a request to Google and your IP address is visible to them as part of that request. No cookie is set by this.

We may also disclose information where we are legally required to do so.

Where your data goes

Our hosting is UK/EU based. Some of the service providers above are international organisations that may process data outside the UK; where that happens, they rely on safeguards such as the UK International Data Transfer Agreement or the UK Extension to the EU–US Data Privacy Framework.

How long we keep it

• Enquiries that do not lead to work — kept for up to 24 months, so we can recognise you if you come back to us, then deleted.
• Enquiries that lead to work — kept for 6 years after the job completes, which is the period in which a contractual claim could be brought and the period our accounting records must cover.
• Anti-spam records — the IP-derived record used for rate limiting is stored in a non-reversible hashed form and is discarded within 30 minutes.
• Server logs — retained by our host according to their standard retention period.

How we protect it

The whole site is served over HTTPS. The quote form is protected by a CSRF token, a strict Content Security Policy, rate limiting and an anti-bot check. Configuration and credentials are stored outside the public web directory. Access to the mailbox that receives enquiries is limited to the people in the business who need it.

Your rights

Under UK GDPR you have the right to:

• ask what personal data we hold about you, and receive a copy;
• have inaccurate data corrected;
• ask us to delete your data, where we have no overriding reason to keep it;
• ask us to restrict how we use it, or object to our use of it on legitimate-interests grounds;
• ask for your data in a portable format;
• withdraw consent where we have relied on it.

To exercise any of these, contact us using the details above. We will respond within one month. There is no charge.

Complaints

If you are unhappy with how we have handled your data, please tell us first and we will try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Children

This site is not directed at children and we do not knowingly collect personal data from anyone under 16.

Changes to this policy

If we change how we handle personal data we will update this page and the “last updated” date above.