Your data.Your data.Our contract.Our contract.

PrimeCraft Surface Solutions Ltd is a company registered in England & Wales (Co. No. 16070669) with registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF (“PSS”, “we”, “us”). We design and build bathrooms, kitchens, carpentry, flooring and full property renovations across Greater London and the Home Counties.

For data-protection purposes, PSS is the data controller of the personal information we collect about you. You can reach us at info@pssconstruction.co.uk.

When you enquire with us, we collect the minimum we need to help:

• Your name
• Email address and phone number
• Postcode (so we can confirm coverage and arrange a site visit)
• Details about the project you’re planning
• Any photos or documents you choose to send us

When you browse the website, we and our analytics providers (see section 8) automatically collect technical data: IP address, device and browser type, screen size, referring page, pages you visit, time on page, clicks and scroll position. Microsoft Clarity also records an anonymised replay of your session (mouse movements, clicks and scrolls — text you type into form fields is masked by default).

We do not collect special-category data (health, ethnicity, religion, etc.) and we do not ask for payment details on this website — invoicing is handled separately once a project is agreed.

We use your information to:

• Respond to your enquiry and arrange a site visit
• Prepare an itemised quote for your project
• Communicate with you during any works we carry out
• Keep records required for tax, insurance and building control
• Understand how visitors use the website so we can improve it (page popularity, where the contact form gets stuck, broken links)
• Measure the effectiveness of advertising we run on Google and Meta (Facebook/Instagram) — only with your consent via the cookie banner

Our lawful bases are:

• Contract — taking steps to enter into a contract with you and performing it (responding to enquiries, delivering projects)
• Legitimate interest— running our business, understanding website performance, protecting against fraud. We’ve carried out a balancing test and concluded the impact on you is minimal because the data is masked, aggregated and used purely to improve the service
• Consent — advertising and marketing cookies are only set if you accept them via the cookie banner. You can withdraw consent at any time (section 10)
• Legal obligation — keeping financial and project records as required by HMRC, building control and our insurers

We never sell your data. We share it only where it’s necessary to deliver your project or run the website:

• Trades on your project — our tiler, electrician, Gas Safe registered engineering partner, etc. Only the information they need to do the work.
• Our accountant and insurer — where required by law or for claims handling.
• Vercel Inc. (United States) — hosts this website, stores enquiry records (managed Postgres), holds any photos uploaded through the estimator (managed Blob storage), and provides aggregated cookieless page-view analytics.
• Resend(United States) — sends transactional emails (your enquiry confirmation, our team’s notification).
• Microsoft Corporation (United States) — runs Microsoft Clarity, which captures anonymised session replays and heatmaps so we can see how the site is used (section 8).
• Google LLC (United States) — runs Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking. Only loaded with your consent via the cookie banner (section 9).
• Meta Platforms Inc. (United States) — runs the Meta Pixel and Conversions API for Facebook/Instagram ad measurement. Only loaded with your consent via the cookie banner (section 9).

International transfers. Several of our processors are based in the United States. Personal data transfers to the US are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the “UK IDTA”) and, where the receiving organisation is certified, under the UK Extension to the EU–US Data Privacy Framework. Each provider publishes its own transfer-impact assessment which we have reviewed.

You can request copies of the relevant safeguards by emailing info@pssconstruction.co.uk.

Enquiry details we don’t take forward are kept for up to 12 months, then deleted.

Records relating to projects we complete are kept for up to 7 years to comply with accounting, tax and potential warranty-claim obligations.

Microsoft Clarity session recordings are retained by Microsoft for up to 12 months on their platform before automatic deletion.

Google Analytics 4 retains user-level and event-level data for up to 14 months(we’ve set this to the shortest available value in the GA4 console).

Under UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (right of access)
• Correct anything that’s inaccurate (right to rectification)
• Delete your data where we no longer need it (right to erasure)
• Restrict how we use it while we sort something out (right to restriction)
• Transfer it to another provider in a machine-readable format (right to portability)
• Object to processing based on legitimate interest (right to object)
• Withdraw consent for any processing we do under consent (cookies, advertising tags) at any time — this won’t affect anything we did with your data before you withdrew

Email us at info@pssconstruction.co.uk and we’ll respond within one month.

If you’re not happy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk (helpline 0303 123 1113). We’d appreciate the chance to put things right first, but you don’t have to come to us before contacting the ICO.

A cookie is a small text file stored on your device when you visit a website. We use a small number of cookies — some are required for the website to work, others help us understand how it’s used, and others measure advertising we run.

When you first visit the site you’ll see a cookie banner. Strictly necessary cookies are always set. Analytics and advertising cookies only load if you choose to accept. You can change your choice at any time by clearing your browser cookies for pssconstruction.co.uk — the banner will reappear on your next visit.

Strictly necessary (always on)

• pss-consent-v2 — records whether you accepted or declined non-essential cookies (12-month lifetime, this domain only).
• Any temporary cookies set by Vercel for routing and abuse protection.

Analytics & advertising (only set if you accept)

• _ga, _ga_* — Google Analytics 4 identifiers (2-year lifetime, used to count unique visits and sessions in aggregate).
• _gcl_au, _gcl_aw — Google Ads click identifiers, set if you arrived via a Google Ad (90-day lifetime).
• _fbp — Meta Pixel browser identifier, used to attribute conversions back to Facebook/Instagram ads (90-day lifetime).

We also use Google Consent Mode v2 — before you accept the banner, Google’s tags load in a consent-denied state. They don’t set cookies and send only aggregated, non-identifying pings to Google so we can still see conversion volumes without identifying any individual.

We use Microsoft Clarityto understand how visitors use the website — which sections get read, where people click, whether the contact forms work as intended. It records an anonymised replay of your session and aggregates that into heatmaps.

What it captures

• Mouse movements, clicks and scroll position
• Screen size, browser, device type, country (city-level at most)
• The pages you visit on this site and how long you spend on each

What it does NOT capture

• Text you type into any form is masked by default — Clarity records that you typed something, not what you typed
• Passwords (these are never shown to Clarity by the browser)
• Your full IP address (Clarity stores a redacted form for geo-region only)
• Payment details (we don’t take payments on this site)

Legal basis. We rely on legitimate interest. We’ve carried out a balancing test (the Legitimate Interests Assessment required by UK GDPR Article 6(1)(f)) and concluded the impact on you is minimal because the recording is anonymised, form input is masked, and Clarity is contractually prohibited from using the data for its own marketing. A copy of the LIA is available on request.

Cookieless.Microsoft Clarity operates in a cookieless mode on our site — it doesn’t store cookies on your device.

Independent of the cookie banner. Because Clarity is cookieless and relies on legitimate interest rather than consent, it is active for all visitors and is not switched on or off by the Accept or Reject buttons in the cookie banner — those buttons control Google and Meta advertising cookies only. You can still opt out of Clarity at any time using Do Not Track or by emailing us, as set out below.

How to opt out. Enable the Do Not Track setting in your browser (Clarity respects it), or email us at info@pssconstruction.co.uk and we’ll exclude your session data and delete any existing recordings.

More information. Microsoft publishes a Clarity-specific privacy statement at learn.microsoft.com/clarity.

If you accept the cookie banner, we use Google Tag Manager to load:

• Google Analytics 4 — aggregated page views, events, conversion paths. Used to understand which marketing channels are working.
• Google Ads conversion tracking — measures the return on any ads we run on Google Search and YouTube. Only fires if you arrived from a Google ad click.
• Meta Pixel + Conversions API — measures the return on ads we run on Facebook and Instagram. The Conversions API is a server-side complement to the browser Pixel; we send Meta a hashed (one-way encrypted) version of your email if you submit an enquiry, so they can match it to your Facebook account and report whether you came from an ad. Hashing is done before transmission — Meta never receives your plain email.

If you don’t accept, none of these set cookies and Google Consent Mode keeps them in a denied state. The Meta Conversions API will not fire either.

To stop these processing your data even on other sites, you can opt out at:

• Google ad personalisation: adssettings.google.com
• Meta ad preferences: facebook.com/ads/preferences
• Your Online Choices (UK industry opt-out): youronlinechoices.com/uk

We do not use automated decision-making or profiling to take decisions that significantly affect you. The price-range estimator on this website produces an indicativefigure only — it’s a calculator, not a quote. Every real quote is reviewed and confirmed by a human (us) in person after a site visit.

Our services are aimed at property owners. The website isn’t directed at children and we don’t knowingly collect personal data from anyone under 18. If you believe a child has provided us with information, email us at info@pssconstruction.co.uk and we’ll delete it.

The website is served over HTTPS only. Personal data submitted via the contact form is encrypted in transit (TLS 1.2+) and stored in Vercel’s managed Postgres with at-rest encryption. Access to the database is restricted to the PSS founders.

We don’t store credit-card numbers anywhere on this site or our systems — payment is taken offline via bank transfer once a project is agreed.

If a personal-data breach occurs and there’s a risk of harm to you, we’ll notify the ICO within 72 hoursand inform you directly without undue delay, as required by UK GDPR Articles 33–34.

If we update this policy, the “Last updated” date at the top of this page will change. Material changes (new processors, new tracking, new lawful bases) will be notified by email to anyone we hold an active enquiry or project record for, and via a banner on the website for new visitors.