Your data.Our contract.

PrimeCraft Surface Solutions Ltd is a company registered in England & Wales (Co. No. 16070669) with registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF (“PSS”, “we”, “us”). We design and build bathrooms, kitchens, carpentry, flooring and full property renovations across Greater London and the Home Counties.

For data-protection purposes, PSS is the data controllerof the personal information we collect about you. We are registered with the Information Commissioner’s Office under registration number ZC230116. You can reach us at info@pssconstruction.co.uk.

When you enquire with us, we collect the minimum we need to help:

• Your name
• Email address and phone number
• Postcode (so we can confirm coverage and arrange a site visit)
• Details about the project you’re planning
• Any photos or documents you choose to send us

When you browse the website, we and our analytics providers (see section 8) automatically collect technical data: IP address, device and browser type, screen size, referring page, pages you visit, time on page, clicks and scroll position. Microsoft Clarity also records an anonymised replay of your session (mouse movements, clicks and scrolls — text you type into form fields is masked by default).

How you reached us.If you arrive from an advertisement, a search result or another website, we store how you got here in a cookie on your device (“pss_attr”, section 7): the campaign and advert name from the link you clicked, any Facebook or Google click identifier, the website that referred you, and the first page you landed on. If you later send an enquiry, that record is attached to it so we can tell which advertising actually brings people to us. It contains no name, email or phone number, and it is never shared with anyone. It is stored only if you accept in the consent dialog; if you reject, nothing is written, and if you change your answer to reject later it is deleted from your device.

Where your enquiry is kept. Enquiries sent through any form on this site are emailed to us and also saved in our own database (section 4), together with the technical details above — your IP address, your browser identification, the page you submitted from, and the how-you-reached-us record.

We do not collect special-category data (health, ethnicity, religion, etc.) and we do not ask for payment details on this website — invoicing is handled separately once a project is agreed.

We use your information to:

• Respond to your enquiry and arrange a site visit
• Prepare an itemised quote for your project
• Communicate with you during any works we carry out
• Keep records required for tax, insurance and building control
• Understand how visitors use the website so we can improve it (page popularity, where the contact form gets stuck, broken links)
• Measure the effectiveness of advertising we run on Google and Meta (Facebook/Instagram). The tracking that runs in your browser only loads if you accept the cookie banner. Measurement we send from our own server when you submit an enquiry is not controlled by the banner — section 10 explains exactly what that is and how to object to it
• Send you follow-up emails about your enquiry, and our occasional newsletter if you asked for it (section 11)
• Protect our forms from automated spam, using Google reCAPTCHA (section 9)

Our lawful bases are:

• Contract — taking steps to enter into a contract with you and performing it (responding to enquiries, delivering projects)
• Legitimate interest— running our business, understanding website performance, protecting against fraud. We’ve carried out a balancing test and concluded the impact on you is minimal because the data is masked, aggregated and used purely to improve the service
• Consent — the Google and Meta advertising tags in your browser are only loaded if you accept them via the cookie banner. You can withdraw consent at any time (section 7)
• Legal obligation — keeping financial and project records as required by HMRC, building control and our insurers

We never sell your data. We share it only where it’s necessary to deliver your project or run the website:

• Trades on your project — our tiler, electrician, Gas Safe registered engineering partner, etc. Only the information they need to do the work.
• Our accountant and insurer — where required by law or for claims handling.
• Vercel Inc. (United States) — hosts this website, holds any photos uploaded through the estimator (managed Blob storage), and provides aggregated cookieless page-view analytics.
• Neon Inc. (United States) — provides the managed Postgres database, connected through Vercel, in which enquiries, estimator submissions and newsletter subscriptions are stored.
• Resend(United States) — sends transactional emails (your enquiry confirmation, our team’s notification).
• Microsoft Corporation (United States) — runs Microsoft Clarity, which captures anonymised session replays and heatmaps so we can see how the site is used (section 8).
• Google LLC (United States) — runs Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking, which load in your browser only if you accept the cookie banner (section 10). Google also runs reCAPTCHA, which checks our forms for automated spam and runs whether or not you accept the banner (section 9).
• Meta Platforms Inc. (United States) — runs the Meta Pixel and the Conversions API for Facebook/Instagram ad measurement. The Pixel loads in your browser only if you accept the cookie banner. The Conversions API is different: it sends data from our server when you submit an enquiry, and the banner does not control it (section 10).

International transfers. Several of our processors are based in the United States. Personal data transfers to the US are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the “UK IDTA”) and, where the receiving organisation is certified, under the UK Extension to the EU–US Data Privacy Framework. Each provider publishes its own transfer-impact assessment which we have reviewed.

You can request copies of the relevant safeguards by emailing info@pssconstruction.co.uk.

Enquiry details we don’t take forward are kept for up to 12 months, then deleted.

Records relating to projects we complete are kept for up to 7 years to comply with accounting, tax and potential warranty-claim obligations.

Microsoft Clarity session recordings are retained by Microsoft for up to 12 months on their platform before automatic deletion.

Google Analytics 4 retains user-level and event-level data for no longer than 14 months, which is the maximum Google permits for a property like ours. Aggregated reports that cannot identify an individual are kept by Google for longer.

The how-you-reached-us cookie described in section 2 lasts 90 days from your last visit, then expires on its own. If it has been attached to an enquiry, it is kept for as long as that enquiry record is kept.

Under UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (right of access)
• Correct anything that’s inaccurate (right to rectification)
• Delete your data where we no longer need it (right to erasure)
• Restrict how we use it while we sort something out (right to restriction)
• Transfer it to another provider in a machine-readable format (right to portability)
• Object to processing based on legitimate interest (right to object)
• Withdraw consent for any processing we do under consent (cookies, advertising tags) at any time — this won’t affect anything we did with your data before you withdrew

Email us at info@pssconstruction.co.uk and we’ll respond within one month.

If you’re not happy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk (helpline 0303 123 1113). We’d appreciate the chance to put things right first, but you don’t have to come to us before contacting the ICO.

A cookie is a small text file stored on your device when you visit a website. Below is the complete list of what this site stores on your device. Nothing is left out.

When you first visit you’ll see a consent dialog, and the site waits for your answer before you can browse. Accepting or rejecting controls the Google and Meta browser tags and our own how-you-reached-us record. The other items below are set either way, and each one says so.

You can change your answer at any time using the Cookie settings link at the bottom of every page. Rejecting after having accepted also deletes the how-you-reached-us record from your device.

Set on every visit, whatever you choose

• pss-consent-v2— remembers whether you accepted or declined. This one is not a cookie: it is stored in your browser’s local storage, which has no expiry date and stays until you clear it.
• _clck, _clsk — Microsoft Clarity session-recording identifiers (section 8). One year and one day respectively.
• pss-dev-mode— only ever set on our own staff’s devices, to keep our internal testing out of the statistics.
• Temporary cookies set by Vercel for routing and abuse protection, and by Google reCAPTCHA when you use a form (section 9).

Advertising and analytics — only if you accept

• pss_attr — the how-you-reached-us record described in section 2 (campaign and advert name, click identifier, referring site, first page seen). 90 days. This domain only, never shared. Set only if you accept, and deleted from your device if you reject or later change your answer.
• _ga, _ga_* — Google Analytics 4 identifiers (2-year lifetime, used to count unique visits and sessions in aggregate).
• _gcl_au, _gcl_aw — Google Ads click identifiers, set if you arrived via a Google Ad (90-day lifetime).
• _fbp — Meta Pixel browser identifier (90-day lifetime), and _fbc, which stores the click identifier from a Facebook or Instagram advert if you arrived from one.

Changing your mind

Because your choice is held in local storage rather than a cookie, clearing cookies alone will not reset it. In your browser’s settings choose to clear cookies and site data (including local storage) for pssconstruction.co.uk; the banner then reappears on your next visit and you can choose again. You can also email us and we will action it for you.

We also use Google Consent Mode v2 — before you accept the banner, Google’s tags load in a consent-denied state. They don’t set cookies and send only aggregated, non-identifying pings to Google so we can still see conversion volumes without identifying any individual.

We use Microsoft Clarityto understand how visitors use the website — which sections get read, where people click, whether the contact forms work as intended. It records an anonymised replay of your session and aggregates that into heatmaps.

What it captures

• Mouse movements, clicks and scroll position
• Screen size, browser, device type, country (city-level at most)
• The pages you visit on this site and how long you spend on each

What it does NOT capture

• Text you type into any form is masked by default — Clarity records that you typed something, not what you typed
• Passwords (these are never shown to Clarity by the browser)
• Your full IP address (Clarity stores a redacted form for geo-region only)
• Payment details (we don’t take payments on this site)

Legal basis. We rely on legitimate interest. We’ve carried out a balancing test (the Legitimate Interests Assessment required by UK GDPR Article 6(1)(f)) and concluded the impact on you is minimal because the recording is anonymised, form input is masked, and Clarity is contractually prohibited from using the data for its own marketing. A copy of the LIA is available on request.

It does set cookies. Clarity stores two identifiers on your device, _clck (one year) and _clsk (one day), which let it stitch your page views into a single session recording.

Independent of the cookie banner. Clarity relies on legitimate interest rather than consent, so it is active for all visitors and is not switched on or off by the Accept or Reject buttons in the cookie banner — those buttons control the Google and Meta advertising tags only. We have made that choice deliberately and are telling you plainly rather than burying it. You can opt out at any time using Do Not Track or by emailing us, as set out below.

How to opt out. Enable the Do Not Track setting in your browser (Clarity respects it), or email us at info@pssconstruction.co.uk and we’ll exclude your session data and delete any existing recordings.

More information. Microsoft publishes a Clarity-specific privacy statement at learn.microsoft.com/clarity.

Every form on this site is protected by Google reCAPTCHA v3, which scores how likely it is that a submission came from a person rather than an automated script. There is no puzzle to solve — it works quietly in the background.

To produce that score, Google receives your IP address, information about your browser and device, and how you interacted with the page (mouse movement, typing rhythm, time spent). Google may also read cookies it has already set on your device from other sites. This is governed by Google’s own privacy policy and terms of service.

reCAPTCHA runs whether or not you accept the cookie banner — it protects the form itself, so it is treated as necessary rather than optional. Our lawful basis is legitimate interest: without it our enquiry forms would be filled with automated spam. It loads only on pages that contain a form, and only when you begin using one.

At present we use the score for information only — it is recorded alongside the enquiry so we can spot patterns. No genuine enquiry is rejected on the basis of it.

If you accept the cookie banner, we use Google Tag Manager to load:

• Google Analytics 4 — aggregated page views, events, conversion paths. Used to understand which marketing channels are working.
• Google Ads conversion tracking — measures the return on any ads we run on Google Search and YouTube. Only fires if you arrived from a Google ad click.
• Meta Pixel — measures the return on ads we run on Facebook and Instagram. It also has Advanced Matching switched on, which means that when you submit a form the Pixel sends Meta a hashed (one-way scrambled) copy of the contact details you typed, so Meta can match you to a Facebook or Instagram account.

If you don’t accept the banner, none of the above set cookies and Google Consent Mode keeps the Google tags in a denied state.

The Meta Conversions API — please read this one

The Conversions API is different from everything else on this page, and we want to be straightforward about it. It runs on our server, not in your browser, so the cookie banner does not switch it off. When you submit an enquiry or complete the estimator, we send Meta:

• A hashed (one-way scrambled, not reversible by Meta into the original text) copy of your email address, phone number, first name, last name and postcode
• Your IP address and browser identification, which are sent as-is and hashed by Meta on receipt
• The Facebook advert click identifier and browser identifier from the _fbc and _fbp cookies, if you have them
• The page you submitted from, and an indicative value for the type of project

Its only purpose is to tell us whether an advert produced a real enquiry. We rely on legitimate interest for it: you have chosen to contact a builder about a project, and knowing which advert reached you is how a business our size decides where to spend. We have carried out the balancing test required by UK GDPR Article 6(1)(f) and a copy is available on request.

You can object to this and we will honour it. Email us at info@pssconstruction.co.uk and we will stop sending your enquiry to Meta and ask Meta to delete what has already been sent. It has no effect on your enquiry or your project.

To stop these processing your data even on other sites, you can opt out at:

• Google ad personalisation: adssettings.google.com
• Meta ad preferences: facebook.com/ads/preferences
• Your Online Choices (UK industry opt-out): youronlinechoices.com/uk

Replies and confirmations. When you send an enquiry we email you a confirmation, and we reply properly as soon as we can. These are part of dealing with your enquiry, so they are sent on the basis of contract.

A short follow-up sequence. If you enquire or complete the estimator and we don’t hear back, our system sends up to three follow-up emailsover the fortnight that follows — a nudge about your project, not a newsletter. We do this under the “soft opt-in” rule in the Privacy and Electronic Communications Regulations, which allows a business to follow up with someone who approached it about similar work. Every one of these emails carries a one-click unsubscribe link, and using it stops the sequence immediately and permanently.

The newsletter. We publish an occasional email about projects we have finished. It is sent only to people who have asked for it, and you confirm your address before the first issue arrives. Unsubscribe at the bottom of any issue.

We never sell or rent our email list, and we don’t send you other companies’ offers.

We do not use automated decision-making or profiling to take decisions that significantly affect you. The price-range estimator on this website produces an indicativefigure only — it’s a calculator, not a quote. Every real quote is reviewed and confirmed by a human (us) in person after a site visit.

Our services are aimed at property owners. The website isn’t directed at children and we don’t knowingly collect personal data from anyone under 18. If you believe a child has provided us with information, email us at info@pssconstruction.co.uk and we’ll delete it.

The website is served over HTTPS only. Personal data submitted via the contact form is encrypted in transit (TLS 1.2+) and stored with at-rest encryption in the managed Postgres database described in section 4. Access to the database is restricted to the PSS founders.

We don’t store credit-card numbers anywhere on this site or our systems — payment is taken offline via bank transfer once a project is agreed.

If a personal-data breach occurs and there’s a risk of harm to you, we’ll notify the ICO within 72 hoursand inform you directly without undue delay, as required by UK GDPR Articles 33–34.

If we update this policy, the “Last updated” date at the top of this page will change. Material changes (new processors, new tracking, new lawful bases) will be notified by email to anyone we hold an active enquiry or project record for, and via a banner on the website for new visitors.