Privacy policy

Northcrest Skylights Leeds is the data controller for the personal information described on this page. We decide how that information is used, and we are answerable for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We survey, install and replace rooflights and skylights in homes across Leeds and the towns up to 30 road miles away. The work happens at your house and on your roof, so we keep no public premises or shop for callers. Anything about your data can go to info@northcrestskylightsleeds.co.uk or to 0113 436 0654. Mention privacy in the first line and it will be dealt with as a privacy request.

We gather what is needed to answer an enquiry, survey the room and the roof, and carry out the job. How much we hold depends on how far things go, and can include:

• your name, telephone number and email address
• the address of the property, and whether you own it or act for the owner
• what you say about the room needing light and the roof over it, including any planning or conservation-area worries
• measurements and photographs taken on the survey, inside the room and outside on the roof
• the written quote, your acceptance of it, invoices and payment records
• notes of calls, emails and WhatsApp chats about the job
• records of the Building Control notification and any planning check made for your house

We never ask for health details or other special category data. If you choose to mention a health condition or an access need so the visit can be planned around it, that note is used for the visit only and removed once the installation is signed off.

The enquiry form

The quote form on our pages is provided by Mortaro CRM and loads inside a frame from mortaro-crm-production.up.railway.app. Whatever you type into it goes straight to that system, which stores and handles it for us as our processor, under a written contract that limits it to acting on our instructions.

WhatsApp

Our WhatsApp buttons open a chat through wa.me. The small message panel on the site puts your words together inside your own browser and passes them to WhatsApp when you press send, so nothing typed into that panel is saved on our website. From then on the conversation sits in WhatsApp, and WhatsApp's own privacy policy covers how that service treats it.

Calls and emails

Phone calls and emails come to us directly. We keep a short note of each one so that whoever surveys your roof knows what you asked about.

Visiting the website

Like any web server, our host records technical details of each request, such as the IP address, the browser and the page asked for, and keeps those logs to run the site and protect it from misuse. The map on the contact page fetches its tiles from the OpenStreetMap Foundation's servers, which therefore receive your IP address while the map loads. Cookies and similar storage are covered separately in our cookie policy.

UK GDPR only allows personal data to be used where there is a lawful basis in Article 6. These are the bases we rely on:

Where we rely on legitimate interests, we have weighed our need against your privacy and kept the use narrow. You can object to any of those uses, as explained below.

We contact you about your enquiry, survey, quote, installation and guarantee and nothing else. Marketing emails or texts are sent only to people who have asked for them, which is what the Privacy and Electronic Communications Regulations 2003 require. No decision about you is made by automated means, and we do no profiling.

Your details are shared only where the job or the law needs it:

• the quote form provider, our website host and our email provider, each acting as a processor on our instructions
• the council's building control team or a registered building control approver, when we notify the work
• the local planning authority, when a planning or conservation question about your property has to be put to it
• our accountant and HM Revenue and Customs, for tax
• our insurers and legal advisers, if a claim has to be dealt with
• a court, the police or another body with a lawful right to ask

We never sell personal data or hand it to other firms for their own marketing.

Some of our suppliers may hold data on servers outside the UK. Any such transfer is covered by UK adequacy regulations or by a safeguard the Information Commissioner recognises, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

• Enquiries that go no further: deleted 24 months after our last contact with you.
• Quotes that are not accepted: deleted 24 months after the date on the quote.
• Completed jobs: the survey notes and photographs, quote, Building Control record and payment records are kept for the 10 years of the guarantee and then six more years, the period in which legal claims about the work can be brought, before deletion.
• Server logs: kept by our host on a short rolling basis for security, then overwritten.

Tax records are kept for as long as HMRC requires, even where that runs beyond the periods above.

Data protection law gives you the right to:

• ask for a copy of the personal information we hold about you
• have wrong details corrected, or incomplete ones completed
• ask us to erase your information where we no longer have a good reason to keep it
• ask us to limit how we use it while a question about it is settled
• object to any use we base on legitimate interests
• receive information you gave us in a portable format, where we hold it under a contract or your consent
• withdraw consent at any time, where consent is the basis

Write to info@northcrestskylightsleeds.co.uk to use any of these rights. There is normally no fee. We answer no later than one month after we receive the request; for a complex request the law lets that run for up to two further months, and we would tell you if so and why. We may ask for proof of identity before releasing anything, so your information only goes to you.

The Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, gives you the right to complain to us directly about how your personal data has been handled. Send the complaint to info@northcrestskylightsleeds.co.uk. We acknowledge it no later than 30 days after receiving it, look into it properly, keep you told of progress and write to you with the outcome. Our wider complaints procedure explains the steps.

You can also complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO will normally expect you to have raised the matter with us first.

When the way we handle information changes, for instance if an analytics tool is added to the website, this page is updated before the change takes effect and the date at the top is moved on. The version on this page is the one that applies.