Privacy Policy
BMS BUILDING & GROUNDWORKS LTD collects the name, email address and message you send through our enquiry form so we can reply and quote for your job. We keep enquiries that do not lead to work for 2 years and customer records for 6 years after the last job, and we never sell your information.
Last updated: 2 November 2026
Who we are
BMS BUILDING & GROUNDWORKS LTD, trading as BMS Building, is a company registered in England and Wales under company number 16570052. Our registered office is The Wenta Business Centre, Colne Way, Watford, WD24 7ND. Our VAT number is 497789396. We run this website, bmsbuilding.uk.
This policy explains what personal information we collect, why we collect it, what we do with it, how long we keep it and what rights you have. For the information described here, we are the data controller.
If you have a question about this policy, or you want to use any of the rights described below, email us at info@bmsbuilding.uk, call us on 01923 700 649, or write to us at our registered office.
What we collect and why
When you send us an enquiry
Our enquiry form appears on the homepage, the contact page, the gallery and the reviews page. It asks for:
- your name
- your email address (required, so we can reply)
- your message
- the service you are asking about (optional)
- a tick to confirm you have read this privacy policy (required)
When you send the form, we also record the page you sent it from, the date and time, and your IP address and the country it points to. We use those to protect the form from spam and abuse, and to know which page you were reading.
We use your enquiry to reply to you, to arrange a site visit and to give you a quote. Our lawful basis is legitimate interests: you have asked us to get in touch, and replying is what you would expect. Where you are asking for a quote, it is also a step you have asked us to take before entering into a contract.
You do not have to give us any information. Without a name and an email address we cannot reply to a form enquiry, but you can always phone us instead.
We do not use the form to add you to a mailing list, and we do not send marketing emails.
When you become a customer
If you go ahead with a job, we keep your details, the quote, our correspondence and the records of the work and payment. Our lawful basis is the contract between us, and keeping accounting records is something we are required to do.
When you call, email or message us
If you phone, email or message us on WhatsApp, we use the details you give us in the same way as a form enquiry, on the same lawful basis, and keep them for the same periods.
Keeping the website secure
Every request to this website passes through Cloudflare, which processes your IP address and information about your browser to deliver the page and to filter out attacks. The enquiry form uses Cloudflare Turnstile, a security check that runs in your browser to tell people from automated spam. Our lawful basis is legitimate interests: keeping the site and the form working and safe.
Measuring how the website is used
Cloudflare Web Analytics counts visits to the pages of this site. It sets no cookie and stores nothing on your device, and your IP address is used only briefly to count the visit and is not kept. Our lawful basis is legitimate interests: knowing which pages people read, so we can improve them.
With your permission only, we also use Google Analytics, loaded through Google Tag Manager, and Microsoft Clarity. Google Analytics counts the pages people visit, where they arrive from and where they leave, and whether an enquiry was sent, a phone number tapped or an email or WhatsApp link clicked. It never receives what you typed. Microsoft Clarity records how pages are used, including clicks, scrolling and mouse movement, so we can see where the site is hard to use; what you type into the enquiry form is masked before Clarity sees it. Both set cookies and send information about your visit to Google and Microsoft. Our lawful basis is your consent, which you give or refuse in the cookie banner. They are off unless you turn them on, and you can withdraw your consent at any time with the Cookie settings link at the foot of every page. Withdrawing does not affect anything that happened before.
Cookies and similar technologies
What each cookie and similar technology on this site does, how long it lasts and how to change your choices is set out in our Cookie Policy.
Who we share information with
We are supported by Begin Group Ltd (ICO registration ZC181845), a UK digital agency that operates our website and customer relationship system on our behalf as a data processor. Begin Group Ltd only processes your data on our instructions. Enquiry and customer data is held in our customer relationship system, operated for us by Begin Group Ltd on the HighLevel platform.
The other services that handle personal information for us are:
| Service | What it does | Where |
|---|---|---|
| HighLevel (GoHighLevel) | Our customer relationship system. Holds your enquiry, your contact details and our notes | United States |
| Resend | Sends us an email alert with the details of each enquiry | United States |
| Google Workspace | Our email. Enquiry alerts, your emails and our replies sit in our inbox | United States and other countries |
| Cloudflare | Hosts the website, protects it from attacks, runs the Turnstile security check and Cloudflare Web Analytics, and keeps a backup copy of each enquiry | United States and other countries |
| Google Tag Manager and Google Analytics | Measure how the site is used, only if you allow analytics | United States and other countries |
| Microsoft Clarity | Records how pages are used, only if you allow analytics | United States and other countries |
Each of these acts as a processor or sub-processor for us, under contract and with security protections in place.
We do not sell personal information, and we do not share it for anyone else's marketing. We may share information where we have to, for example with a regulator or the police when they have the right to ask for it, or with our professional advisers.
Information that leaves the United Kingdom
Some of the services above are provided by companies based outside the United Kingdom, mainly in the United States. Where that happens, the transfer is protected by an International Data Transfer Agreement, the UK Addendum to the Standard Contractual Clauses, or the UK Extension to the EU to US Data Privacy Framework. You can ask us for details of the safeguards that apply.
How long we keep information
| Information | How long we keep it |
|---|---|
| An enquiry that does not lead to work | 2 years from your last contact with us, then deleted |
| Customer records: your details, quotes, correspondence and job records | 6 years after the last job we carried out for you |
| The backup copy of each website enquiry, held by Cloudflare | 180 days, then deleted automatically |
| Records of enquiries the form blocked as spam or abuse | 180 days, then deleted automatically |
| Google Analytics measurement data, if you allowed analytics | 14 months |
| Microsoft Clarity recordings, if you allowed analytics | For the period Microsoft sets for Clarity, which is no longer than 13 months |
How we protect information
Access to enquiry and customer records is limited to the people who need it. The website is served over an encrypted connection, the enquiry form is protected against automated abuse, and accounts on the systems we use are protected by strong passwords and, where available, two factor authentication.
Your rights
You have the right to ask us for a copy of the information we hold about you, to have it corrected if it is wrong, to have it deleted in some circumstances, to ask us to restrict how we use it, to object to us using it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time, and withdrawing it does not affect anything we did before you withdrew it.
Some information cannot be deleted on request while we still need it, for example the records of a job we are required to keep. If that applies, we will tell you why.
To use any of these rights, email info@bmsbuilding.uk or call 01923 700 649. It is free, and we will respond within one calendar month.
Automated decision making
We do not make decisions about you using automated processing alone, and we do not carry out profiling that produces legal or similarly significant effects.
Complaints
If you are unhappy with how we have handled your information, please tell us first at info@bmsbuilding.uk. We will acknowledge your complaint within 30 days and tell you what we are doing about it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. Complaining to us does not remove your right to complain to them.
Changes to this policy
We review this policy at least once a year, and whenever we change what we do with personal information. The date at the top shows when it last changed.
- 2 November 2026: first published.