Privacy Notice

This notice explains how Bhangals Construction Consultants Ltd collects, uses, shares and protects personal data, and the rights you have. It applies to clients, prospective clients, website visitors, people who contact us, newsletter subscribers, event attendees, suppliers, contractors, job applicants, and anyone whose details we receive in connection with a project.

Bhangals Construction Consultants Ltd (company number 07379450, registered office Bridge House, 9–13 Holbrook Lane, Coventry, CV6 4AD) is the controller of your personal data. ICO registration number: ZC266203.

For any privacy question or request, contact our data protection lead:

Email: privacy@bhangals.co.uk
Post: Data Protection, Bhangals Construction Consultants Ltd, 3 Grange Park Court, Roman Way, Northampton, NN4 5EA
Telephone: 01604 871806

We operate alongside our associated company My Build Estimate Limited, which has its own privacy notice. Where we share personal data with it, we explain this in section 2.8.

Depending on how you deal with us, we may collect:

• Identity and contact data: name, job title, company, postal address, email address, telephone and mobile numbers.
• Project data: site addresses, drawings, plans, specifications, photographs, schedules, cost information, contracts, correspondence, and the names and contact details of others involved in a project (such as architects, contractors, lenders, insurers and loss assessors).
• Transaction and financial data: quotations, orders, invoices, payment records, and billing details. Card payments are handled by our payment provider; we do not store full card numbers.
• Communications data: emails, letters, messages (including WhatsApp and social media messages), notes of meetings and calls, and recordings and transcripts of telephone calls.
• Marketing data: your marketing preferences, newsletter subscriptions, event bookings, voucher and referral details, and whether you open or click our emails.
• Technical and usage data: IP address, device and browser type, pages viewed, how you reached our website, and similar information collected through cookies and similar technologies (see our Cookie Policy).
• Recruitment data: CVs, cover letters, qualifications, employment history, references, right-to-work information and interview notes.
• Feedback data: reviews, survey responses and complaints.

We do not intentionally collect special category data (such as health information). If it is included in information you send us, we will only use it where necessary and lawful, for example to make reasonable adjustments or to deal with a claim.

• From you, when you contact us, request a quote, instruct us, subscribe, book an event, apply for a job, call us or message us.
• From others involved in your project, such as your architect, contractor, client, lender, insurer, loss assessor or solicitor.
• From referrers and partners who introduce you to us, with your agreement.
• From public sources, such as Companies House, the Land Registry, planning portals, business directories, professional networking sites and company websites.
• From business data and lead-generation providers, for business contact details of people working in construction, property and related sectors.
• Automatically, through our website, cookies, and analytics and advertising technology.

Our legitimate interests include running and growing our business, delivering accurate and high-quality services, training our staff, keeping proper records, protecting our legal position, and marketing our services. We have balanced these against your rights. You can ask us for more detail.

We use artificial intelligence and automated tools to support our team across our business. This includes, but is not limited to:

• drafting, editing and summarising emails, letters and other correspondence;
• assisting with the preparation of reports, estimates, cost plans, schedules and other documents;
• reading, summarising and extracting information from drawings, specifications and documents;
• transcribing, summarising and reviewing telephone calls and meetings for training, quality and record-keeping;
• research, data analysis and internal administration; and
• marketing, content creation and lead management.

These tools may process personal data contained in the information you give us or that we hold about a project.

AI built into the services we use. Many of the software, platforms and services we rely on — including our website and its hosting, our customer relationship and business management system, email and marketing platforms, telephony, office and document storage software, accounting, analytics, advertising and security tools — include or connect to AI features, and their suppliers may add new AI features from time to time. Any personal data processed through those services may therefore be processed using AI. This section applies to all such processing, whether the AI is a standalone tool or built into another service.

Human review. A member of our team reviews AI-assisted output before it is relied on or issued to you. Our professional advice, estimates and reports are the responsibility of our qualified staff.

No solely automated significant decisions. We do not make decisions that have a legal or similarly significant effect on you based solely on automated processing. If we ever do, we will tell you, explain the decision, and give you the right to make representations, to have a person review it, and to challenge it.

Provider safeguards. We choose business or enterprise versions of AI services where available, under contracts that restrict how providers use our data. Where AI is built into a third-party service, it is provided under that supplier’s contract and data protection terms; we review those terms and, where settings allow, switch off the use of our data to train the supplier’s general AI models. Some AI providers are based outside the UK, including in the USA; see section 2.9.

Questions or objections. You can ask us about our use of AI, or object to it, at any time using the contact details in section 2.1. Website content, emails and documents we issue may be prepared with AI assistance; where we use an AI system to interact with you directly (for example a website chat assistant), we will tell you.

Calls to and from our business telephone lines and business mobiles, and online meetings (such as Microsoft Teams, Zoom or Google Meet), may be recorded and transcribed, including by AI note-taking tools. We may transcribe recordings and analyse them, including with AI tools, to train staff, monitor and improve service quality, check the accuracy of instructions and advice, and resolve complaints or disputes. Access to recordings is limited to authorised staff and our service providers. We tell you about this through this notice, a recorded announcement on calls to our main lines, our email signatures, and our quotations and terms; when we call you, or at the start of an online meeting, our team will also tell you that the call may be recorded. If you would prefer not to be recorded, please tell us and we will offer another way to communicate, such as email.

We may communicate with you by any method, including email, letters and other written correspondence sent by post, courier or by hand, reports and documents, client portals, file-sharing and e-signature platforms, telephone, text message (SMS), WhatsApp and other messaging apps, social media platforms (such as LinkedIn, Facebook, Instagram, TikTok, YouTube and X), video calls and online meetings, website chat, and any similar channel we use now or in future. Messages, attachments, voice notes and other content exchanged through any of these channels may be stored in our systems and used as described in this notice, including with AI tools. When you contact us through a third-party platform, that platform also processes your data under its own terms and privacy policy.

We store and manage client, enquiry and project information in our own secure customer relationship and business management system, which is hosted by third-party hosting and cloud service providers. Our hosting arrangements may change from time to time. Wherever our systems are hosted, we use reputable providers under written contracts that require them to keep data secure, and if data is hosted outside the UK it is protected as described in section 2.9. These systems, like our website, hosting and other software, may include or connect to AI features, as described in section 2.5. We also use third-party software and cloud services for email, document storage, accounting, telephony, marketing, and AI assistance. Access is restricted to people who need it for their role.

We share personal data only where necessary, with recipients in the categories below. The providers we use change from time to time; a current list of our main service providers is available on request.

Our service providers act as processors on our instructions under written contracts requiring them to keep data secure and use it only for the services they provide to us. We do not sell your personal data.

Some of our service providers store or process data outside the UK, including in the European Economic Area and the United States. Where personal data is transferred outside the UK, we make sure it is protected by one of the following:

• the country or organisation is covered by UK adequacy regulations (including organisations certified under the UK Extension to the EU–US Data Privacy Framework, the “UK–US data bridge”);
• the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
• another safeguard or exception permitted by UK data protection law.

Contact us for more information about the safeguards for a particular transfer.

We keep personal data only for as long as we need it for the purposes above, including legal, regulatory, insurance and accounting requirements. Typical periods are:

Where a claim, dispute or regulatory investigation is ongoing or likely, we may keep relevant data until it is resolved. When data is no longer needed, we securely delete or anonymise it.

We may send you updates, newsletters, event invitations and information about our services and those of My Build Estimate. We send marketing to individuals only with consent, or where you are an existing client or have asked for a quote and did not opt out. We may market to business contacts on the basis of our legitimate interests. Every marketing email contains an unsubscribe link, and our marketing emails contain tracking technology that tells us whether they are opened and which links are clicked. You can opt out at any time by using the link, replying “unsubscribe”, or contacting us. We never share your details with third parties for their own marketing.

We may send marketing by any channel the law allows, including email, text message, WhatsApp and other messaging services, post, telephone and social media. We may also show you adverts on social media and other online platforms, including, where the law allows, by securely matching your contact details with the platform so we can reach you or people like you. You can opt out of any of these at any time by contacting us, and for platform advertising you can also use the platform’s own ad settings.

We use appropriate technical and organisational measures to protect personal data, including access controls, multi-factor authentication, encryption where appropriate, staff training and confidentiality obligations. No transmission over the internet is completely secure, so please take care when sending us information and use the secure methods we provide where possible. If a data breach is likely to put you at high risk, we will tell you.

Under UK data protection law you have the right to:

• access your personal data and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances;
• restrict processing in certain circumstances;
• object to processing based on our legitimate interests, and object at any time to direct marketing (we will always stop);
• data portability — to receive data you provided in a machine-readable format, or have it sent to another organisation, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where we rely on consent (this does not affect processing before withdrawal); and
• rights relating to automated decision-making, including to obtain human review, make representations and contest a decision.

To exercise a right, contact us using the details in section 2.1. We may need to confirm your identity. We will respond within one month, which may be extended by up to two further months for complex or numerous requests; we will tell you if so. There is usually no fee. Some rights are subject to exemptions, for example where we need data for legal claims or to meet legal obligations; if we cannot comply, we will explain why.

If you are unhappy with how we have handled your personal data, please tell us first by email to privacy@bhangals.co.uk, by post or by telephone, as set out in our Data Protection Complaints Procedure. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you updated and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: www.ico.org.uk/make-a-complaint · 0303 123 1113.

Our website and services are intended for adults. We do not knowingly collect personal data from children under 18.

Our website contains links to other websites and social media platforms. Their owners are responsible for their privacy practices. When you interact with our social media pages, the platform may process your data under its own policies, and in some cases we and the platform are joint controllers for page statistics.

We may update this notice from time to time. The latest version will always be on our website with the date it was last updated. Where changes are significant, we will take reasonable steps to tell you.