Skip to main content

Privacy Policy

Last updated: 22 August 2026

1. Who we are, and how to reach us

The controller of your personal information is George Stephens, trading as GWS Plumbing & Bathrooms, a sole trader registered for VAT in the United Kingdom (VAT number 486 0121 03).

Address: Instone House, Instone Road, Dartford, Kent DA1 2AG.
Email: [email protected]  |  Phone: 07376 641877

We are a small business and we do not have a data protection officer — George handles these requests himself. If you want to exercise any of the rights in section 7, that is where to write.

2. What we collect

Depending on how you use the site, we collect:

  • Contact and job details — your name, phone number, email address, property address and postcode, and what you have told us about the work.
  • Photos you upload — pictures of your bathroom or plumbing problem sent through the enquiry form, the AI Bathroom Transformer or the design tools.
  • Booking and payment information — what you booked, when, and the payment reference. We never see or store your card number; card details are entered on Stripe's own pages.
  • Messages between us — enquiry text, chat conversations with the assistant on this site, and any feedback you leave about it.
  • Technical data, including your IP address. Your IP address and browser user-agent reach our server on every request. We use them to rate-limit abuse of the forms and the chat assistant, and we store the IP address and user-agent against each view of a quote page so we can tell a customer's own visits from anyone else's. This happens whether or not you accept cookies.
  • Cookie and analytics data — only if you accept (see section 8).
  • Special-category data via the Disabled Facilities Grant checker — see section 3.

3. Health and benefits information (DFG checker)

If you use our Disabled Facilities Grant checker and ask for a callback, we collect your answers — which can include information about disability or health and about benefits — together with your name and phone number. Health data is special-category data under Article 9 of the UK GDPR and gets extra protection.

Our condition for processing it is your explicit consent (Article 9(2)(a)), given by the tick-box on the checker. We use it solely to help you with a possible grant application and quotation. We never share it with anyone — including the council — without asking you first. You can withdraw your consent at any time by calling 07376 641877 or emailing [email protected], and we will erase it.

Answering the checker questions alone sends nothing to us. Your answers only leave your device if you ask for the callback.

4. Why we use it, and our lawful basis

Under Article 6 of the UK GDPR we must have a lawful basis for each purpose. Ours are:

  • Answering your enquiry and preparing a quotation — steps taken at your request before entering into a contract (Art. 6(1)(b)).
  • Carrying out the work, taking payment, and honouring the guarantee — performance of our contract with you (Art. 6(1)(b)).
  • Appointment reminders and messages about a job you have booked — performance of our contract with you (Art. 6(1)(b)). These are service messages: they have no unsubscribe link, because we have to be able to tell you when we are coming.
  • Keeping VAT records, invoices and waste transfer notes — compliance with our legal obligations (Art. 6(1)(c)).
  • Automated follow-ups on a quote, review requests, and 6- and 12-month check-ins — our legitimate interest in following up people who asked us for a quote or had work done (Art. 6(1)(f)), relying on the "soft opt-in" in regulation 22 of PECR. Every one of these messages carries an unsubscribe link, and once you use it we record that and send you no more of them.
  • Rate-limiting, fraud prevention and keeping the site up — our legitimate interest in the security of the service (Art. 6(1)(f)).
  • Analytics and advertising measurement — your consent (Art. 6(1)(a)), given through the cookie bar and withdrawable at any time.
  • The DFG checker answers — your consent (Art. 6(1)(a)) plus your explicit consent for the health element (Art. 9(2)(a)).

We do not make any decision about you by automated means alone that has a legal or similarly significant effect. The chat assistant and the design tools help us answer you faster; a person prices and decides every job.

5. Who we share it with

We do not sell your personal information, ever. We share it with the tradespeople working on your job, with our accountant and professional advisers, and with the service providers below, who process it on our instructions:

  • Stripe — card payments and deposit links. Card details go straight to Stripe and never reach us. Stripe's privacy policy.
  • Google — Analytics 4, Google Ads and Google Tag Manager — how the site is used and whether our advertising works. Only ever loaded with your consent. Google's business privacy information.
  • Google Calendar — your name and appointment details, so a booked visit appears in George's diary.
  • Google (Gemini) — if you use the AI Bathroom Transformer or a design tool, the photo you upload and the prompt are sent to Google's image model to produce the visualisation.
  • Anthropic — the chat assistant on this site, and the drafting of quote follow-up messages, run on Anthropic's Claude models. What you type into the assistant, and your name and job description when a follow-up is drafted, are sent to Anthropic. Anthropic's privacy policy.
  • Resend — the email provider that delivers our notification and transactional email.
  • Zapier — the automation service that relays our automated follow-up, review-request and check-in emails to you.
  • Our object-storage provider — where photos you upload and the images our tools generate are stored.
  • Our website hosting and database providers — they hold everything above on our behalf. We are moving hosting during 2026; the current list of providers is available on request at [email protected].

We may also share information where the law requires it, or to establish or defend a legal claim.

Transfers outside the UK

Stripe, Google, Anthropic, Resend and Zapier are US-headquartered and may process your information outside the UK. Where they do, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the UK extension to the EU–US Data Privacy Framework. You can ask us for details.

6. How long we keep it

  • DFG checker answers — 12 months. An automated job runs every night and applies this: if you did not go ahead, your whole enquiry record — the answers, your name and your phone number — is deleted once it is 12 months old. If you did become a customer, the health and benefits answers are erased at 12 months and only the ordinary job record is kept.
  • Customer records, invoices and VAT records — six years after the end of the relevant accounting period, because HMRC requires it, and so we can honour the 12-month workmanship guarantee and deal with any later claim.
  • Enquiries that never became a job — kept while we might still hear back from you, and deleted on request.
  • Chat conversations and quote-page view logs (including IP addresses) — kept as part of the enquiry record, and deleted on request.
  • Marketing unsubscribe records — kept indefinitely. We have to keep a record that you opted out in order to keep honouring it.
  • Analytics data — retained by Google under Google Analytics' own retention settings.

To be straight with you about how this works: the 12-month DFG erasure is the one deletion we have automated. Everything else is deleted when we no longer need it or when you ask us to — and if you ask, we do it.

7. Your rights

Under the UK GDPR you have the right to:

  • Be told what we hold about you, and get a copy of it (access)
  • Have inaccurate information corrected (rectification)
  • Have information deleted where we no longer need it (erasure)
  • Restrict how we use it while a question about it is resolved
  • Object to processing based on our legitimate interests — and to object to direct marketing at any time, which is an absolute right we must honour
  • Receive information you gave us in a portable form (portability)
  • Withdraw consent at any time, where we rely on it — including for cookies and for the DFG checker answers. Withdrawing does not affect anything done before you withdrew.

To exercise any of these, email [email protected] or call 07376 641877. It is free, and we will answer within one month.

Complaining to the regulator

If you are unhappy with how we have handled your information, please tell George first — but you have the right to complain to the Information Commissioner's Office (ICO) at any time. ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · helpline 0303 123 1113 · ico.org.uk.

8. Cookies and similar technologies

Essential storage runs the site and is always on. Everything else — analytics and advertising — is set only if you accept on the cookie bar. Until you choose, Google Consent Mode holds analytics and advertising storage at "denied".

  • gws-consent (essential, stored in your browser, kept until you clear it) — remembers whether you accepted or refused, so we do not ask again.
  • gws_admin_session (essential, session cookie) — only ever set for George when he signs in to the admin area.
  • Google Analytics — _ga, _ga_G-CEWNT1L0Y9 (analytics, up to 2 years, consent) — how many people visit and which pages they read.
  • Google Ads — _gcl_au and related (advertising, up to 90 days, consent) — whether an advert led to an enquiry.
  • Google Tag Manager (consent) — loads the tags above.

Changing your mind is one click. The "Cookie settings" button in the bottom corner of every page reopens the cookie bar so you can withdraw consent as easily as you gave it. Choosing "Essential only" immediately tells Google to stop using storage for analytics and advertising. You can also clear cookies through your browser settings at any time.

9. How we protect it

Access to the customer records behind this site is limited to George and protected by a signed session. Traffic to and from this site is encrypted in transit. Payment card details are handled entirely by Stripe and never reach our systems. If a breach ever put your rights at risk, we would tell the ICO within 72 hours and tell you without undue delay.

10. Changes to this policy

If we change how we use your information we will update this page and change the date at the top. This version replaces the one published in January 2026.

11. Contact us

Any question about this policy, or about how we handle your data: [email protected] or 07376 641877.