Your data, in safe hands

When you ask us for a quotation, we end up knowing a fair bit about you. Your name and contact details. The room you are renovating. Photographs of your windows. Sometimes a bank reference when a deposit is paid. Often, over the years, the layout of much of your home.

We think the least we owe you, in return, is to be straightforward about what we hold, how it is looked after, and what you can ask us to do with it.

This page is the plain-English summary. Our full Privacy Policy is the formal document, and our written Data Protection Complaints Procedure sets out exactly what to do if something has gone wrong.

The four rules we operate by

UK GDPR sets out seven legal principles. Underneath those, we run our day-to-day work to four practical rules of our own. They are simple, but together they explain almost every decision we make about your data.

Artificial intelligence and your data

We use AI tools internally to help us work faster — drafting documents, analysing site survey photographs, sense-checking product specifications. Like any modern small business, we want the benefit of these tools without taking risks with our customers' data.

We operate to a written AI Governance Directive, the short version of which is:

• Customer personal data lives in Pipedrive, Xero and our email systems — not in the AI tools we use internally.
• Where we ask an AI to help with a real customer matter, we use anonymised references and details, not names, addresses, or contact information.
• An automated check runs daily across our internal files and blocks anything that looks like customer-identifiable data from being saved into our shared knowledge store.
• No automated decision is ever made about a customer. Every quotation, every survey, every installation decision is made by a named member of our team.

David Browne wrote publicly about this approach in his February 2026 article in The Circular, the monthly magazine of the Entrepreneurs Circle, where he has written a regular column since 2015.

What happens if something goes wrong

We have a written Data Breach Response Plan that is rehearsed annually. If we ever discovered a data breach that posed a risk to your rights or freedoms, we would notify the Information Commissioner's Office within 72 hours, as the law requires. Where the breach posed a high risk, we would also tell you directly, without undue delay, in plain English.

We have not had a notifiable data breach to date. If we do, we will be open about it.