Privacy policy

The data controller is Gateway Estate Maintenance Ltd, 693 Green Lane, Dagenham RM8 1UU, United Kingdom. For any privacy matter, contact us at hello@gemcontracts.co.uk or by post to the address above, marked “Data protection”.

Through this site and the work that follows from it, we hold:

• Enquiry data: name, email address, phone number, property postcode, the service you are interested in and the message you send us, with the time of submission and a hashed record of the submitting network address, used for rate limiting and abuse prevention.
• Job and attendance data: the property address, access arrangements, what we were asked to do, what our operative found, the work carried out, materials used and time on site.
• Photographs: images of the property and the work, taken before, during and after an attendance, so findings and completion can be evidenced. We photograph the property, not the people in it.
• Occupier contact details: where a landlord or agent instructs work at a tenanted property, the name and contact number needed to arrange access.
• Quotation, invoice and payment records: what was priced, approved, invoiced and paid. Card payments are handled by our payment providers; we do not store full card numbers.
• Compliance documents: certificates and reports produced for a property, such as gas safety, electrical and legionella records.
• Website data: limited technical data and, with your consent, analytics as described in our cookie policy.

• Contract: to answer your enquiry, quote for work, attend the property, carry out the work and take payment.
• Legal obligation: to keep accounting records, to hold safety certificates and compliance documentation, and to meet our health and safety duties.
• Legitimate interests: to run and secure this website, to prevent spam and abuse, to keep a record of work for guarantee purposes, and to contact business customers about services relevant to the properties they hold. We balance these interests against your rights.
• Consent: for optional analytics cookies and, where required, for marketing to individuals. You can withdraw consent at any time.

Where a landlord or managing agent instructs us, we hold the occupier’s contact details on their instruction, to arrange access and to keep the occupier informed about an appointment. We report the condition of the property and the work done to the person who instructed us. We do not report on the occupier, and we do not use occupier details for marketing.

We share personal data only where it is needed to deliver the work: with our own operatives and vetted specialist partners attending your property; with payment processors handling your transactions; with the IT and hosting providers that process data under contract for us; and with professional advisers, insurers or authorities where the law requires it. We do not sell personal data. Where a provider processes data outside the UK, we rely on an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement.

• Enquiries that do not become work: up to 24 months from the last contact.
• Job records, photographs, quotations and invoices: 6 years after the end of the relationship, reflecting tax and limitation periods.
• Safety certificates and compliance records: the statutory retention period for each certificate type.
• Website analytics: the periods stated in the cookie policy.

When data is no longer needed it is deleted or irreversibly anonymised.

Personal data is held on access-controlled systems, with role-based permissions inside our operations platform, encrypted transport, audit logging of privileged actions and documented procedures for handling any incident. Staff access is limited to what the role requires: an operative sees the jobs they are sent to, not the wider customer record.

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where there is no continuing basis to hold it;
• restrict or object to processing, including any direct marketing;
• data portability for data you provided under contract or consent;
• withdraw consent where processing relies on it.

To exercise any right, contact hello@gemcontracts.co.uk. We respond within one month. We may need to verify your identity before acting on a request.

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, via ico.org.uk or 0303 123 1113.

We review this policy at least annually and update it when our processing changes. Material changes are highlighted here with a new effective date.