Privacy notice

Draft wording for the company to approve before launch. Items marked TBC are still to be confirmed.

This notice covers the website expressacoustics.co.uk, and the enquiries, quote requests and sample requests sent through it. It is written under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who we are

Express Acoustics Ltd is the controller of the personal data described here. That means we decide why and how it is used.

Data controller

Express Acoustics Ltd

Company number

13618988, registered in England and Wales

Registered office

Ferry Lane Industrial Estate, Lamson Road, Rainham RM13 9YY

Trading address

1 Lamson Road, Rainham, Essex RM13 9YY

Email

info@expressgroupltd.co.uk

Phone

01708 554777

ICO registration number

To be confirmed

Privacy contact. Questions about your personal data go to info@expressgroupltd.co.uk. We have not appointed a Data Protection Officer, because the law does not require one for a business like ours.

The Express Group. Express Group Construction Ltd and Express Facades & Manufacturings Ltd are separate companies in the Express Group, with their own websites and privacy notices. Each company is responsible for the personal data it collects. The three companies share an office, a phone line and a Microsoft 365 email system, and today they share the mailbox info@expressgroupltd.co.uk, which Express Group Construction Ltd runs for the group. Your enquiry is handled by Express Acoustics staff; staff who look after the shared mailbox may see it in passing.

The personal data we collect

We collect only what you send us through the website, plus a small amount of technical data about how the website is used.

You do not have to give us any of this information. The fields marked * on each form are the minimum we need to reply to you, so the form cannot be sent without them. Everything else is optional.

Enquiries: advice and quotes

The form on the Contact page has three routes. On every route it asks for your name and email address, your company if you give it, and your message.

• Get acoustic advice: your phone number; your role (acoustic consultant, architect, interior designer, fit-out contractor, main contractor, client or facilities manager, or other) and the type of space, if you give them; what the problem is (echo, too loud, speech hard to hear, meeting a standard such as BB93, or other), the room size or floor area, the project stage, when you need it, whether you need advice, supply only or supply and install, and the acoustic target if you know it.
• Request a quote: your phone number; your role and the type of space, if you give them; the product, the finish or colour, the quantity in square metres, the delivery postcode, the date you need it on site, the project stage, and whether you need advice, supply only or supply and install.
• Ask for documents: used by the "Ask for this document" links on the website (for example a product data sheet we send by email). It asks only for your name, company, email address, your phone number if you give it, and your message naming the documents you need. We use these details to send the documents.

We also record which page the form was sent from and when. To stop spam and repeated sending, the website keeps a keyed, one-way hash of your IP address. We cannot read the address back from it; it only lets us see whether later submissions came from the same address. A temporary count of recent sends from the same address is deleted after one hour.

Please send business details only. The forms do not ask for sensitive information, and we ask you not to include any.

Floor plans, drawings, photos and acoustic reports

With a request for acoustic advice you can upload a floor plan, drawings, photos or an acoustic report (PDF, DWG, JPG or PNG); with a quote request, also a schedule or spreadsheet (XLS, XLSX or CSV), DXF drawings or a ZIP file of drawings. These files usually describe a room rather than a person, but drawings can carry names in title blocks, acoustic reports name their authors, and photos of a room can show the people in it. Please send photos without people in them where you can, and make sure you are allowed to share any file that includes other people's details. We use such details only to deal with your enquiry.

Uploaded files are stored in a private folder on our web server, outside the public part of the website, so nobody can open them from the internet. Only our authorised staff can download them, after logging in to the website's admin area. If the files are small enough, they are also attached to the email that tells our team about your enquiry.

Sample requests

The Samples page lets you tick the products and finishes you want to see, and asks for your name, company and email address; your role and phone number, if you give them; the delivery address for the samples; the products and finishes chosen; the project name, location and stage, if you add them; and your notes. We use these details to send the samples and to follow up your request.

Website use

• Analytics, only if you agree. If you accept analytics cookies, we use Google Analytics 4 to see how visitors use the website: the pages viewed, how you arrived (for example from a search engine or a link), your approximate location (town or country), the type of device and browser, and a random identifier stored in a cookie. When the analytics script loads, your IP address is sent to Google; Google states that it uses it only to work out your approximate location and does not log or store it. If you do not accept, Google Analytics does not load at all and nothing is sent to Google. Our cookie policy explains this in full.
• Server logs. Like any web server, our hosting records technical details of each visit (IP address, date and time, the page requested, browser type) to keep the website secure and working.
• Failed logins. Attempts to log in to the staff area are logged (IP address, the user name tried, and the time) so that repeated failures can be blocked.
• Fonts and media. The website's fonts (Figtree and Newsreader) are stored on our own server, and the website embeds no videos or content from other websites (apart from the Google map you can choose to load, below), so loading a page does not send your details to Google or any other service.
• Maps. The Contact page shows our own map panel with a Show map button. The map loads from Google Maps only when you click Show map; until then, our pages send nothing to Google. When you click, your browser fetches the map from Google, so Google receives your IP address, details of your browser and device, and the address of the page you are on, and it may set or read its own cookies (see our cookie policy). Google uses this data as a separate controller, under its own privacy policy (policies.google.com/privacy), and may process it in the United States and other countries. The "Get directions" links open Google Maps in a new tab, where Google's privacy policy also applies.
• Instagram and group links. The Instagram link and the links to the other Express companies and to FAB Supplies are plain links. They load no content or cookies from those sites on our pages.

Staff who log in

Our own staff who manage the website have user accounts. We keep their name, email address, login records and the changes they make, to run and secure the website.

How we use it and our lawful basis

Data protection law requires a lawful basis for each use of personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights. We use the data only in ways you would reasonably expect from a business you have contacted.

The tick box on each form confirms that you have read this notice and want us to reply. It is not a request for your consent: we need your details to reply in any case. You can object, or ask us to stop, at any time (see "Your rights").

We do not sell personal data. We do not use it for automated decision-making or profiling that has legal or similar effects on you.

Marketing. We do not add contacts to marketing mailing lists from the website.

Who we share it with

We share personal data only with people who need it.

Our staff. The people who handle enquiries, acoustic advice, estimating and samples at Express Acoustics Ltd.

Other Express Group companies. If you ask for supply and install, the installation may be carried out and contracted by Express Group Construction Ltd, and if your enquiry concerns façade or SFS products it may be for Express Facades & Manufacturings Ltd. In those cases we pass your enquiry to that company, at the same address, so that it can price and plan the work. That company is then responsible for what it receives. The shared mailbox is explained under "Who we are".

Delivery of samples. When we post or courier samples to you, the postal or courier service receives your name, delivery address and, where needed, your phone number.

Service providers (processors). These companies process data for us under contracts that require them to protect it and use it only on our instructions:

The website also uses WordPress plugins for search engine settings, page speed, login protection and editing screens. They run on our own server and are set up so that they do not send visitors' personal data to anyone else.

Others, when required. Professional advisers (such as lawyers, accountants and insurers), the police, courts or regulators when the law requires it, and a buyer of our business if it were ever sold.

International transfers

Most personal data stays in the United Kingdom, on our hosting at Krystal.

If you accept analytics cookies, Google Analytics data is processed by Google, which transfers it to the United States and may transfer it to other countries. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), which the UK government has approved as providing adequate protection. Google also uses the UK's approved contract terms (the International Data Transfer Addendum) for other transfers.

Our email system, Microsoft 365, which receives the form notifications, also stores its data in the United Kingdom.

You can ask us for more details on these safeguards.

How long we keep it

We keep personal data only for as long as we need it. These are our suggested periods, still to be confirmed by the company:

When the period ends, we delete the data or make it anonymous. That includes copies in our email.

How we protect it

• The website runs over an encrypted connection (HTTPS).
• Uploaded files are kept in a private folder outside the public part of the website. Only logged-in staff with the right permissions can download them.
• Staff log in with individual accounts. Repeated failed logins are slowed down or blocked.
• The website, its plugins and the server are kept up to date. Uploads are checked for file type and size.
• The forms use spam traps rather than a third-party "captcha" service, so no visitor data goes to a captcha provider.
• Administrator accounts use two-factor authentication.

No system is perfectly secure. If a breach is likely to put people at risk we will report it to the Information Commissioner's Office (ICO) within 72 hours, as the law requires, and if the risk to you is high we will tell you directly.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and get a copy;
• rectification, to have inaccurate data corrected or incomplete data completed;
• erasure, to have your data deleted in some circumstances;
• restrict how we use your data in some circumstances;
• object to our use of your data where we rely on legitimate interests;
• data portability, to receive data you gave us in a common electronic format, or have it sent to another organisation, where we rely on consent or a contract;
• withdraw consent at any time where we rely on it (for analytics cookies). This does not affect what we did before you withdrew it;
• complain, to us and to the ICO (see "How to complain").

How to use your rights. Email info@expressgroupltd.co.uk, call 01708 554777, or write to us at the trading address above. We may ask you to confirm who you are. We reply within one month. This can be extended by up to two further months for complex or numerous requests, and we will tell you if it is. There is normally no charge.

You can change your cookie choice at any time with the Cookie settings link at the bottom of every page.

Cookies

How this website uses cookies is explained in our cookie policy.

How to complain

If you are unhappy with how we have handled your personal data, please tell us first, using the contact details above. We will acknowledge your complaint within 30 days, look into it, and reply without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at any time:

• website: ico.org.uk/make-a-complaint
• phone: 0303 123 1113
• post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this notice

We will update this notice when the website or the way we use personal data changes. The latest version is always on this page, with the date it was last updated. If a change matters to you, for example a new use of data you have already given us, we will tell you directly where we can.

Last updated: to be confirmed