Privacy Policy - MTCInsulation

1. Who we are and how this notice applies

This Privacy Policy explains how MTC Insulation (“we”, “us”, “our”) collects and uses your personal data when you visit and use the website at https://www.mtcinsulation.co.uk (the “Website”), make an enquiry, enter into a contract with us, or otherwise interact with us. We are the data controller for the personal data processed through the Website and for our customer, supplier, and marketing records.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

2. Personal data we collect

2.1 Data you provide to us

Contact details: name, email address, phone number, address.
Enquiry details: information you include in contact forms, emails, or calls.
Service information: property details and preferences relevant to insulation or related services.
Contractual and billing data: purchase orders, invoices, payment-related references (we do not store full card numbers on our systems).
Job applications: CV/resume, cover letter, qualifications, work history, references, and right-to-work information provided by you.
Marketing preferences: your choices regarding receiving updates or offers.

2.2 Data we collect automatically

Technical data: IP address, device and browser type, operating system, approximate location, pages viewed, time and date, referrer URL, and interactions with the Website.
Cookies and similar technologies: see section 5 for details.

2.3 Data from third parties

Public sources and partners: limited verification information (for example, to confirm an address), lead sources, or referrals.
Recruitment sources: information provided by recruitment agencies or referees for job applications.

3. Purposes for which we use personal data

To respond to enquiries and provide quotations.
To supply and manage services, including scheduling, installation and aftercare.
To manage our relationship with you, including customer support and service updates.
To process payments and maintain accounts and records.
To send marketing communications where permitted and manage your preferences.
To operate, secure, and improve the Website, including analytics and troubleshooting.
To comply with legal and regulatory obligations, including tax and accounting requirements.
To protect our rights, prevent fraud and misuse, and establish or defend legal claims.
To recruit and assess candidates for roles with us.

4. Legal bases we rely on

Contract: processing necessary to enter into or perform a contract with you (e.g., providing services, handling orders, invoicing).
Legitimate interests: responding to enquiries, improving our services and Website, ensuring security, and promoting our services in a proportionate way that respects your rights.
Consent: placing or accessing non-essential cookies; sending direct electronic marketing where consent is required; processing certain optional information you choose to provide. You can withdraw consent at any time (see section 10).
Legal obligations: retaining records for tax and accounting, and responding to lawful requests from authorities.
Vital interests: very rarely, to protect life or safety.

5. Cookies and similar technologies

We use cookies and similar technologies to make the Website work, to remember your preferences, and—if you consent—to measure Website performance and improve our content.

5.1 Types of cookies we may use

Strictly necessary cookies: essential for core functionality, security, and accessibility. These do not require consent.
Functional cookies: remember preferences (such as language or region). Set with your consent where required.
Analytics cookies: help us understand how visitors use the Website so we can improve it. Set only with your consent.
Advertising or social cookies: if used, they would track your browsing to show personalised content or measure campaigns. Set only with your consent.

5.2 Managing cookies

Consent: where required, we request your consent for non-essential cookies via a cookie banner. You can change your choices at any time using the controls made available on the Website or by adjusting your browser settings.
Browser controls: you can block or delete cookies via your browser. If you block all cookies, some Website features may not function properly.
Retention: session cookies expire when you close your browser; most preference cookies last up to 12 months; analytics cookies may last up to 24 months unless you delete them sooner.

6. Sharing your personal data

We share personal data only as necessary and in accordance with the UK GDPR:

Service providers (processors): such as hosting, IT support, email and communications platforms, customer management tools, analytics providers, and secure payment processors.
Professional advisers: accountants, auditors, legal advisers, and insurers for legitimate business purposes.
Business partners and subcontractors: where required to deliver our services at your request.
Authorities and regulators: where we are legally required to do so or to protect our rights or the rights of others.
Business transfers: if we undergo a reorganisation, merger, or sale, data may be transferred to the new owner under the same protections.

We require processors to provide appropriate security and only process data in accordance with our instructions.

7. International data transfers

Some service providers may be located outside the United Kingdom and the European Economic Area. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as:

An adequacy decision by the UK Government for the destination country; or
Approved data transfer mechanisms, including the UK Addendum to the EU Standard Contractual Clauses or the International Data Transfer Agreement, supplemented by risk assessments and additional safeguards where appropriate.

You may contact us for more information about international transfers relevant to your data.

8. Data retention

We keep personal data only for as long as necessary for the purposes set out in this notice, and to meet legal, accounting, or reporting requirements. Typical retention periods include:

Enquiries and quotes: up to 24 months from last contact.
Customer and service records: for the duration of the contract plus up to 7 years (to comply with tax and accounting obligations and to address potential claims).
Supplier and subcontractor records: contract duration plus up to 7 years.
Marketing contact details: until you opt out or withdraw consent; suppression lists are kept to respect your opt-out.
Job applications: typically 6 months if unsuccessful; for employees, as required by employment law and our retention policies.
Cookie data: see section 5.2 for typical durations.

When data is no longer needed, we securely delete or anonymise it.

9. Data security

We implement appropriate technical and organisational measures to protect personal data, including secure hosting, access controls, encryption in transit where appropriate, least-privilege access, staff training, and vendor due diligence. While no system is perfectly secure, we continually assess and improve our safeguards. If we identify a personal data breach that poses a risk to your rights and freedoms, we will act promptly in line with legal requirements.

10. Your rights

Under the UK GDPR, you have the following rights (subject to conditions and exemptions):

Access: request a copy of your personal data.
Rectification: correct inaccurate or incomplete data.
Erasure: request deletion of your data in certain circumstances.
Restriction: ask us to limit processing in certain cases.
Portability: receive your data in a structured, commonly used format and/or request we transmit it to another controller where technically feasible.
Object: object to processing based on our legitimate interests or to direct marketing.
Withdraw consent: where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, please contact us using the details in section 14. We may need to verify your identity before responding. We aim to respond within one month, or inform you if more time is needed for complex requests.

11. Marketing

We may send you marketing communications about our services if you have consented or if you are an existing customer and we are permitted to do so under PECR. You can opt out at any time by following the unsubscribe instructions in the message or by contacting us. We do not sell your personal data.

12. Children’s data

Our Website and services are not directed to children and we do not knowingly collect personal data from anyone under 13 years of age. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Automated decision-making

We do not carry out decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects about you.

14. Data controller and privacy contact (DPO)

MTC Insulation is the data controller for personal data processed via the Website and in the course of providing our services.

We are not required to appoint a Data Protection Officer under the UK GDPR. For any questions about this Privacy Policy or our data practices, or to exercise your rights, please contact our data protection contact using the contact details published on this Website (for example, via the Website’s contact details or contact form). Please mark your message “Data Protection”.

15. Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. Significant changes will be highlighted on the Website. Please review this page periodically to stay informed.

17. Effective date

This Privacy Policy was last updated on 13 January 2026.