We are a building firm, not a data business. This website has no analytics, no advertising and no tracking of any kind. The only personal information we collect through it is what you choose to send us in the contact form, plus a small amount of technical information that any web server records. We never sell your information and never pass it to advertising platforms.
Who is responsible for your information
Zella Construction Ltd (company number 16123653), Newbridge Farm, Merthyr Mawr Road, Bridgend, Wales, CF31 3PN, is the controller of the personal information described in this notice.
Privacy contact: Gareth Williams — info@zellaconstruction.com or info@zellaconstruction.co.uk. Both addresses are monitored and reach the same team.
Data protection officer: Not required. We are not a public authority and our core activities do not involve large-scale monitoring or large-scale special category data. Gareth Williams is the named person responsible for data protection matters. EU representative: Not required. We offer our services only in the United Kingdom and do not target or monitor people in the European Economic Area.
ICO registration number: [OWNER INPUT REQUIRED] — not yet registered with the ICO; registration and fee payment outstanding
Where your information comes from
Almost always from you directly, when you fill in the contact form, make a data-rights request, or email or telephone us. Technical information such as your IP address is generated automatically by your own browser when it requests a page. We do not buy contact lists and we do not obtain information about you from data brokers or social networks.
What we use your information for, and why we are allowed to
Answering an enquiry sent through the contact form
Information used
Name, email address, optional phone number, optional project type, and what you tell us about the job.
Lawful basis
Taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)); where you are enquiring on behalf of a business, our legitimate interests.
Our legitimate interest, and the balance
Responding to people who deliberately contact us about building work. Necessary because we cannot quote without the details; low impact because the information is volunteered for that exact purpose and is not used for anything else.
Who sees it
Zella Construction staff with content-system access. Stored in our website database; not shared with advertising or marketing platforms.
How long we keep it
Automatically deleted 12 months after the enquiry is received. Enquiries that become jobs are transferred to our normal business records, which are kept for as long as the law requires.
Where it is stored
Website hosted by Lovable; the database, file storage and staff sign-in service run on Supabase infrastructure hosted with Amazon Web Services in Paris, France (EU region eu-west-3).
Handling a data-rights request
Information used
Name, email address, the type of request and any detail you provide, plus a case reference and dates.
Lawful basis
Compliance with a legal obligation (UK GDPR Article 6(1)(c)) — we must respond to rights requests.
Who sees it
Zella Construction staff authorised to handle privacy requests.
How long we keep it
Deleted 24 months after the request is closed, kept as evidence that we responded.
Where it is stored
Website hosted by Lovable; the database, file storage and staff sign-in service run on Supabase infrastructure hosted with Amazon Web Services in Paris, France (EU region eu-west-3).
Recording your cookie choice so we can demonstrate it
Information used
A random reference, the choice made, the policy version and a timestamp. No IP address and no device details.
Lawful basis
Compliance with a legal obligation (UK GDPR Article 6(1)(c)) and PECR — we must be able to show that consent was given or refused.
Who sees it
Zella Construction staff with content-system access.
How long we keep it
24 months.
Where it is stored
Website hosted by Lovable; the database, file storage and staff sign-in service run on Supabase infrastructure hosted with Amazon Web Services in Paris, France (EU region eu-west-3).
Running and securing the website
Information used
Standard server records including IP address, browser type, page requested and time.
Keeping the website available and defending it against attack and abuse. Necessary because a web server cannot operate without these records; limited impact because they are not used to identify individuals or build profiles.
Who sees it
Lovable, our hosting provider, acting as our processor.
How long we keep it
[OWNER INPUT REQUIRED] — hosting log retention period to be confirmed with the hosting provider
Where it is stored
Website hosted by Lovable; the database, file storage and staff sign-in service run on Supabase infrastructure hosted with Amazon Web Services in Paris, France (EU region eu-west-3).
Staff accounts for the content management system
Information used
Staff email address, display name, encrypted password credentials and role.
Lawful basis
Our legitimate interests (UK GDPR Article 6(1)(f)) and, for employees, performance of their contract.
Our legitimate interest, and the balance
Only authorised people should be able to change the website. Necessary for access control; minimal impact as only work contact details are held.
Who sees it
Zella Construction administrators.
How long we keep it
For as long as the person needs access, then deleted.
Where it is stored
Website hosted by Lovable; the database, file storage and staff sign-in service run on Supabase infrastructure hosted with Amazon Web Services in Paris, France (EU region eu-west-3).
Publishing project photographs and customer testimonials
Information used
Photographs of completed work (which may show private property) and the first name or initials of a customer giving a testimonial.
Lawful basis
Our legitimate interests (UK GDPR Article 6(1)(f)). We obtain the property owner's permission before publishing photographs of their property.
Our legitimate interest, and the balance
Showing prospective customers real examples of our work. Necessary because a builder cannot be judged without evidence of past jobs; impact is managed by obtaining the property owner's permission and by not publishing addresses.
Who sees it
Published publicly on this website.
How long we keep it
Kept and published indefinitely as a permanent record of our work, with the customer's permission. Removed on request, or when permission is withdrawn.
Where it is stored
Website hosted by Lovable; the database, file storage and staff sign-in service run on Supabase infrastructure hosted with Amazon Web Services in Paris, France (EU region eu-west-3).
Providing your information is not a statutory requirement. You do not have to use the contact form — you can email or telephone us instead. If you do not give us a way to reply, we simply cannot answer your enquiry.
Who we share information with
We do not sell your information and we do not share it for anyone else's marketing. We use a small number of suppliers who process information strictly on our instructions.
Suppliers who process personal information for us
Supplier
Service
Information received
Role
Location
Contract
Transfer safeguard
Lovable (website hosting platform), using Supabase and Amazon Web Services infrastructure
Website hosting, database, file storage and staff authentication
Enquiries, privacy requests, consent records, staff accounts, server logs
Processor
Database and files: Paris, France (EEA). Website delivery: global edge network.
[OWNER INPUT REQUIRED] — the provider's data processing terms must be accepted in writing and a copy filed
Personal information is stored in France, inside the European Economic Area. Transfers from the United Kingdom to the EEA are permitted under the UK adequacy regulations, so no additional contractual transfer mechanism is required for that route.
We will also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.
Sending information outside the UK
Website hosted by Lovable; the database, file storage and staff sign-in service run on Supabase infrastructure hosted with Amazon Web Services in Paris, France (EU region eu-west-3).
Personal information is stored in France, inside the European Economic Area. Transfers from the United Kingdom to the EEA are permitted under the UK adequacy regulations, so no additional contractual transfer mechanism is required for that route.
Your information is not sent outside the United Kingdom or the European Economic Area for any other purpose. To ask for a copy of the safeguards, email info@zellaconstruction.com.
How long we keep information
Contact enquiries are deleted automatically 12 months after we receive them. Data-rights records are deleted 24 months after the case is closed. Consent records are deleted after 24 months. Where an enquiry turns into a job, the details move into our ordinary business and accounting records, which we keep for the periods required by tax and contract law.
Marketing
We do not currently send marketing emails or text messages, and we do not add people who contact us about a job to any marketing list. If that ever changes, we will ask separately and clearly, it will never be pre-ticked or bundled with anything else, and every message will carry a working unsubscribe link. You can object to direct marketing at any time and we must stop.
Automated decisions and profiling
We do not make any decision about you by automated means and we do not profile you. Every enquiry is read by a person.
Children
This website is aimed at people arranging building work and is not directed at children. We do not knowingly collect information from children. If you believe a child has sent us information, email info@zellaconstruction.com and we will delete it.
Special category information
We do not ask for and do not want information about health, race, religion, politics, trade union membership, sex life, sexual orientation, genetics, biometrics or criminal offences. Please do not include such details in the contact form. If you send them anyway, we will delete them unless they are genuinely necessary for the work you are asking about, in which case we will contact you first.
Cookies
See the Cookie Policy for the full list. You can change your choice at any time with .
Keeping information safe
Access to enquiries and privacy requests is limited to named staff accounts protected by a password and enforced at database level, so an unauthorised request simply returns nothing. Information travels over an encrypted connection and is encrypted where it is stored. We do not put form contents, contact details or tokens into application logs. We deliberately do not publish further detail that would help an attacker.
Your rights
Be informed. To know what we do with your information — this notice.
Access. To get a copy of the personal information we hold about you.
Rectification. To have inaccurate or incomplete information corrected.
Erasure. To have information deleted where there is no good reason for us to keep it.
Restriction. To ask us to pause using your information while a concern is resolved.
Portability. To receive information you gave us in a portable format, where we rely on consent or a contract and the processing is automated.
Object. To object to processing based on our legitimate interests. You have an absolute right to object to direct marketing — if you object, we will stop, with no exceptions.
Withdraw consent. Where we rely on your permission, you can withdraw it at any time. This does not affect anything done before you withdrew it.
Use the data-rights form or email info@zellaconstruction.com. You do not need an account and we will not ask for identity documents unless we genuinely cannot identify you from the information you give us. We answer without undue delay and normally within one month.
Complaints
Please tell us first at info@zellaconstruction.com so we can put things right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113. If you are in the EEA you may complain to your national supervisory authority instead.
Changes to this notice
We review this notice at least once a year and whenever we change what we do. The version number and date at the top always tell you which version you are reading. If we make a material change we will show a notice on the website and, where the change affects optional technologies, ask for your cookie choice again.