Privacy Policy

Introduction

Southern Oak Ltd ("Southern Oak", "we", "us" or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and share your personal data when you interact with our website at southernoak.co.uk, when you enquire about or commission one of our oak framed buildings, and when you submit your details through one of our Facebook lead generation forms.

We are a company registered in England and Wales under company number 14648275, with our registered address at 9 Corbets Tey Road, Upminster, Essex, RM14 2AP. We are the data controller responsible for your personal data within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Personal data we collect

We collect the following categories of personal data, depending on how you interact with us:

• Contact details, your full name, email address, telephone number and postal address / postcode, provided when you complete a contact form, request a quote, or submit a planning feasibility appraisal.
• Project details, information about your intended project, including project type (garage, gazebo, garden room, porch, Heritage Solar, etc.), approximate dimensions, number of bays, roof type, budget and timeframe.
• Property information, your project address, postcode, building type and position, together with details such as whether the property is listed or within a conservation area or green belt.
• Payment information, billing address and transaction references when you pay for a planning feasibility appraisal or place a building order. Card details are handled entirely by our payment provider (Square); we never receive or store your full card number.
• Documents and images, drawings, photographs and supporting files you choose to upload when enquiring or commissioning a feasibility appraisal.
• Completion records, details you provide on our installation completion form, including checklist responses, photographs and signatures.
• Marketing and enquiry data, any information you provide through a Facebook lead generation form (see the section on Facebook Lead Ads below).
• Technical data, your IP address, browser type and pages visited, collected automatically through cookies and analytics when you browse southernoak.co.uk.

How we use your personal data

We use your personal data for the following purposes:

• To respond to your enquiry, provide a quote and discuss your oak framed building project.
• To carry out planning feasibility appraisals, prepare planning applications and manage building regulations submissions on your behalf.
• To manufacture, deliver and install your oak framed building and to complete the installation handover.
• To process payments and issue invoices and receipts.
• To follow up with you about your project, including by telephone, email or messaging, where you have asked us to.
• To send you oak framing insights, new projects and inspiration by email where you have signed up to our newsletter or consented to marketing.
• To respond to lead generation enquiries submitted through Facebook (see below).
• To maintain records for accounting, tax and legitimate business administration.
• To comply with our legal and regulatory obligations.

Legal basis for processing

We rely on the following lawful bases under the UK GDPR:

• Consent, where you have given us clear consent, for example to receive marketing emails or to submit a Facebook lead form.
• Contract, where processing is necessary to take steps before entering into a contract with you, or to perform a contract for the design, supply or installation of an oak framed building.
• Legal obligation, where we must process your data to comply with the law, for example accounting and tax records.
• Legitimate interests, where we have a genuine business reason to process your data that does not override your rights, such as responding to enquiries and improving our services.

Facebook lead generation forms

We run lead generation advertising on Facebook (Meta) to make it easy to enquire about an oak framed building. When you see one of our adverts and complete a Facebook lead form, the following applies:

• Data collected, Facebook collects and shares with us the information you provide in the lead form. This typically includes your name, email address, phone number and any custom fields shown on the form (such as your postcode, intended project type or budget). Facebook may also share limited information about how you interacted with the advert.
• Consent on Facebook, when you submit a Facebook lead form you consent to your details being shared with us so that we can contact you about your enquiry. You can manage or withdraw this consent at any time by contacting us (see the Contact section below).
• How we use the lead, we use the details from your Facebook lead form in the same way as an enquiry made directly through our website: to respond to your enquiry, discuss your project, provide a quote and, where you ask us to, follow up by phone, email or messaging.
• Meta's role, Facebook (Meta Platforms Ireland Limited) acts as a data processor in delivering the lead to us. Your use of Facebook itself is governed by Meta's own terms and privacy policy, which you can read at facebook.com/about/privacy. We are not responsible for the content of Meta's privacy policy or how Facebook processes your data on its own platform.
• Retargeting and custom audiences, we may use the contact details you provide to create lookalike or custom audiences for our own marketing on Facebook, in line with Meta's advertising policies. Where we do this, we share only hashed, non-identifying data with Meta for audience matching.
• Facebook's data processing, we do not pass your personal data back to Facebook beyond what is necessary to deliver and measure the lead generation campaign that you responded to.

You are under no obligation to complete a Facebook lead form. If you prefer, you can contact us directly through southernoak.co.uk/contact or by telephone.

Sharing your data

We do not sell your personal data. We only share it where necessary, with the following categories of recipient:

• Our payment provider, Square, to process card payments securely.
• Our email and marketing tools (including Resend and email service providers) to deliver correspondence and newsletters.
• Local planning authorities and building control bodies, where you have instructed us to act on your behalf.
• Subcontractors and specialists involved in your project, such as groundworkers, glaziers or roofers, to the extent necessary to deliver your building.
• Professional advisers such as accountants and solicitors, where required for legal or accounting purposes.
• Meta (Facebook), solely to deliver and measure the lead generation campaigns described above.
• Regulatory or law enforcement bodies, where we are legally required to do so.

Data retention

We keep your personal data only for as long as we need it. As a guide:

• Enquiry and quote data is retained for up to 24 months after your last contact, unless you proceed to a project.
• Records relating to a commissioned building (contracts, planning documents, completion forms) are retained for the duration of any guarantee and for seven years thereafter for accounting and legal purposes.
• Payment records are retained for seven years to meet tax and accounting obligations.
• Marketing consent and newsletter subscriptions are retained until you unsubscribe or ask us to stop.
• Facebook lead data is retained for up to 12 months from your last interaction, unless you become a customer.

Your rights

Under the UK GDPR you have the following rights over your personal data:

• The right to be informed about how we use your data (this policy).
• The right of access to the personal data we hold about you.
• The right to have inaccurate personal data rectified.
• The right to have personal data erased (the right to be forgotten), subject to our legal obligations.
• The right to restrict or object to the processing of your data.
• The right to data portability, to receive your data in a structured, machine-readable format.
• The right to withdraw consent at any time, where we rely on consent (including for marketing and for Facebook leads).
• The right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us using the details in the Contact section below. We will respond within one month.

Cookies and analytics

Our website uses cookies to understand how visitors use the site and to improve it. This includes analytics tools that collect aggregated, non-identifying information about pages visited and referring sources. You can control or delete cookies through your browser settings; disabling them may affect some functionality of the site.

Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. Payment card data is handled entirely by our PCI-DSS compliant payment provider and is never stored on our systems.

International transfers

Some of the services we use (including Meta and certain email providers) may process data outside the United Kingdom. Where this happens, we rely on the safeguards required under the UK GDPR, such as Standard Contractual Clauses, to ensure your data is protected to an equivalent standard.

Children's privacy

Our services are intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date of the most recent update is shown at the top of this page. We will not reduce your rights under this policy without your consent.

Contact & your rights

If you have any questions about this Privacy Policy, or want to exercise any of your data protection rights, including withdrawing consent for marketing or for a Facebook lead enquiry, please get in touch:

Company registration number: 14648275. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.