Privacy policy

The data controller is Gateway Estate Maintenance Ltd, Unit 7, 125 High Road, London N18 3QX, United Kingdom. For any privacy matter, contact us at info@gemcontracts.co.uk or by post to the address above, marked “Data protection”.

We collect and hold:

• Enquiry data — name, email address, phone number, property postcode, the service you are interested in and the message you send us, together with the time of submission and a hashed record of the submitting network address used for rate limiting and abuse prevention.
• Customer and account data — contact details, property addresses, contract and payment terms, job, quotation and invoice history, and correspondence with our operations desk.
• Tenant and occupier data — where a landlord or agent subscribes a tenanted property, the contact details needed to arrange access and, on the Complete plan, reports raised by tenants directly.
• Payment data — records of invoices and payments. Card payments are processed by our payment providers; we do not store full card numbers.
• Website data — limited technical data and analytics as described in our cookie policy.

• Contract — to respond to enquiries you make, to provide services you have instructed, to manage subscriptions and to take payment.
• Legal obligation — to keep accounting records, to hold safety certificates and compliance documentation, and to meet health and safety duties.
• Legitimate interests — to run and secure our website and systems, to prevent spam and abuse, to maintain records of work for guarantee purposes, and to contact business customers about services relevant to their portfolios. We balance these interests against your rights.
• Consent — for optional analytics cookies and, where required, for marketing to individuals. You can withdraw consent at any time.

We share personal data only where needed to deliver our services: with our operatives and vetted specialist partners attending your property; with payment processors handling your transactions; with IT and hosting providers who process data under contract for us; and with professional advisers, insurers or authorities where the law requires it. We do not sell personal data. Where a provider processes data outside the UK, we ensure an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement are in place.

• Enquiries that do not become customers — up to 24 months from the last contact.
• Customer records, job history, quotations and invoices — 6 years after the end of the relationship, reflecting tax and limitation periods.
• Safety certificates and compliance records — the statutory retention period applicable to each certificate type.
• Website analytics — per the periods stated in the cookie policy.

When data is no longer needed, it is deleted or irreversibly anonymised.

Personal data is held on access-controlled systems, with role-based permissions inside our operations platform, encrypted transport, audit logging of privileged actions and documented procedures for handling any incident. Staff access is limited to what their role requires.

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where there is no continuing basis to hold it;
• restrict or object to processing, including any direct marketing;
• data portability for data you provided to us under contract or consent;
• withdraw consent where processing relies on it.

To exercise any right, contact info@gemcontracts.co.uk. We respond within one month. We may need to verify your identity before acting on a request.

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk or 0303 123 1113.

We review this policy at least annually and update it when our processing changes. Material changes will be highlighted on this page with a new effective date.