Privacy and Cookie Notice

Oxford Roof Ltd (company number 15287364), trading as Oxford Roof Masters, is the data controller for the processing described in this notice. It was incorporated in England and Wales on 15 November 2023. Its registered office is 29 Mill Lane, Marston, Oxford, England, OX3 0QB. You can contact us at info@oxfordroofmasters.com or 01865 591801.

Paid roofing work is contracted with Oxford Roof Ltd unless a written quotation or contract expressly identifies another contracting party.

• Quote and emergency enquiries: name, telephone number, email address, postcode, roofing issue, urgency, message, the page used to submit the form, browser/user-agent information and submission time.
• Claim accounts and case files: account name and email, property and contact details, incident description and dates, insurer and policy details, claim references, checklist notes, messages, roof-zone notes, photographs and other evidence you choose to upload, and an activity history.
• Work, quote, invoice and payment records: customer and job details, quotations, invoices, payment status and related correspondence. Card or bank payment details are handled by the payment provider and are not stored in this website database.
• Technical and security information: IP address and request metadata in hosting logs, authentication/session data, consent preference, errors and security events. A daily-changing one-way hash derived from IP address and browser information is used for approximate unique counts on blog articles. Separate keyed one-way hashes of the request IP and enquiry email are used briefly to prevent repeated form/email abuse. Raw IP and email values are not stored in either technical counter table.
• Analytics information, only if you accept: pages viewed, approximate location, device/browser information, clicks, scrolling, calls or WhatsApp-link interactions, form success/error events and session interaction recordings on public pages. Form-field content is not intentionally sent to analytics providers.

Please do not put unnecessary health information, identity documents or details about another person into a free-text field or photo. If information about another person is necessary, tell them that you are providing it to us.

• To respond to a quote or callback request, create an account or claim file, provide requested services, communicate with you and administer a job or payment: steps at your request before a contract and performance of a contract.
• To keep accounting, tax, safety and legally required business records: legal obligation.
• To protect the service, prevent misuse, troubleshoot, keep an audit trail, measure aggregate blog readership and establish or defend legal claims: our legitimate interests in running a secure, effective business.
• To run Google Analytics and Microsoft Clarity on the public website: your consent. You can refuse or withdraw it without affecting quotes, claims or roofing services.

We do not sell personal information or use enquiry or claim details for third-party advertising. We do not make decisions about you that have legal or similarly significant effects using solely automated processing. Any automated claim or photo guidance is organisational support only; it does not decide or submit an insurance claim.

Access is limited to authorised Oxford Roof Masters personnel and providers needed for the purposes above. Depending on how you use the service, these include:

• Supabase — database, authentication and private claim-photo storage.
• Vercel — website hosting, serverless request handling and operational logs.
• Resend — enquiry confirmations, notifications and other transactional email.
• Stripe — customer, invoice and payment processing where an invoice is issued through Stripe.
• Google — Google Analytics after consent, and Google Maps when the embedded map is loaded.
• Microsoft — Clarity analytics and session interaction recording after consent.
• WhatsApp/Meta — only if you choose to open WhatsApp to contact us.
• Professional advisers, insurers or public authorities where you ask us to involve them or disclosure is reasonably necessary or required by law.

The claim workspace is private to your account. Oxford Roof Masters receives access to a claim when you use the workspace sharing/request feature; the service does not automatically submit your claim to an insurer.

Our primary Supabase project region is AWS London (eu-west-2). Some providers above operate or use subprocessors outside the UK, including in the United States. Where UK personal information is transferred to a country without UK adequacy regulations, the transfer must be covered by an appropriate safeguard such as the UK International Data Transfer Agreement/Addendum or another lawful mechanism. You can ask us for information about the safeguard relevant to your data.

We use the following retention periods:

• Enquiries that do not become a job: normally up to 24 months after the last meaningful contact.
• Customer, job, quote, invoice, payment, complaint and contract records: normally up to 6 years after the work or account is completed.
• Claim accounts and evidence: while the account or claim remains active, then normally up to 24 months after the last activity, unless it forms part of a job, complaint or legal record kept for the longer period above.
• First-party blog-view rows: up to 13 months.
• Enquiry rate-limit counters and idempotency records: normally no more than 8 days; expired rows are ignored immediately and removed during routine request cleanup.
• Microsoft Clarity recordings: up to 30 days. Google Analytics user/event data: no more than 14 months under the Standard-property setting; Google's separate aggregated standard reports are not affected by this setting.
• Your analytics choice in browser storage: until you change it below or clear site data.

We may keep a record longer where law requires it, a dispute is active, or it is needed to establish, exercise or defend a legal claim. Deleted information may remain in restricted backups until those backups are overwritten.

Essential browser storage keeps claim-account sessions secure and remembers your analytics choice. It is used because the site and claim workspace cannot provide those requested functions without it. The public site also uses first-party blog view counts without placing an analytics cookie on your device.

Google Analytics cookies and Microsoft Clarity cookies/session recording load only after you select “Accept analytics”. Advertising storage remains disabled. Selecting “Reject analytics” does not stop essential storage or the server receiving ordinary request information needed to deliver and secure a page.

Depending on the circumstances, you may have rights to access, correct, erase or restrict personal information, receive a portable copy, object to processing based on legitimate interests, and withdraw consent. These rights are not absolute; for example, we may need to retain invoice records required by law.

To make a request, email info@oxfordroofmasters.com or call 01865 591801. We may need to confirm your identity. You also have the right to complain to the Information Commissioner's Office (ICO).

We will update the date at the top when this notice changes materially. For privacy questions or to ask for details of a processor or transfer safeguard, contact info@oxfordroofmasters.com.