Privacy Policy

Last updated: 5 June 2026

ELRM Construction Ltd ('we', 'us', 'our') is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal data when you visit our website, contact us, or engage with us in connection with our construction and contracting services.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. ELRM Construction Ltd is the data controller for the personal information we process.

We may collect and process the following categories of personal data:

• Identity information – name, job title, company name
• Contact information – email address, postal address, telephone number
• Business information – company registration number, UTR number, VAT number (where applicable)
• Technical data – IP address, browser type, pages visited, time and date of visit
• Communication data – records of correspondence by email, telephone, or post
• Financial and contractual data – bank account details, payment records, contract and invoice details, CIS deduction records
• Employment and subcontractor data – qualifications, certificates, CSCS cards, NI numbers, UTR numbers, and insurance documents where required under the Construction Industry Scheme (CIS)

We collect personal data through the following means:

• Directly from you – when you contact us via our website, email, telephone, or post
• During contractual and commercial dealings – when you engage us or are engaged by us as a subcontractor, supplier, or client
• From third parties – including HMRC (in connection with CIS verification), references from other businesses, and publicly available sources
• Through our website – using cookies and similar tracking technologies (see Section 9)

We process your personal data on the following lawful bases under the UK GDPR:

• Contractual necessity – to enter into and perform contracts with clients and subcontractors
• Legal obligation – to comply with obligations under the Construction Industry Scheme (CIS), HMRC requirements, health and safety legislation, and other applicable law
• Legitimate interests – for business administration, communication, debt recovery, and the management of our contracting operations, where these interests are not overridden by your rights
• Consent – where you have freely given explicit consent, such as for marketing communications (you may withdraw consent at any time)

We use personal data for the following purposes:

• To carry out and manage construction and contracting work
• To issue and process invoices, valuations, and payments
• To fulfil our obligations under the Construction Industry Scheme (CIS), including verifying subcontractors with HMRC and making the required deductions
• To verify identity and qualifications of site personnel
• To communicate with clients, subcontractors, and suppliers
• To comply with health and safety obligations on site
• To resolve disputes and enforce contractual rights
• To respond to enquiries made through our website
• To improve and maintain our website

We may share your personal data with the following parties where necessary:

• HM Revenue & Customs (HMRC) – for CIS verification and reporting obligations
• Clients and main contractors – where required to fulfil contractual obligations
• Subcontractors and labour providers – where sharing is necessary for site management and contract delivery
• Professional advisers – including accountants, solicitors, and insurers
• Cloud software providers and IT service providers – who process data on our behalf under appropriate data processing agreements
• Regulatory bodies – where we are required to disclose information by law

We do not sell personal data to third parties. We do not share your data with any third party for marketing purposes without your consent.

We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with our legal obligations. In general:

• Financial and contractual records (including CIS records) are retained for a minimum of 6 years in accordance with HMRC requirements
• Health and safety records may be retained for up to 40 years where required by legislation
• Website enquiry data is retained for no longer than 2 years unless a commercial relationship develops

When data is no longer required, it is securely deleted or anonymised.

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access – to request a copy of the personal data we hold about you
• Right to rectification – to request correction of inaccurate or incomplete data
• Right to erasure – to request deletion of your data in certain circumstances
• Right to restriction of processing – to request that we limit how we use your data
• Right to data portability – to receive your data in a structured, commonly used format
• Right to object – to object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making – we do not carry out automated decision-making or profiling

To exercise any of these rights, please contact us using the details in Section 11. We will respond within one calendar month. We may need to verify your identity before processing your request.

Our website uses cookies to improve your browsing experience and analyse site traffic. Cookies are small text files stored on your device. We use the following types of cookies:

• Essential cookies – necessary for the website to function correctly
• Analytics cookies – to understand how visitors use our site (e.g. Google Analytics)

You can control cookies through your browser settings. Disabling cookies may affect website functionality. A cookie consent notice is displayed when you first visit our website.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include password protection, encrypted email where applicable, restricted access to sensitive records, and secure disposal of data.

Where data is processed by third-party software providers, we ensure that appropriate data processing agreements and security standards are in place.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) and, where required, affected individuals, in accordance with the UK GDPR.

We do not routinely transfer personal data outside of the United Kingdom. Where any transfer is necessary, we will ensure that appropriate safeguards are in place as required by the UK GDPR.

If you have any questions about this Privacy Policy, or wish to exercise any of your data rights, please contact us:

ELRM Construction Ltd Email: Eljon@ELRMConstruction.co.uk 

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We may update this Privacy Policy from time to time to reflect changes in law, our business, or our data practices. Any updates will be posted on our website with a revised 'last updated' date. We recommend you review this policy periodically.

ELRM Construction Ltd | Registered in England & Wales