Privacy Policy

Last updated: 25 August 2026

1. Who we are

CJ Decorators Ltd (“CJ DECS”, “we”, “us”, “our”) is a specialist contract decorating company and the “data controller” responsible for your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or how we handle your personal information, please contact us using the details above.

2. The information we collect

We only collect the personal information we need to respond to you and provide our services.

Information you give us

When you complete the enquiry form on our Contact page, or contact us by email or telephone, we collect the information you choose to provide, which may include:

• your name;
• your company or organisation (if provided);
• your email address;
• your telephone number (if provided);
• the service you are interested in; and
• the details of your enquiry or project that you include in your message.

Information we collect automatically

Our website is hosted by Netlify. When you visit the site, our hosting provider and its content delivery network automatically process limited technical information — such as your IP address, browser type, device information and the pages you request — in server logs. This is used to deliver the website, keep it secure and prevent abuse. Our enquiry form also uses a hidden “honeypot” field to help detect and block automated spam submissions.

3. How we use your information and our legal bases

Under UK GDPR we must have a lawful basis for using your personal information. We use it as follows:

• To respond to your enquiry and provide quotations and services — lawful basis: taking steps at your request prior to entering into a contract, and performance of a contract where we work together.
• To communicate with you about your enquiry, project or our services — lawful basis: legitimate interests (to manage and respond to enquiries) and/or performance of a contract.
• To operate, secure and improve our website, and to prevent spam and fraud — lawful basis: legitimate interests (running our business and keeping our systems secure).
• To comply with our legal and regulatory obligations, including accounting, tax and health-and-safety record keeping — lawful basis: compliance with a legal obligation.

Where we rely on legitimate interests, we have considered your rights and interests and will not use your information where they override ours. We do not use your information for automated decision-making or profiling, and we do not use it for third-party marketing.

4. Cookies and similar technologies

This website does not set its own (first-party) cookies and does not use analytics, tracking or advertising cookies.

Some content is provided by third parties, which may set cookies or receive your IP address when it loads:

• Google Fonts — our pages load fonts from Google Fonts (Google LLC). Your browser requests the fonts from Google, which may receive your IP address.
• OpenStreetMap — our Contact page displays a map embedded from OpenStreetMap (OpenStreetMap Foundation), which may receive your IP address when the map loads.
• Netlify — our hosting and forms provider may set cookies necessary for security and to operate the website and its forms.

You can control or block cookies through your browser settings. Blocking some cookies may affect how parts of the site work.

5. Who we share your information with

We do not sell your personal information. We share it only with trusted service providers who process it on our behalf, and only as necessary to run our business:

• Netlify, Inc. — website hosting and form submission handling (your enquiry is transmitted to and stored in our Netlify account);
• Google LLC — supply of website fonts;
• OpenStreetMap Foundation — supply of the embedded map.

We may also disclose your information where we are required to do so by law, to establish, exercise or defend our legal rights, or in connection with the sale or reorganisation of our business.

6. International data transfers

Some of our service providers are based outside the United Kingdom, which may involve transferring your information internationally. Where this happens, we take steps to ensure your information is protected by appropriate safeguards, such as the UK Government’s adequacy regulations, the International Data Transfer Agreement, or Standard Contractual Clauses.

7. How long we keep your information

We keep your personal information only for as long as we need it for the purposes set out in this policy. In general:

• enquiries that do not proceed are kept for a limited period and then deleted;
• where we work together, we keep project and contract records for the duration of the work and afterwards to meet our legal, accounting and insurance obligations — typically up to six years.

When your information is no longer needed, we securely delete or anonymise it.

8. Keeping your information secure

We use appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse or alteration. Information submitted through our website is transmitted over an encrypted (HTTPS) connection. No method of transmission or storage is completely secure, but we take reasonable steps to safeguard your data.

9. Your rights

Under UK data protection law you have the following rights, which you can exercise free of charge:

• Access — to request a copy of the personal information we hold about you;
• Rectification — to have inaccurate or incomplete information corrected;
• Erasure — to ask us to delete your information in certain circumstances;
• Restriction — to ask us to limit how we use your information;
• Portability — to receive certain information in a portable format;
• Objection — to object to processing based on our legitimate interests; and
• Withdraw consent — where we rely on consent, to withdraw it at any time.

To exercise any of these rights, please email us at info@cjdecs.co.uk. We may need to verify your identity before responding, and we will respond within one month.

10. Complaints

We hope to resolve any concerns you have about how we handle your personal information. You also have the right to complain to the UK’s data protection regulator:

11. Children’s privacy

Our website and services are aimed at businesses and are not directed at children. We do not knowingly collect personal information from children.

12. Third-party links

Our website may contain links to other websites, such as our LinkedIn page. This policy does not apply to those websites, and we are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any website you visit.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated “Last updated” date. Please check back periodically.