Privacy Notice

Last updated: 9 October 2026

The short version. We use your details to quote for, book, carry out and get paid for plastering work, and to keep the records the law and our guarantees need. We do not sell your data, we do not send marketing emails, and we do not use advertising or tracking cookies. Customer files, messages and backups are encrypted. You can ask us for a copy of your data, or for it to be corrected or deleted, at any time.

Who we are

Ayres Plastering is run by Alec Ayre as a sole trader, who is responsible for (the "controller" of) the personal data described here. For anything about your data, contact us by email to alec@ayresplastering.co.uk. We reply within one month, and it is free.

What we collect

When you ask for a quote

• Your name, email address, phone number and the address of the work.
• What you want doing: your description, room sizes and answers to our questions, your preferred dates, how you heard about us, and any photos, videos or drawings you send. Photos of your home can show its layout and contents, so only send what helps us quote.
• The internet (IP) address the request came from, used only to stop spam.

While we quote for and do the work

• Quotes, estimates, accepted options, booked dates, invoices, payments and receipts.
• Messages between you and us in your customer portal, and the emails we send you about your job.
• Notes we make to run the job, such as materials and tasks.

Your customer account

• Your sign-in details: password (stored only as a one-way scrambled hash), passkeys, and authenticator codes if you turn them on.
• Security records: when you signed in, your sessions, and a log of important changes to your account and jobs. These records can include your IP address and browser type.
• Your notification choices. If you turn on phone or browser notifications, we store the subscription your browser gives us.

If we set up an account for you

Sometimes we add someone ourselves, for example after a job agreed in person. We record the name and only the contact details and address you gave us, and send you a link to the account. If you do not use the link within 7 days the account is locked: its photos, messages and links are deleted, and the invoice and payment records we must keep are kept.

When you pay

Most customers pay by bank transfer. Our bank and our accounting software (FreeAgent) show us the payer's name, amount and reference so we can match your payment to the right invoice. If you pay online with Stripe Pay by Bank, Stripe and your bank handle the payment. We never see your online-banking login and only receive the amount, the status and a reference.

When you visit our website

Our server records basic technical information (IP address, browser, pages requested) to keep the site working and secure. We do not use analytics or advertising trackers.

Why we use it, and our legal reasons

• To answer your enquiry and prepare a quote: because you asked us to, before any contract.
• To book and do the work, send invoices, take payment and keep you updated (including payment and message reminders, at most one per invoice and one per waiting message): to carry out our contract with you.
• To keep tax and accounting records: because the law requires it.
• To keep job records and photos for guarantees, aftercare and any dispute, to keep accounts and the website secure, and to block spam and fraud: our legitimate interests in running a safe, reliable business. You can object to these (see "Your rights").
• Notifications on your phone or browser: only with your consent. You can turn them off at any time in your account settings.

We do not ask for health or other sensitive information. If you mention something like that, for example to explain access needs, we use it only to plan the work safely.

Automatic tools, AI and quotes

• Our quote helper reads your enquiry to work out which job it is and which questions to ask. That part runs entirely on our own server. Prices come from our own fixed rates and your measurements.
• We do not send your enquiry, photos or details to outside AI services.
• Every quote and estimate is checked and sent by a person. Nothing automatic makes a final decision about you. Enquiries that look like sales pitches or spam are refused automatically; if you think yours was refused by mistake, contact us.
• For outside work, we check the weather forecast for your general area. Only the first half of your postcode (for example "SK11") is used, never your full address.

Who we share it with

We share only what each service needs to do its job for us. They may not use your data for their own purposes.

• Fasthosts (UK) hosts the server that runs this website and stores your account, files and messages.
• Proton (Switzerland) sends our emails, and holds our email and calendar.
• Google suggests addresses as you type yours into the quote form.
• Stripe handles the payment, only if you choose to pay online.
• Our bank and FreeAgent (accounting software) see the payments you make to us.
• Our Proton calendar receives your name, phone number, address and dates when a job is booked, so we turn up at the right place.
• Your browser's notification service (Apple, Google, Mozilla or Microsoft) carries a short "you have an update" alert, with no names, amounts or message text, only if you turn notifications on.
• postcodes.io and Open-Meteo receive only a postcode area such as "SK11", for weather forecasts.

We may also share information with our accountant, insurers or legal advisers, or with the police, courts or regulators when the law requires it. We never sell your data or share it for marketing.

Your account, files and backups are stored in the UK. Some services store data outside the UK: Proton in Switzerland, and others in the European Union or the United States. Where they do, they are covered by UK adequacy regulations (which include Switzerland, the EU and the UK–US "data bridge") or by the standard contract terms approved for international transfers.

Our public website shows our Google reviews (reviewer's name and review as published on Google) and photos from our Instagram account. The Instagram photos load from Instagram's servers, which receive your IP address when you view them.

How long we keep it

• Enquiries that do not go ahead: deleted automatically after 60 days with no activity (no messages, changes or signing in to your account).
• Customer, job, quote, invoice and payment records, with job photos and messages: deleted automatically 6 years after the last activity on the job, because tax law requires us to keep them that long and they cover guarantees and claims.
• Your account: once it has no jobs left and has not been used for 60 days, your name and contact details are deleted from it.
• Spam checks on quote requests (IP address): 90 days.
• Sign-in sessions: 7 days, or until you sign out. Single-use QR sign-in codes last 2 minutes.
• Website server logs: about 90 days.
• Email delivery history: encrypted recipient addresses and subjects, attachment counts, send times and provider outcomes are kept for 90 days to investigate delivery problems. This history does not store email bodies or sign-in links.
• Security and change history: kept with the records they relate to. The IP addresses and browser details in it are removed after 12 months.
• Backups: encrypted copies kept for 30 days, on our server and on our own offsite backup storage in the UK, then deleted.

If there is a dispute, an unpaid invoice or a legal claim, we may keep the records involved until it is resolved.

How we protect it

Customer accounts need a password, passkey or one-time sign-in link, and staff accounts can require a second step. Messages, photos and files, and the payer details we receive from bank payments, are stored encrypted, and backups are encrypted before they leave our server. Only we can see your records. You can see only your own. Access and important changes are logged. No system is perfectly secure, so please tell us straight away if you think your account has been misused.

Protecting you from fraud

We will never ask for your password by email, text, phone or in person. Only enter it on this website's sign-in page.

Our bank details will never change by email or text. Invoices and the secure payment page show the account to pay. If anyone tells you our bank details have changed, or asks you to pay a different account, call us on 07519331027 before paying anything.

Emails from us come from our own domain and link only to this website. If a message looks unusual, do not use its links; open this website yourself or contact us.

Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong (you can also change your contact details yourself in your account);
• delete your data, or stop using it while a concern is looked into;
• give you your data in a format you can take elsewhere;
• stop using it for our legitimate interests, unless we have strong reasons to continue (such as a legal claim);
• stop sending notifications or other things you agreed to.

To ask, contact us by email to alec@ayresplastering.co.uk. In your customer account, Settings also lets you download a copy of your data straight away, or ask us to close the account. We may need to check who you are first. Some records, such as invoices, must be kept for the periods above even if you ask us to delete them. We will tell you if that applies.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Cookies and storage on your device

We only use storage that the site needs to work, such as keeping you signed in. See our cookie notice for the details.

Children

Our services are for adults arranging work on a property. We do not knowingly collect data about children.

Changes to this notice

When we change how we use your data we will update this page and the date at the top. If a change affects you significantly we will tell you by email or in your account.