Privacy Policy

Last Updated: 28/07/2026

At Mercian Surveying, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your personal information when you visit our website, use our services, or interact with us.

This policy is compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Important Information & Who We Are

Mercian Surveying is the "Data Controller" responsible for your personal data.

Contact Details

If you have any questions about this Privacy Policy or wish to exercise your legal rights, please contact us at:

  • Full Legal Entity Name: Mercian Surveying LTD

  • Email Address: je@merciansurveying.com

  • Postal Address: 8 Herondale Road, Stourbridge, DY8 3LL

  • Telephone Number: 01384 929 063

2. The Data We Collect About You

Personal data means any information capable of identifying an individual. We may collect, use, store, and transfer the following types of personal data:

  • Identity Data: Name, username, title.

  • Contact Data: Email address, telephone number, billing address, and delivery address.

  • Financial Data: Payment card or bank account details (Note: processed securely via third-party payment processors).

  • Transaction Data: Details about payments to and from you and services/products you have purchased from us.

  • Technical Data: IP address, browser type and version, time zone setting, operating system, and platform.

  • Usage Data: Information about how you use our website, products, and services.

  • Marketing & Communications Data: Your preferences in receiving marketing from us and your communication preferences.

3. How We Collect Your Personal Data

We use different methods to collect data from and about you:

  • Direct Interactions: You give us your details by filling in forms on our site, purchasing products/services, subscribing to newsletters, or contacting us via email, phone, or post.

  • Automated Technologies: As you interact with our website, we automatically collect Technical Data about your equipment and browsing actions using cookies and server logs.

  • Third Parties: We may receive data about you from analytics providers (such as Google Analytics) or payment service providers.

4. How We Use Your Data & Lawful Bases

Under UK GDPR, we must have a "lawful basis" to process your personal data. We use your data for the following purposes:

Purpose / ActivityType of DataLawful Basis for Processing To register you as a new customer Identity, ContactPerformance of a ContractTo process and deliver your order/serviceIdentity, Contact, Financial, TransactionPerformance of a ContractTo manage our relationship (e.g., customer service updates)Identity, Contact, MarketingPerformance of a Contract / Legal ObligationTo administer and protect our website (troubleshooting, analytics)Technical, UsageLegitimate Interests (running our business securely)To send you newsletter/marketing updatesContact, MarketingConsent (or Legitimate Interests for existing customers)

5. Disclosures of Your Personal Data

We may share your personal data with trusted third parties for specific business operational purposes:

  • Service Providers: Hosting providers, IT administrators, payment gateways (e.g., Stripe, PayPal), and delivery services.

  • Professional Advisers: Lawyers, bankers, auditors, and insurers.

  • Regulators/Authorities: HMRC or law enforcement if required by law.

We do not sell your personal data to any third parties.

6. International Data Transfers

If we transfer your personal data outside the UK (e.g., if our software servers are located in North America or Europe), we ensure a similar degree of protection by implementing at least one of the following safeguards:

  • Transferring to countries approved by the UK government as providing an adequate level of data protection.

  • Using UK International Data Transfer Agreements (IDTAs) or standard contractual clauses.

7. Data Security & Retention

Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way.

Retention Period

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying legal, accounting, or tax requirements (e.g., HMRC requires transaction records for 6 years).

8. Your Legal Rights

Under UK data protection laws, you have rights regarding your personal information:

  • Right of Access: Request a copy of the personal data we hold about you (a "Subject Access Request").

  • Right to Rectification: Request corrections to incomplete or inaccurate data.

  • Right to Erasure: Ask us to delete your personal data where there is no good reason for us continuing to process it.

  • Right to Object / Restrict: Object to us processing your data where we rely on a legitimate interest or direct marketing.

  • Right to Data Portability: Request transfer of your data to you or a third party.

  • Right to Withdraw Consent: Withdraw your consent at any time where we rely on consent to process your data.

To exercise any of these rights, please contact us at [Insert Email Address].

Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first!

9. Third-Party Links & Cookies

Our website may include links to third-party websites or plugins. Clicking on those links may allow third parties to collect data about you. We do not control these websites.

(If you use tracking cookies, add a sentence like: "For details on how we use cookies, please see our separate Cookie Policy.")

Note: If your business collects sensitive data (health records, biometric data, religious beliefs) or conducts automated decision-making/profiling, you will need additional tailored clauses. Furthermore, most UK businesses that process personal data must pay an annual data protection fee to the ICO unless exempt.