PRIVACY POLICY

1. Who We Are

Graham Industries is a business automation and digital presence service operated by Lewis Graham, trading as Graham Industries, based in Stornoway, Isle of Lewis, Scotland, United Kingdom.

For the purposes of UK GDPR, Graham Industries is the data controller in respect of personal data collected through our website and outreach activities. In respect of data processed on behalf of our clients, Graham Industries acts as a data processor and our clients are the data controllers.

Contact details for all data protection matters: lewis@grahamindustries.co.uk

2. What We Collect

2.1 Website enquiry data

When you submit an enquiry through our contact form, we collect:

• First name and last name
• Business name
• Trade type
• Phone number
• Email address
• Any additional information you choose to provide in the message field

2.2 Business outreach data

We conduct B2B marketing outreach to UK limited companies operating in the trade sector. For this purpose we process:

• Business name and Companies House registration number
• Director name (sourced from Companies House public register)
• Professional email address associated with the business domain
• Trade type and business location

This data is sourced from publicly available sources including Companies House, Google Business Profile, and professional business directories. We only contact UK limited companies. Sole traders are excluded from our outreach activities in accordance with PECR.

2.3 Client service data

When you become a client of Graham Industries, we process additional data required to deliver our services, as detailed in our client service agreement.

2.4 Technical and usage data

When you visit our website we may collect standard technical information including your IP address, browser type, pages visited, and time spent on pages. This is collected through standard web analytics and is used solely to improve our website.

3. How We Use Your Data

We use personal data for the following purposes:

• To respond to enquiries submitted through our contact form
• To conduct B2B marketing outreach to UK limited companies in the trade sector
• To deliver our services to clients in accordance with our service agreement
• To send service-related communications including invoices, reports, and operational updates
• To comply with legal obligations
• To improve our website and services

4. Legal Basis for Processing

4.1 Enquiry and client data

Processing of data submitted through our enquiry form and data processed in connection with client service delivery is carried out on the basis of contract (Article 6(1)(b) UK GDPR) — it is necessary to process this data to respond to your enquiry and, if you become a client, to perform the contract for services.

4.2 B2B marketing outreach

Processing of business contact data for our B2B cold email outreach campaign is carried out on the basis of legitimate interests (Article 6(1)(f) UK GDPR). We have conducted a Legitimate Interest Assessment (LIA) confirming that our commercial interest in marketing our services to relevant UK trade businesses is not overridden by the privacy rights of recipients, given the professional context of the data, the relevance of the communication, and the safeguards in place including clear opt-out mechanisms.

Our outreach is conducted in compliance with the Privacy and Electronic Communications Regulations 2003 (PECR). We contact only UK limited companies, which are corporate subscribers exempt from the consent requirement under PECR Regulation 22. Every email includes a clear opt-out mechanism and our identity as the sender.

4.3 Legal compliance

Where processing is necessary to comply with a legal obligation, the basis is legal obligation (Article 6(1)(c) UK GDPR).

5. Who We Share Your Data With

We do not sell personal data to any third party. We share data only with carefully selected third-party service providers who act as data processors on our behalf under documented data processing agreements. These providers fall into the following categories:

• Email delivery providers — used to send transactional and marketing communications on our behalf. All providers operate under GDPR-compliant data processing terms.
• Database and records management providers — used to store and manage client and prospect records securely. Where providers are based outside the UK, appropriate transfer safeguards including standard contractual clauses are in place.
• Business automation providers — used to operate automated workflows that deliver our service. All providers are bound by data processing agreements that restrict use of data to our instructions only.
• Website hosting providers — used to host and serve our website and client-facing systems. Appropriate security measures are maintained at all times.
• SMS and communications providers — used to deliver SMS notifications as part of our service. All providers operate under documented data processing terms.
• Business productivity and communications providers — used for internal business communications, file storage, and operational management.

All processors are contractually required to handle data only on our documented instructions, implement appropriate technical and organisational security measures, and comply with applicable UK data protection law. We maintain a full register of our data processors which is available on request.

If you would like to know the specific providers we use, you may request this information by contacting us at lewis@grahamindustries.co.uk. We will respond within one calendar month.

6. How Long We Keep Your Data

• Enquiry data — retained for 12 months from the date of enquiry, or for the duration of the client relationship if you become a client, whichever is longer.
• Outreach prospect data — retained for the duration of the outreach campaign. Records with no engagement within 24 months are deleted from active lists. Opt-out records are retained indefinitely on our suppression list to prevent future re-contact.
• Client service data — retained for the duration of the service agreement plus 6 years in accordance with our legal and accounting obligations.
• Technical and usage data — retained for 12 months.

7. Your Rights

Under UK GDPR you have the following rights in respect of your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your data in certain circumstances.
• Right to object — you have an absolute right to object to processing of your data for direct marketing purposes at any time. On receipt of an objection, we will stop processing your data for marketing immediately and permanently.
• Right to restrict processing — you can ask us to restrict how we use your data in certain circumstances.
• Right to data portability — you can ask us to provide your data in a structured, commonly used format.

To exercise any of these rights, contact us at lewis@grahamindustries.co.uk. We will respond within one calendar month.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies

Our website uses only essential technical cookies required for the website to function. We do not currently use advertising or tracking cookies. We do not use third-party analytics platforms that set persistent tracking cookies.

If we introduce non-essential cookies in the future, we will update this policy and implement appropriate consent mechanisms.

9. International Data Transfers

Some of our service providers are based outside the United Kingdom, including the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including reliance on the UK's adequacy regulations and standard contractual clauses approved by the ICO.

10. Contact Us

For any questions, requests, or concerns relating to this privacy policy or our handling of your personal data, please contact:

We will acknowledge your request within 5 business days and respond in full within one calendar month.