Privacy Policy

1. Who we are

APMBuild Ltd ("APMBuild", "we", "us", "our") is a construction and project management company specialising in energy-efficient building, residential refurbishments and extensions, EnerPHit-informed retrofits, and European building materials supply. We are registered in England and Wales (Company No. 16087373).

We are the data controller for the personal data we hold about you. This means we determine how and why your personal data is processed.

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website (www.apmbuild.uk), contact us, or engage our services. It applies to all individuals whose data we process, including website visitors, prospective clients, clients, suppliers and business contacts.

2. Data we collect

Information you give us directly

• Contact details: name, email address, telephone number, postal address
• Project information: property address, project type, floor area, budget range, EPC rating, project description
• Business information: company name, VAT number, professional role (for architects, developers and contractors)
• Communications: content of emails, WhatsApp messages and enquiry form submissions you send us
• Free guide downloads: first name, email address, your role (if you choose one), phone number (optional) and whether you ticked the box asking for occasional updates
• Article emails: the email address you enter in the sign-up box at the end of our blog articles

Information collected automatically

• Usage data: pages visited, time spent on pages, links clicked, browser type, device type
• Technical data: IP address, approximate location (country/region), referring website
• Cookie data: see Section 9 for full details

Information from third parties

• Referrals from existing clients or professional contacts
• Publicly available information (e.g. Companies House, LinkedIn) for business contacts

We do not collect or process any special category data (such as health data, racial or ethnic origin, political opinions) in the ordinary course of our business.

3. How we use your data

We use your personal data for the following purposes:

• Responding to enquiries — to answer your questions and provide quotations or assessments
• Delivering our services — to plan, manage and carry out construction and project management work
• Materials supply — to process orders and arrange delivery of building materials
• Sending requested information — to deliver free guides and resources you have specifically requested, article emails you have signed up for, and occasional updates if you ticked the box on the guides form
• Project communications — to keep you updated on the progress of your quote or project and respond to queries
• Legal and contractual obligations — to fulfil our contractual obligations, comply with applicable laws, and maintain proper business records (e.g. tax records)
• Improving our website — anonymised analytics to understand how visitors use our site (only with your consent, see Section 9)
• Safety and compliance — to comply with Building Regulations, health and safety legislation, and other applicable legal requirements

We will not use your data for automated decision-making, profiling, or any form of marketing to third parties. We do not send unsolicited marketing emails.

4. Legal basis for processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

• Contract (Article 6(1)(b)): where processing is necessary to perform a contract with you or to take steps before entering into a contract (e.g. providing a quotation, carrying out project work)
• Legitimate interests (Article 6(1)(f)): where we have a genuine business need to process your data that does not override your rights — for example, responding to business enquiries, maintaining client records, improving our services, and sending relevant information to existing contacts
• Consent (Article 6(1)(a)): where you have given us clear consent — for example, when signing up for article emails or ticking the box for occasional updates on the guides form. You may withdraw consent at any time by replying “stop” to any email from us or by contacting us
• Legal obligation (Article 6(1)(c)): where we need to comply with a legal duty — for example, tax records, health and safety requirements, or responding to a lawful request from a public authority

5. Who we share data with

We do not sell or rent your personal data to third parties. We may share your data with:

• Sub-contractors and tradespeople — engaged to carry out work on your project (only relevant project details, subject to confidentiality obligations)
• Materials suppliers — to process and deliver orders (name, delivery address, order details)
• Professional advisers — accountants, solicitors and insurers where required
• IT service providers — including our website host (Cloudflare), email provider, and any project management tools we use — all operating under appropriate data processing agreements
• Formspree (Formspree, Inc., USA) — processes every form on this website: the contact form, the JV partnership form, the free guides form and the article sign-up box. It receives exactly what you type into the form (for example your name, email address, phone number and message), together with technical data your browser sends with any web request, such as your IP address. It uses this to deliver your submission to APMBuild by email and keeps a copy in our Formspree account. See Formspree’s privacy policy.
• HMRC and regulatory bodies — where required by law
• Architects and consultants — where you have engaged them on a joint project and sharing is necessary to deliver the service

Any third parties with whom we share data are required to handle it securely and only for the purposes we specify.

6. International transfers

Our primary suppliers are based in Poland and the EU. Where we share data with EU-based suppliers (for example, to arrange materials delivery), this is covered by the UK's adequacy decisions for EEA countries, meaning your data receives a comparable level of protection.

When you send any form on this website, what you type is transferred to Formspree, Inc. in the United States, which processes it to deliver it to us. This transfer relies on the safeguards described in Formspree’s own privacy policy.

Some of our IT service providers (e.g. Cloudflare, Google) may process data outside the UK and EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO.

7. How long we keep data

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Client project records: 7 years after project completion (for contractual, warranty and tax purposes)
• Enquiries that did not proceed: 12 months from last contact
• Supplier and contractor records: 7 years (HMRC requirement)
• Marketing contacts (article emails and updates): until you ask us to stop or withdraw consent, plus 12 months
• Website analytics data: 26 months (standard analytics retention)

The same periods apply to the copies of form submissions held in our Formspree account and in our email.

After the relevant retention period, data is securely deleted or anonymised.

8. Your rights

Under UK GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at office@apmbuild.uk. We will respond within one calendar month. We may need to verify your identity before processing your request. There is no charge for exercising your rights in most circumstances.

9. Cookies

Our website uses a small number of cookies — text files stored on your device. We use Google Consent Mode v2: non-essential cookies are blocked by default and only set after you actively choose “Accept all” in our cookie banner.

Strictly necessary cookies (always active)

Required for the website to function correctly. These store your cookie consent choice itself and basic security/session information. No consent is required and they cannot be disabled.

Analytics cookies (optional — off by default)

We use Google Analytics 4 (measurement ID G-BZM6JECWPZ) to understand how visitors use our site — which pages are read, how people arrive, and where they leave. Analytics data is aggregated and does not identify you personally. We have not enabled Google Signals or advertising features, and we do not run remarketing.

Analytics cookies are set only after you click “Accept all”. If you click “Reject non-essential”, no analytics or advertising cookies are written.

Approximate location (no cookie, no storage)

Some pages show a small bar suggesting the area page nearest to you — for example “Looks like you’re in Worcestershire”. To do that, our server reads the approximate location our hosting provider (Cloudflare) already derives from your IP address at the moment of the request: county, town and postcode area only, never a street address. This is used once to produce the suggestion and never stored, logged or shared, and it sets no cookie. Two things are saved on your device: a note that you closed the bar (apmb_area_hint in local storage), so we don’t show it again, and the suggested area itself (apmb_area_geo in session storage), so the next page in the same tab doesn’t ask again. Session storage is cleared when you close the tab. The suggestion never redirects you — you stay on the page you opened.

What we do not use

• No advertising cookies, no remarketing pixels, no third-party ad networks
• No Facebook Pixel, no TikTok Pixel, no LinkedIn Insight Tag
• No cross-site tracking
• No selling or sharing of cookie data
• No precise/GPS location — we never ask your browser for it

Manage your preferences

When you first visit, our cookie banner asks you to choose. You can change your choice at any time using the button below — or by clearing the apmb_cookie_consent entry from your browser’s local storage. You can also manage cookies through your browser settings — see aboutcookies.org for guidance.

Change cookie preferences

10. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include:

• HTTPS encryption on our website (Cloudflare)
• Password-protected systems and devices
• Limiting access to personal data to those who need it
• Regular review of our data handling practices

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the ICO as required by law.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version will always be available on our website, with the date of last update shown at the top. For significant changes, we will notify active clients directly.

This policy was last reviewed and updated on 20 October 2026.

12. Contact us & complaints

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Making a complaint

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's data protection supervisory authority:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.