Privacy Policy

About this policy

This privacy policy and notice applies to CDC RESTORATION LTD (company number 06539664), trading as Chameleon Windows Restoration, and to our website at chameleon-restoration.co.uk. We take your privacy seriously.

This notice explains how we look after your personal data in all situations where we collect it, sets out your privacy rights and explains how the law protects you. It supplements any other privacy notice we may give you when we collect your data, and should be read together with it.

Who we are and how to contact us

CDC RESTORATION LTD is the data controller for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please send any question about your data, or any request to use your rights, to:

• Name: Oleksandr Povshednyy, Director
• Email: info@chameleon-restoration.co.uk
• Phone: 01223 912220
• Post: CDC RESTORATION LTD, Bellingham House, 2 Huntingdon Street, St Neots, PE19 1BG

Information we collect

We collect, process and store personal data that you give us, for example when you ask about our services, become a customer or supplier, or call or email us. We also collect some information automatically when you use our website or call us, as explained below. Personal data is any information that relates to you as an identifiable person. It may include:

• Identity data: your name and title.
• Contact data: your home or work address, email address and telephone numbers, and invoicing details.
• Property data: the address of the property, and the photos and details of your windows that you send us.
• Financial data: bank account and payment card details.
• Transaction data: payments you make to us and payments we make to you.
• Technical data: your IP address, browser type and version, device and operating system, time zone and approximate location, and how you use our website.
• Call data: the number you call from, the number you called, the date, time and length of the call and, for calls to our tracking numbers, a recording of the call (see Phone calls).
• Profile and usage data: your enquiries, feedback and survey responses, and how you use our website and services.
• Marketing data: your preferences about hearing from us.

We may also use aggregated data, which is derived from personal data but does not identify you directly or indirectly, such as how many visitors used a page of our website.

How we collect your personal data

• Directly from you: when you contact us by phone, email, our website forms, in person or by post.
• Automatically: when you use our website (see Website analytics and cookies) and when you call one of our tracking numbers (see Phone calls).
• From third parties: for example the details our telephone answering service takes when you call us.

Phone calls: call tracking and call recording

Calls to our numbers are answered on our behalf by a telephone answering service, which passes your name, number and message to us.

If you reach our website from one of our online adverts, you may see a different phone number (a tracking number) in place of our main number. It puts you through to the same team. It lets us tell which of our adverts lead to calls. To do this we keep the advert's click identifier and campaign details, the page you arrived on and the tracking number you were shown on our systems for up to 90 days, linked to a random visit code (see Website analytics and cookies for how that code travels with you).

When you call a tracking number, we record the number you call from and the date, time and length of the call, and link the call to that advert visit. We keep the number you called from in these records for 120 days.

Calls to our tracking numbers are recorded, from the moment our team answers, for training and quality purposes. You are told this at the start of the call. Recordings are kept for 12 months and then deleted. Calls to our main number, 01223 912220, are not recorded.

When a call follows a click on one of our Google adverts, we tell Google Ads, sending the advert's click identifier and the time of the call, never your name or phone number, so that we can measure which adverts work.

Website analytics and cookies

We ask before we store anything in your browser that the website does not need. When you first visit, you can accept or reject cookies, and you can change your choice at any time with Cookie settings at the bottom of every page. Website cookies lists everything we store.

• If you accept, our analytics service, PostHog, which holds our data on servers in the European Union, stores a cookie and similar data in your browser, so we can see how visitors use the website over time. It records the pages you visit, how you arrived, your device and browser, and your approximate location. If you arrived from one of our adverts, we also keep a random visit code in your browser for 90 days, so the same tracking number stays with you if you come back.
• If you reject, or have not chosen yet, nothing is stored in your browser for analytics or advertising. PostHog still counts visits, using a code its servers work out from your IP address and browser for that day only, which is never stored on your device. If you arrived from one of our adverts, a random visit code is added to the links you follow on our website, so the same tracking number stays with you during your visit.
• Whatever you choose, we keep your choice in your browser for 12 months, so that we do not ask again on every page.
• Our enquiry forms are protected from spam by Google reCAPTCHA, which is loaded when you start filling in a form and collects information about your device and browser. Its use is subject to the Google Privacy Policy and Terms of Service.
• Our videos load from YouTube's privacy-enhanced service (owned by Google) only when you press play, and YouTube may then store information in your browser.

You can also block or delete cookies and browser storage in your browser's settings.

Data accuracy

It is important that the data we hold about you is accurate and up to date. If your details change, please let us know so that we can update our records.

How we use your information

We use your personal data only where the law allows us to. The information we collect is mainly used:

• To provide our services to you, to communicate with you and to meet our contractual commitments to you. This may include Identity, Contact, Property, Financial and Transaction data.
• To tell you about changes to our business or services that may affect our service or relationship with you. This may include Identity and Contact data.
• If you are an existing customer, to contact you about goods and services similar to those you bought from us. This may include Identity and Contact data.
• To measure which of our adverts and web pages lead to enquiries, and to improve our service and train our team, including with call recordings. This may include Technical, Call and Profile data.
• Where we need to comply with a legal obligation. This may include Identity, Contact and Transaction data.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. This may include all types of data.

When we collect your data for marketing purposes we will always ask for your consent at the point the data is collected.

We will only use your personal data for a reason other than the one for which it was originally collected if we consider that we need to use it for that other purpose and have a legitimate interest in doing so.

Who we share your information with

• Our service providers, who process data on our behalf and may use it only to provide their service to us: our telephone answering service; our telephone provider (Twilio); website hosting and security (Cloudflare); website analytics (PostHog); email (Google); spam protection on our forms (Google reCAPTCHA); and advert measurement (Google Ads).
• Regulatory bodies: to comply with the law and to help prevent fraud. This may include Identity, Contact and Transaction data.
• Our suppliers: third parties involved in carrying out our services for you. This may include Identity, Contact and Transaction data.
• Business sale: if we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer, and if CDC RESTORATION LTD's business is bought by a third party, personal data held about its customers will be one of the assets transferred to the buyer. Any such transfer will only be on terms that keep your personal data confidential and require the recipient to keep to this policy.

We never give advertisers your name, email address or phone number. We share only advert click identifiers, as described above, and aggregated data about our website visitors and customers.

If you do not want us to share your data with third parties, you can tell us when you give us your details, or at any time by writing to the address above or emailing info@chameleon-restoration.co.uk. Where we rely on your consent, you can withdraw or change it at any time in the same way.

Where your data is stored

Some of our service providers store or process data outside the United Kingdom, for example in the European Union or the United States. Where they do, we make sure your data stays protected, using UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum.

Security

The transmission of information over the internet or by email is not completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of data while you are sending it to us; any such transmission is at your own risk.

We have security measures in place to prevent your data from being accidentally lost, used or disclosed. Once we have received your personal data, we use strict procedures and security features to try to prevent unauthorised access.

In the event of a data breach we will notify the Information Commissioner's Office (ICO), and you if the breach is likely to result in a high risk to you.

How long we keep your data

We keep data only for as long as we need it for the purpose for which it was collected, or to meet legal requirements.

• Customers and suppliers: we are legally required to keep certain Identity, Contact, Financial and Transaction data for at least six years.
• Call recordings from our tracking numbers: 12 months, then deleted.
• The number you called from, in our call-tracking records: 120 days.
• Advert details on our systems: 90 days from the advert click; the visit code in your browser, only if you accept cookies: 90 days.
• Your cookie choice in your browser: 12 months.
• Marketing: if you have asked to receive marketing from us, until you withdraw your consent.

Your rights

The UK GDPR gives you a range of rights over the personal data we hold about you. You have the right to:

• Access your personal data (a "data subject access request"), and receive a copy of the personal data we hold about you. You will not need to pay a fee unless the request is clearly unfounded, repetitive or excessive. We will respond within one month, but may need further information from you to confirm your identity.
• Have any incomplete or inaccurate data we hold about you corrected.
• Ask us to delete your personal data where there is no good reason for us to keep it. We may not always be able to, for example if we have an ongoing contract with you or a legal duty to keep the data.
• Object to us processing your personal data where we rely on our legitimate interests (or those of a third party), and to direct marketing at any time.
• Ask us to restrict how we process your personal data.
• Ask us to transfer your personal data to you or to a third party in a structured, machine-readable format.
• Withdraw your consent at any time where we rely on consent. If you do, we may not be able to provide certain services to you, and we will tell you if so.

You can use these rights at any time by writing to us at the address above or by emailing info@chameleon-restoration.co.uk.

Third-party links

Our website contains links to other websites. If you follow a link to another website, that site may collect and share data about you. Those websites have their own privacy policies, which you should check. We do not accept any responsibility or liability for them, as we have no control over them.

Complaints

If you would like to complain about how we use your personal data, please contact us first so that we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

Changes to this policy

We may update this policy to reflect changes to our website, our services or the law. Please check it from time to time. If you have any question, comment or request about this policy, please contact us.

Version: October 2026