What this notice covers and who controls the data
This notice covers information sent through the six-step roof assessment form on this website. It does not describe a customer account, payment service, newsletter or photograph-upload system because those features are not present. The public trading name is The Roofing Specialists; the legal controller identity and controller contact must be added when the connected operator is approved for publication.
Until that controller detail is published, privacy questions can be raised through the public contact route on 01383 252038. The missing operator identity is not inferred from the brand, domain or website code. A production operator must confirm its identity, lawful basis, delivery providers and retention schedule before relying on this notice as its complete controller information.
Information sent by the roof enquiry form
The form sends the concern selected, observed signs, a written description, postcode, town or city, property type, access notes, desired outcome, name, email address, optional phone number and preferred contact method. It also sends the submission time, a roof-type label derived from the selected concern, an urgency description, a numerical priority score and a priority label.
Name, email, postcode, concern, observed signs, description and the final confirmation are required by the visible form. The server also requires a roof type, urgency value, postcode, name, confirmation and at least one valid contact route. Phone, town or city, access notes and contact preference are optional. Do not include payment data, identity documents or sensitive personal details in the free-text description.
What happens when you press send
The browser posts a JSON payload to the website's roof-inspection endpoint. The shared lead Worker checks the request method and allowed origin, limits the request size, validates required fields, rejects invalid email syntax and can verify Cloudflare Turnstile when that control is configured. Successful and error responses are marked no-store so the browser or intermediary should not cache the response body.
The Worker does not write the enquiry to an application database. When delivery is configured, it sends a normalised copy either to an operator webhook or through the configured email provider, currently supported by Resend. The receiving mailbox, webhook system and their service logs are separate places where a copy can exist and must be covered by the operator's provider and retention records.
How the priority indicator works
The form applies fixed points to a small set of answers: an active leak, damp or dripping after rain, debris at ground level, and whether the property is commercial, managed or shared. The total is converted to Standard, Medium, High or Urgent before the payload is delivered. This helps a recipient scan the reported circumstances; it is not a roof diagnosis, safety assessment or guaranteed response time.
The score does not make a legal or similarly significant decision about the person submitting the form. A recipient still needs to read the description and decide what information or action is appropriate. If there is immediate danger, keep clear and use the relevant emergency service rather than relying on a website priority label.
Purpose, confirmation and lawful basis
The form information is used to deliver the requested enquiry, understand the roof and property context, respond through the chosen contact route, organise relevant follow-up, prevent misuse and investigate delivery failures. The final checkbox is required before transmission and records that contact about this enquiry is requested. The payload contains no newsletter or unrelated marketing opt-in.
The approved controller must document and publish the lawful basis it relies on for each purpose. The website should not present the checkbox as permission for unrelated marketing, sell the enquiry as a general contact list or use the description for a new incompatible purpose without providing the information and choice required for that use.
Who receives the data and where it can travel
The categories of recipient are the connected website operator, authorised people handling its roofing enquiries, Cloudflare as the website and Worker infrastructure provider, the configured email delivery provider and mailbox recipients, or the configured webhook provider. Turnstile receives the information needed for its security check only when that control is enabled.
The exact provider names, processing locations and any international-transfer safeguards depend on the production configuration selected by the approved operator. Those details must be recorded and added to the notice when configuration is confirmed. The current application code does not create a customer database, share the payload with advertising networks or upload photographs.
Retention criteria and deletion
The website application keeps no database copy of a submitted enquiry. Copies delivered to an email inbox or webhook system should be retained only while they are needed to respond, manage relevant follow-up, resolve a complaint or delivery problem, protect the service from misuse, or meet a documented legal record requirement. A priority label does not justify keeping an enquiry for longer.
When the enquiry and relevant follow-up are closed, the recipient should review the record and delete or anonymise it unless a recorded reason requires continued retention. Provider security and delivery logs can follow separate, documented periods. The approved operator must publish its standard periods where possible and regularly remove information that is no longer needed.
Your rights, objection and complaint route
Depending on the confirmed lawful basis and circumstances, you can ask for access to your personal information, correction, erasure, restriction, portability or an explanation of how it was used. You can object to processing where the right applies. The right to object should be raised clearly with the controller, especially if information is used beyond answering the requested enquiry.
To start a request, contact 01383 252038, identify the roof enquiry and say that the request concerns personal information. The controller may need proportionate information to locate the record and verify the requester. You can also complain to the Information Commissioner's Office if a concern is not resolved.
Browser storage, security and notice updates
Form answers are held in page memory while the modal is open and are reset when a new form session starts. The form code does not write those answers to localStorage or sessionStorage. Transport uses HTTPS on the production site, the Worker rejects disallowed origins, and request-size, validation, spam-trap and optional Turnstile controls reduce misuse; no internet transmission can be described as risk-free.
This notice should be reviewed whenever the operator, form fields, recipients, delivery route, security controls, purposes or retention rules change. A materially new use should be explained before it begins. The page's wording must continue to match both the deployed code and the approved operator's actual handling practice.
