Privacy Policy

Effective Date: 25th September 2026
Last Updated: 25th September 2026

1. Introduction & Who We Are

Summit Elevators Ltd (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Notice explains how we collect, use, store, and safeguard your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the purposes of data protection legislation, the Data Controller is:

Summit Elevators Ltd
Registered in England & Wales (Company No. 3306900)
VAT Registration Number: GB689648161
Registered Office & Trading Address: Unit 19 Vulcan Business Centre, Vulcan Way, New Addington, Croydon, Surrey, CR0 9UG
Telephone: 01689 848455
Email: mail@summitelevators.co.uk

2. Personal Data We Collect

We may collect, record, and process the following categories of personal data:

• Contact & Enquiry Data: Full name, email address, telephone number, job title, company name, and the contents of any message or quote request submitted via our website forms, email, or post.
• Telephone Call Recordings: When you call our office (01689 848455), calls are recorded for quality assurance, staff training, and dispute resolution purposes. This includes the audio recording of the conversation and caller identification metadata (time, date, phone number).
• Technical & Usage Data: Internet Protocol (IP) addresses, browser type and version, operating system, time zone settings, referral sources, and page interaction information automatically collected by our web server and security monitoring services.
• Client & Service Delivery Data: Site access details, billing addresses, contact names, and records of lift installation, maintenance, refurbishment, or modernisation works carried out for our commercial and residential clients.

3. Lawful Basis and Purposes for Processing

Under the UK GDPR, we only process personal data when we have an established legal basis. The table below details our processing purposes and their corresponding lawful bases:

Processing Purpose	Category of Data	Lawful Basis (UK GDPR)
Responding to website enquiries, quote requests, and customer service communications.	Name, Email, Phone, Message Content	Legitimate Interests (responding efficiently to prospective and existing clients) & Steps prior to entering into a contract.
Telephone call recording for training, monitoring, and verification.	Audio Recordings, Call Timestamps, Caller ID	Legitimate Interests (ensuring high service quality, staff coaching, and resolving customer queries or disputes).
Fulfilling lift installation, maintenance, refurbishment, and modernisation contracts.	Contact Details, Site Addresses, Invoicing Data	Performance of a Contract.
Website security, malware scanning, spam prevention, and server performance.	IP Addresses, Server Logs, Browser User Agent	Legitimate Interests (protecting our digital infrastructure against security threats) & Legal Obligation.
Direct marketing, company newsletters, and service updates (where opted in).	Name, Email Address	Consent (via affirmative opt-in checkbox, which can be withdrawn at any time).

4. Third-Party Data Sharing & Disclosures

We do not sell, rent, or trade your personal information. We may share information with trusted third-party service providers solely to the extent necessary to operate our business and website:

• Hosting & Cloud Infrastructure: Secure web hosting, content delivery, and database storage providers.
• Spam Prevention & Security: Automated anti-spam screening services (e.g., Akismet) and security scanning services (e.g., Sucuri Security) to protect form submissions and site integrity.
• Telecommunications & IT Providers: Telephony networks handling our telephone line and secure cloud storage for call recordings.
• Professional & Statutory Advisers: Accountants, legal advisors, insurers, and auditors where required for compliance and business governance.
• Law Enforcement & Regulators: If required by law, court order, or governmental regulation.

5. International Data Transfers

Whenever personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are implemented in compliance with UK GDPR (such as UK International Data Transfer Agreements or adequacy regulations).

6. Data Retention Schedules

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and statutory reporting obligations:

• Routine Website Enquiries: Retained for up to 12 months after the enquiry has been resolved, unless it leads to a commercial contract.
• Client & Contract Records: Retained for 6 years following the end of the customer relationship or contract termination, in accordance with UK statutory limitation periods.
• Telephone Call Recordings: Retained securely for up to 12 months, after which they are routinely deleted unless required for ongoing legal dispute resolution or regulatory investigation.
• Technical Server Logs: Retained for up to 90 days for diagnostics and cybersecurity monitoring before automated deletion.

7. Data Security

We implement robust technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include SSL/TLS encryption for all website communications, firewall and malware scanning, access-controlled servers, and strict internal confidentiality controls.

8. Your Legal Rights (UK GDPR)

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights regarding your personal data:

• Right of Access (Subject Access Request): You have the right to request a copy of the personal information we hold about you.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): You have the right to request that we delete your personal data where there is no compelling legal reason for its continued processing.
• Right to Restriction: You have the right to request that we suspend the processing of your personal data under certain conditions.
• Right to Object: You have the right to object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing emails), you may withdraw that consent at any time.

To exercise any of these rights, please contact our team in writing using the contact details provided below. We do not charge a fee for standard requests and will respond within one calendar month.

9. Contacting Us & Complaints to the ICO

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

Privacy Officer
Summit Elevators Ltd
Unit 19 Vulcan Business Centre, Vulcan Way, New Addington, Croydon, Surrey, CR0 9UG
Email: mail@summitelevators.co.uk
Telephone: 01689 848455

If you are not satisfied with our response or believe our processing of your personal data does not comply with the law, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk