GDPR Policy

MB Design and Build Limited is committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This GDPR Policy summarises how we meet our obligations and what rights you have.

1. Lawful basis for processing

We only process personal data where we have a lawful basis under UK GDPR Article 6:

• Contract, to deliver services you've engaged us for
• Legitimate interests, to respond to enquiries, run our business, prevent fraud and improve our services
• Legal obligation, for tax, accounting, building regs and CDM compliance
• Consent, for non-essential cookies and any direct marketing

2. Your rights

UK GDPR gives you eight rights over your personal data:

• Right to be informed, what we collect and why (see our Privacy Policy)
• Right of access, request a copy of the data we hold
• Right to rectification, correct inaccurate data
• Right to erasure, request deletion (subject to retention obligations)
• Right to restrict processing
• Right to data portability
• Right to object, to processing based on legitimate interests or marketing
• Rights related to automated decision-making, we do not use automated decision-making

3. Making a request

To exercise any GDPR right, email info@buildbymb.co.uk with the subject line "GDPR request" and the type of request. We respond within one calendar month. We may need to verify your identity before releasing any data.

4. Data protection by design

We follow data-protection-by-design principles:

• We only collect what we need
• We only keep it as long as needed
• We restrict access to those who need it
• We use encrypted email and two-factor authentication on cloud services
• We have a clear breach notification process

5. Data breaches

If a personal data breach occurs that's likely to result in risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and notify you without undue delay where required.

6. Children

Our services are not directed at children under 16 and we do not knowingly collect data about children.

7. International transfers

Where data is transferred outside the UK or EEA (e.g. cloud storage providers), we rely on UK adequacy decisions or standard contractual clauses to ensure equivalent protection.

8. Complaints

If you're not satisfied with how we handle your data, you can complain to the Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

9. Contact

For all GDPR-related questions, email info@buildbymb.co.uk.