Last updated: 08.09.2026
1. Who we are
Doors & Windows London is a trading name of DOORSWINDOWSLONDON LTD, a company registered in England and Wales under company number 13233707, with its registered office at 124 Mostyn Road, London SW19 3LR. Our VAT number is 385999214.
We are the “data controller” of the personal information described in this policy. This means we decide how and why your information is used.
We are registered with the Information Commissioner’s Office (ICO) under registration number ZB743518.
How to contact us about your data:
Email: [email protected]
Telephone: 020 4537 3998
Post: Data Protection, Doors & Windows London, 124 Mostyn Road, London SW19 3LR
2. What information we collect
When you contact us through our website
- your first name and last name
- your email address
- your telephone number
- the address and postcode of the property you are enquiring about
- your profession, for example homeowner, architect or installer
- the type of work you are enquiring about
- the content of your message
- any files you choose to upload, such as photographs, drawings or measurements
- whether you have asked to receive marketing communications
When we survey, quote for or carry out work
- measurements, photographs and technical drawings of your property
- details of the products you have chosen
- correspondence between us
- payment and invoicing details
- for installations, the information required for Building Regulations certification
Automatically, when you use our website
- your IP address and general location
- your browser and device type
- pages you visited and how you arrived at our site
- a Google Click Identifier if you reached us by clicking one of our Google adverts
We use this technical information to keep the site secure and, where you have given consent, to understand how the site is used. See our Cookie Policy for detail.
3. Why we use your information, and our lawful basis
UK GDPR requires us to have a lawful basis for everything we do with your data. Ours are set out below.
| What we do | Why | Lawful basis |
|---|---|---|
| Respond to your enquiry and prepare a quotation | Because you asked us to | Steps taken at your request before entering into a contract |
| Arrange and carry out a survey | To measure and specify the work | Performance of a contract, or steps before a contract |
| Order products from our manufacturers | To make what you ordered | Performance of a contract |
| Deliver and install | To complete the work | Performance of a contract |
| Notify your installation to FENSA | Building Regulations require replacement windows and doors to be certified | Legal obligation |
| Register your insurance-backed guarantee | To give you the guarantee cover we promised | Performance of a contract |
| Keep accounting and tax records | HMRC requires it | Legal obligation |
| Protect our website from attack and spam | To keep the site and your data safe | Our legitimate interests in security |
| Measure website and advertising performance | To understand what works | Your consent, given through our cookie banner |
| Send you marketing about our products | To tell you about what we offer | Your consent, which you can withdraw at any time |
You do not have to give us consent to get a quotation. If you ask us for a quote, we will respond to you whether or not you tick the marketing box.
4. Who we share your information with
We do not sell your personal information to anyone.
We share it with the following, only where necessary:
- Manufacturers and suppliers. To make your windows and doors, we send your name and the installation address to the manufacturer producing them. Most of our manufacturing partners are based in Poland; some are in the United Kingdom.
- Transport and logistics companies, so that goods reach the correct address.
- Our installation teams, who need your address, contact details and access arrangements to carry out the work.
- FENSA, the Competent Person Scheme for windows and doors, when we notify your installation for Building Regulations certification. This includes the property address and the details of the work.
- The Consumer Protection Association, where your work is covered by an insurance-backed guarantee.
- Our accountants, for bookkeeping, VAT and statutory accounts.
We also use IT and service providers who process information on our behalf under contract:
- Google – email, document storage, analytics, advertising and tag management
- Cloudflare – website delivery, security and bot protection
- our website hosting provider
- Anthropic – automated reading and sorting of documents and correspondence, described in section 5
- Cookiebot by Usercentrics – cookie consent management
- Wordfence – website security monitoring
We may also disclose information where we are required to do so by law, or to establish, exercise or defend legal claims.
5. Automated processing of documents and correspondence
We use an automated system to help us handle enquiries efficiently. It reads incoming emails and attached documents, such as quotations, drawings and scanned paperwork, in order to sort them, extract key details such as dates and reference numbers, and file them against the right project.
This processing is carried out on our behalf by Anthropic, an artificial intelligence provider, under contract. Documents may contain your name, address and details of your project.
This system does not make any decision about you. It sorts and files information; a person decides what we quote, what we charge and whether we take on work. You are not subject to automated decision-making that produces legal effects concerning you.
6. Sending information outside the UK
Some of the organisations above are outside the United Kingdom.
European Economic Area. Most of our manufacturing partners are in Poland. The UK Government has decided that the EEA provides an adequate level of data protection, so no additional safeguards are required for these transfers.
United States. Google, Cloudflare and Anthropic may process information in the United States. Where they do, transfers are protected by the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or by these providers’ certification under the UK Extension to the EU–US Data Privacy Framework.
You can ask us for more detail about these safeguards using the contact details in section 1.
7. How long we keep your information
| Information | How long | Why |
|---|---|---|
| Records of completed installations, including certificates and guarantees | 10 years after completion | To honour the guarantee and to answer questions about work we carried out |
| Accounting and VAT records | 6 years after the end of the financial year | Required by HMRC |
| Photographs, drawings, measurements and uploaded files from enquiries that did not become orders | 12 months after our last contact with you | They have no further purpose once an enquiry has gone cold |
| Name, email address and the district of your postcode, from enquiries that did not become orders | 36 months after our last contact with you | So we can follow up if you return to the project |
| Website security logs | As set by our security providers, typically 30 days | To investigate attacks |
| Marketing consent records | Until you withdraw consent, plus 2 years | To show we had your permission |
When an enquiry has gone cold, we delete the documents but keep a short record: when you contacted us, the general area you were in, for example “SW19” rather than your full address, what you asked about, and your email address.
8. Your rights
Under UK data protection law you have the right to:
- be told how we use your information – that is what this policy is for
- ask for a copy of the personal information we hold about you
- have inaccurate information corrected
- ask us to delete your information, where we have no continuing reason to keep it
- ask us to restrict how we use it while a concern is resolved
- object to processing we carry out on the basis of legitimate interests
- receive your information in a portable format, in some circumstances
- withdraw consent at any time, where we relied on consent
To exercise any of these rights, contact us using the details in section 1. We will respond within one month. There is normally no charge.
Please note that some information we must keep by law, such as accounting records and Building Regulations certification, and we cannot delete these on request.
To stop marketing emails, use the unsubscribe link in any message, or simply tell us. This will not affect anything else we do for you.
9. Cookies
Our website uses cookies and similar technologies. We ask for your consent before setting anything that is not strictly necessary, and you can change your choice at any time.
Full detail is in our Cookie Policy.
10. Keeping your information secure
Our website runs over an encrypted connection, sits behind Cloudflare’s security service, and is monitored for attacks. Access to our systems is limited to people who need it, and we keep security software up to date.
No system is completely secure. If a breach occurs that is likely to put your rights at risk, we will tell you and report it to the ICO as the law requires.
11. Changes to this policy
We may update this policy. The date at the top shows when it was last changed. If we make a significant change, we will make that clear on our website.
12. Complaints
If you are unhappy with how we have handled your information, please tell us first – we would like the chance to put it right.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint