Data Protection

The Original Grate Expectations Company Ltd (“GE Ltd” “we” or “us”) is a specialist fireplace installation business and we take our data protection and privacy responsibilities seriously.

This Privacy Policy explains our practices regarding the collection, use, storage of personal information that we receive if you are: (i) a client or corporate customer employee; or (ii) you access our website or contact us about our services (“Service Users”), (collectively “you”).

This Data protection policy supplements the terms and conditions of any agreement we may have with you, and is not intended to override them.

Our website may provide links to third party websites. GE Ltd is not responsible for the conduct of third-party companies linked to the website and you should refer to the privacy notices of these third parties about how they may handle your personal information.

GE Ltd is the Controller of personal data we receive from clients and corporate customer employees and Service Users.

If you have any questions about who may be the Controller and responsible for your personal information, please contact sales@grateexpectations.com

When using the term “personal data” or “personal information” in this Privacy Policy, we mean information (including opinions) that relates to you and from which you could be identified, either directly or in combination with other information which we may have in our possession.

We may collect personal data about you when:
The personal data is provided to us by you (e.g. when you contact us by email or telephone);

The personal data is collected when you contract with us to deliver our services;

The personal data is received by us from third parties who provide it to us (e.g. law enforcement agencies, your employer);

The personal data is received by us from Clients, business partners or supplier);

The personal data has been made public by you (e.g. contacting GE Ltd via a social media platform);

The personal data is collected via our IT systems (e.g. our website); and

The personal data is created by us, such as records of your communications with GE Ltd.

The categories of personal information about you which we may collect and use, depending on our relationship and interactions with you, includes:

- Personal details: title, full name, home address (current and historic), telephone and mobile numbers, email address, gender, date of birth, age, signature.

- Employment details: role, business activities, current employer, work-related social media profile details, business contact details (e.g. contact numbers, business address, work email address).

- Family and Friends Information: family and dependents, emergency contacts.

- Internal Identifiers: participant identification numbers, Client numbers.

- Financial Details: purchase transaction history, financial, bank or credit card information.

- Correspondence: details of referrals, quotes and other general contact and correspondence with you.
Incident History: health and safety accidents, security incidents, accident information, complaints communications.

- Website Access Details: your computers unique identifier (e.g. IP Address), general location, the date and time you accessed the Website, the original site you may have come through e.g. Google.

- Data protection and privacy laws requires organisations to have a “legal basis” or “lawful ground” to collect and handle your personal information. We will only collect, use and share your personal information where we are satisfied that we have an appropriate legal basis to do so.

The purposes for which we may use your personal data and the legal bases we rely on to perform such processing are set out below:

- Where necessary for the performance of a contract with you, or take steps linked to a contract:
- To fulfil our contractual obligations to you; or
- To exercise our legal rights with respect to our contract with you.
- Where you give us consent:

On occasions we may ask for your consent, we will use your personal information for the purposes which we explain at the time

For purposes which are required by law:
In response to requests from government law enforcement authorities conducting an investigation; or

Other processing necessary to comply with professional, legal and regulatory obligations that apply to our business.

Where necessary for GE Ltd’s legitimate interests or those of a third party::

- To deliver our services
- To manage our relationship with you including any enquiries, complaints and feedback;
- For security purposes, including managing access to research materials, authenticating your identity and recording visits to our business premises;
- For promotional purposes;
- For accounting, auditing and risk management purposes;
- To support business and administrative functions;
- For health and safety purposes;
- For staff training purposes;
- To monitor compliance with internal business policies;
- For business management and analysis purposes and to improve the efficiency and quality of service delivered to our Clients;
- To prevent, investigate and/or report fraud, misrepresentation, security incidents or crime, in accordance with applicable law;
- To manage the security of our networks and property and ensure the appropriate use, including monitoring access to our web platform and IT systems;
- In connection with a business transaction such as merger, restructuring or sale of the business; or
We will use personal information in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

Where we need to use your personal information for any other purpose, we will let you know at the time of collection or as required or permitted by law.

GE Ltd sometimes handles personal information relying on exemptions under the applicable data protection law. Any permitted handling of personal information under such exemptions will take priority over this Data protection policy to the extent of any inconsistency.

How do we justify our legitimate interests?
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We have undertaken balancing tests for the data processing we carry out based on our legitimate interests.


We will only disclose personal information to a third party in limited circumstances, or where we are permitted to do so by law. We may share your personal information with Clients, research partners and third parties as described below:

With third parties who help manage our business and deliver services (e.g. payment service providers, debt collectors, IT support service providers, business development contractors, marketing companies) and our professional advisors (e.g. law firms, insurers, auditors, brokers). These third parties have agreed to confidentiality restrictions and use any personal information we share with them or which they collect on our behalf solely for the purpose of providing the contracted service to us;

Third parties approved by you (e.g. when you request your data to be transferred); and
Government, regulatory and law enforcement bodies where we are required in order:
- To comply with our legal obligations;
- To exercise our legal rights (e.g. pursue or defend a claim); and
- For the prevention, detection and investigation of crime.

We may transfer your personal information to third parties in connection with a reorganisation, restructuring, merger, acquisition, sale or transfer of assets, or in the event there is an operational or management change of the business.

If you would like further information about the global handling of your personal information, please contact us at sales@grateexpectations.com.

GE Ltd takes precautions including administrative, technical and physical measures to safeguard your personal information against loss, theft and misuse, as well as against unauthorised access, modification, disclosure, alteration and destruction. We protect your personal information using a variety of security measures including:
- Password protected access;
- Encryption;
- Firewalls;
- Secure, encrypted cloud-based services;
- Placing confidentiality requirements on employees and service providers;
- Providing employee training to ensure that your personal data in handled correctly;
- Destroying or permanently anonymising personal information if it is no longer needed for the purposes it was collected; and
- Secure physical storage units for hard copy files with appropriate security restrictions, preventing damage, and unauthorised access to your personal information.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk. Once we have received your information, we have in place robust procedures and security features to try to prevent unauthorised access.

We will store your personal information for as long as is reasonably necessary for the purposes set out in this Data protection policy.

Other Research Data and General Personal Data:
Unless otherwise stated, GE Ltd will generally retain your personal data in accordance with any applicable limitation period (as set out in applicable law) plus one (1) year, to allow reasonable time for review and deletion/anonymisation of the personal information held.
This will usually be seven (7) years following the expiry of our business or participant relationship with you.

We are required by law (for the purpose of complying with regulatory, tax, accounting requirements etc.) to retain certain information for a period following the expiry of our relationship with you.

In specific circumstances we may store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

You have legal rights in connection with personal information. Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information (commonly known as the “right to be forgotten”). This enables you to ask us to delete or remove personal information in limited circumstances, where: (i) it is no longer needed for the purposes for which it was collected; (ii) you have withdrawn your consent (where the data processing was based on consent); (iii) following a successful right to object (see Object to processing); (iv) it has been processed unlawfully; or (v) to comply with a legal obligation to which the GE Ltd is subject.

We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for several reasons, including: (i) for compliance with a legal obligation; or (ii) for the establishment, exercise or defence of legal claims.
Object to processing of your personal information by us or on our behalf which has our legitimate interests as its legal basis for that processing, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. You can object at any time to your personal information being processed for direct marketing (including profiling).

Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, but only where: (i) its accuracy is contested, to allow us to verify its accuracy; (ii) the processing is unlawful, but you do not want it erased; (iii) it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or (iv) you have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal information following a request for restriction, where: (i) we have your consent; (ii) to establish, exercise or defend legal claims; or (iii) to protect the rights of another natural or legal person.
Request the transfer of your personal information. You can ask us to provide your personal information to you in a structured, commonly used, machine readable format, or you can ask to have it transferred directly to another Controller, but in each case only where: (i) the processing is based on your consent or on the performance of a contract with you; and (ii) the processing is carried out by automated means.

Obtain a copy, or reference to, the personal data safeguards used for transfers outside the European Union. We may redact data transfer agreements to protect commercial terms.

Withdraw consent to processing where the legal basis for processing is solely justified on the grounds of consent.
Please note, to ensure security of personal information, we may ask you to verify your identity before proceeding with any such request.

We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

If you would like to discuss our data protection policy please either call us on 020 8540 8387, use the contact form on this page or write to us at 1-3 Station Buildings, Kingston Road, Wimbledon Chase, SW20 8JT, or email us at sales@grateexpectations.com.