Privacy policy

This Privacy Policy explains how Broanmain Limited ("Broanmain", "we", "us", "our") collects, uses and protects the personal data of anyone who visits our website, enquires about our services, supplies us, works with us, or applies to work for us.

We are registered in England and Wales under company number 01155816, with our registered office at Forge Works, Horsham Road, Mid Holmwood, Dorking, Surrey, RH5 4EH. We are the data controller for the personal data we process.

We only collect personal data that we genuinely need. Depending on how you interact with us, this may include:

• Contact details, name, company, job title, email address, phone number, postal address.
• Enquiry information, the content of your enquiry, any drawings or files you attach, and any follow-up correspondence.
• Transactional data, purchase orders, invoices, delivery records and payment references (for customers and suppliers).
• Marketing preferences, whether you have opted in to receive our newsletter or other communications.
• Technical data, IP address, browser type, device type, pages viewed on our website, and session duration (collected automatically).
• Recruitment data, CV, cover letter, work history, proof of eligibility to work (only if you apply for a role).

We do not collect special category data (such as health or ethnicity) unless you voluntarily provide it in a job application or a direct communication.

We use your personal data for the following purposes, relying on the lawful bases under the UK GDPR indicated:

• To respond to your enquiries, legitimate interest / performance of a contract.
• To quote for, fulfil and deliver orders, performance of a contract.
• To maintain our customer and supplier records, legitimate interest / legal obligation.
• To send you our newsletter or industry updates, consent (you can withdraw at any time).
• To comply with legal, regulatory and accounting obligations, legal obligation.
• To investigate complaints or disputes, legitimate interest.
• To maintain website security and prevent abuse, legitimate interest.

We do not sell your personal data. We only share it where strictly necessary, with:

• Professional advisors, our accountants, auditors, lawyers and bankers.
• IT and service providers, our hosting provider, CRM, email infrastructure, accounting software and payroll providers, all bound by data processing agreements.
• Carriers and couriers, to deliver goods to customers.
• Regulators and public authorities, where we are legally required (HMRC, Companies House, ICO, etc.).

We do not transfer personal data outside the UK or the European Economic Area without appropriate safeguards in place.

We only keep personal data for as long as we need it, and in line with legal obligations:

• Contact enquiries: up to 3 years after the last interaction, unless you become a customer.
• Customer and supplier records: 7 years after the last transaction (for HMRC purposes).
• Newsletter subscribers: until you unsubscribe.
• Job applications: up to 12 months, unless you ask us to keep your CV longer.
• Website analytics: up to 26 months, anonymised thereafter.

Under UK GDPR you have the right to:

• Request a copy of the personal data we hold about you (a "subject access request").
• Ask us to correct any inaccurate or incomplete information.
• Ask us to delete your data where there is no overriding lawful reason to keep it ("right to be forgotten").
• Restrict or object to our processing of your data.
• Withdraw any consent you have given (e.g., unsubscribe from marketing).
• Lodge a complaint with the Information Commissioners Office (ICO), ico.org.uk.

To exercise any of these rights, please contact us using the details below. We will respond within 30 days.

Our website uses a small number of cookies:

• Strictly necessary cookies, for core site functionality (no consent required).
• Analytics cookies, to understand how visitors use the site, collected in aggregated, anonymised form.
• Preference cookies, to remember dismissed announcements or language preferences.

We do not use advertising, retargeting or third-party tracking cookies. You can control cookies through your browser settings at any time.

We take data security seriously. Our measures include encryption in transit (HTTPS), access controls on our systems, regular security updates, a secure backup regime, and a documented incident response process. If we ever suffer a personal data breach that is likely to risk your rights and freedoms, we will notify the ICO within 72 hours and, where necessary, inform you directly.

We may update this policy from time to time to reflect changes in law, technology or our business. The "Last updated" date at the top of this page indicates when it was most recently changed. We recommend checking this page periodically.

If you have any questions about this Privacy Policy, or wish to exercise any of your rights, please get in touch: