This Privacy Policy explains how Primeman Ltd ("Primeman", "we", "us", or "our") collects, uses, stores, and protects your personal data when you interact with us. It applies whenever you:

• visit our website;

• contact us by email, telephone, or social media;

• request a quotation or engage our services for metalwork, welding, industrial solutions, or consulting;

• subscribe to our communications.

This policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions about this policy or how we handle your personal data, please contact us using the details in Section 16.

1. Who We Are

Primeman Ltd is the "data controller" responsible for your personal data. This means we determine how and why your personal data is processed.

• Company name: Primeman Ltd

• Company number: 15980782 (registered in England and Wales)

• Registered office: Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE

• ICO registration number: ZC144844

• Email: [email protected]

• Privacy contact: [name and role of designated privacy lead]

2. The Personal Data We Collect

2.1 Information you provide directly

We collect personal data that you provide to us when you contact us, request a quotation, engage our services, or correspond with us. This may include:

• full name;

• email address;

• telephone number;

• business or company name and job title;

• project details and requirements;

• billing and payment information; and

• any other information you choose to provide in your communications with us.

2.2 Information collected automatically

When you visit our website, certain information is collected automatically by our website host and security provider. This may include:

• IP address;

• browser type, version, and device information;

• pages visited, time spent on pages, and other usage data;

• approximate location derived from your IP address.

See Section 11 for further details on cookies and website analytics.

2.3 Special category and sensitive data

We do not intentionally collect special category personal data (such as health, racial or ethnic origin, religious beliefs, or biometric data) unless it is strictly necessary and you have given your explicit consent, or where another lawful basis under Article 9 of the UK GDPR applies.

3. How and Why We Use Your Personal Data

We process your personal data only where we have a lawful basis to do so under Article 6 of the UK GDPR. The table below sets out our purposes and the corresponding legal basis:

• To respond to enquiries and provide quotations — legal basis: legitimate interests and steps prior to entering into a contract.

• To deliver our metalwork, welding, industrial, and consulting services — legal basis: performance of a contract.

• To manage client relationships and ongoing communications — legal basis: performance of a contract and legitimate interests.

• To process payments and issue invoices — legal basis: performance of a contract and legal obligation.

• To maintain financial, tax, and accounting records — legal basis: legal obligation.

• To improve our services, website, and operations — legal basis: legitimate interests.

• To send marketing communications about our services — legal basis: consent (which you may withdraw at any time).

• To comply with legal, regulatory, and tax obligations — legal basis: legal obligation.

Where we rely on legitimate interests, we have carried out a balancing exercise to ensure that our interests do not override your rights and freedoms. You may request further information about this assessment using the contact details in Section 16.

4. Who We Share Your Personal Data With

We do not sell your personal data. We share it only with trusted third parties who provide services on our behalf, and only to the extent necessary for them to perform those services. Our current key data processors and service providers include:

• Captivation Hub — our website development and hosting provider, which may process visitor data, including analytics-related information, in the course of operating our website;

• Google Workspace / Gmail — our email and business productivity provider, used for client communications and document handling;

• Cloudflare — our domain and website security and content delivery provider.

We may also share your personal data with:

• payment processors, where you make payments to us;

• our accountants and financial service providers, for invoicing, accounting, and tax purposes;

• contractors or subcontractors, where reasonably required to deliver our services to you;

• professional advisers, such as solicitors and insurers, where necessary;

• regulatory authorities, law enforcement, or government bodies, where required by law or to protect our legal rights.

All third parties acting as our processors are required by contract to handle your personal data securely and in compliance with the UK GDPR.

5. International Data Transfers

Some of our service providers operate internationally, which means your personal data may be transferred to, stored, or processed in countries outside the United Kingdom — including the United States and countries within the European Union.

Where personal data is transferred outside the UK, we ensure that one or more of the following safeguards is in place, as required by the UK GDPR:

• the country has been recognised by the UK Government as providing an adequate level of data protection (an "adequacy decision");

• the transfer is governed by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or

• another lawful safeguard recognised under Article 46 of the UK GDPR.

We only work with reputable providers that implement appropriate technical and organisational security measures. If you would like further information about the safeguards we use, please contact us using the details in Section 16.

6. How Long We Keep Your Personal Data

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, regulatory, or reporting obligations.

In general, client records, communications, invoices, and project-related documents are retained for up to 6 years following the end of a project or the conclusion of the client relationship. This period reflects the limitation period for contractual claims under the Limitation Act 1980 and HM Revenue & Customs requirements for accounting records.

We may retain personal data for a longer period where the law requires us to do so or where it is necessary to defend or establish legal claims. Once data is no longer required, it is securely deleted or anonymised.

7. Data Security

We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include access controls, secure email handling, encrypted website connections through Cloudflare, and the use of reputable cloud-based providers

No system can be guaranteed to be completely secure. While we take reasonable steps to safeguard your data, we cannot guarantee absolute security of information transmitted to us electronically. Any transmission is at your own risk.

8. Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, in accordance with Article 33 of the UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

9. Your Data Protection Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you;

• Right to rectification — to ask us to correct inaccurate or incomplete data;

• Right to erasure ("the right to be forgotten") — to request that we delete your data in certain circumstances;

• Right to restrict processing — to ask us to limit how we use your data;

• Right to object — to object to processing carried out on the basis of legitimate interests, or to direct marketing;

• Right to data portability — to receive your data in a structured, commonly used, machine-readable format;

• Right to withdraw consent — where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month, as required by the UK GDPR. There is normally no charge, although we may charge a reasonable fee or refuse the request where it is manifestly unfounded or excessive.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

• Helpline: 0303 123 1113

• Website: https://ico.org.uk

10. Marketing Communications

We will only send you marketing communications where you have given us your consent to do so, or where we are otherwise permitted by law (for example, where you are an existing client and the communication concerns similar services).
You may unsubscribe from marketing communications at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us at [email protected]. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdrew it.

11. Cookies and Website Analytics

Our website does not currently set marketing or tracking cookies. However, our website is hosted by Captivation Hub and protected by Cloudflare, both of which may use limited technical cookies and collect basic analytics data (such as IP addresses, page views, and device information) for the purposes of website performance, security, and statistical analysis.

Where any non-essential cookies are introduced in future, we will update this policy and obtain your consent through a cookie banner before such cookies are placed on your device, in accordance with the Privacy and Electronic Communications Regulations (PECR). You can also control cookies through your browser settings at any time.

12. Automated Decision-Making and Profiling

We do not use your personal data for any automated decision-making (decisions made solely by automated means without human involvement) or profiling that produces legal or similarly significant effects on you.

13. Third-Party Links

Our website and communications may contain links to third-party websites, plug-ins, or applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

14. Children's Privacy

Our services are directed at businesses and individuals aged 18 and over. We do not knowingly collect personal data from children under the age of 18. If you believe that we may have collected personal data from a child, please contact us so that we can take appropriate steps to delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or for other operational reasons. Where the changes are significant, we will take reasonable steps to notify you. The "Last updated" date at the top of this policy indicates when it was most recently revised. We encourage you to review this policy periodically.

16. How to Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have any concerns about how we handle your personal data, please contact us:

• Primeman Ltd

• Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE

• Email: [email protected]

— End of Privacy Policy —