Data Controller
Quest End Ltd — Registered in England & Wales
18 Queen Street, Maidenhead, Berkshire, SL6 1HZ
Telephone: 01628 290640 | Email: info@questend.co.uk
01Who We Are
Quest End Ltd ("we", "us", "our") is a custom installation company based in Maidenhead, Berkshire. We specialise in home cinema, smart home automation, lighting control, commercial AV, and structured networking.
We are the data controller for the personal data we collect in connection with our business activities and this website (www.questend.co.uk). We are committed to protecting your personal data and processing it fairly and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
02Data We Collect
Depending on how you interact with us, we may collect and process the following categories of personal data:
- Identity data: your name and, where relevant, the name of your business.
- Contact data: your email address, telephone number, and postal address (including the address of the property where work is to be carried out).
- Enquiry data: details of your project requirements, budget indications, and any other information you provide when contacting us.
- Financial data: invoice and payment records (we do not store full card details; card payments are handled by our payment processor).
- Contractual data: details of agreed works, signed quotations, and project documentation.
- Technical data: IP address, browser type, and pages visited on our website, collected via server logs and analytics tools.
- Communications data: records of emails, calls, and messages between you and Quest End Ltd.
We do not collect any special category data (such as health information or biometric data) unless it is volunteered by you and directly relevant to a project requirement.
03How We Collect It
We collect personal data through the following means:
- Direct contact: when you call, email, or submit an enquiry form on our website.
- Site surveys: when one of our engineers or designers visits your property.
- Contracts and proposals: when you accept a quotation or sign a works agreement.
- Our client portal: when you register for or use our secure client portal to access project documentation.
- Automated technologies: our web server logs and any analytics tools we use may automatically collect technical data about your visit to our website.
04Lawful Basis for Processing
We rely on the following lawful bases to process your personal data:
- Contract: processing is necessary to perform a contract with you, or to take steps at your request before entering into one (e.g. preparing a quotation, carrying out an installation).
- Legal obligation: processing is necessary to comply with our legal obligations (e.g. retaining financial records for HMRC purposes).
- Legitimate interests: processing is necessary for our legitimate interests in running our business (e.g. responding to enquiries, managing client relationships, improving our services), provided those interests are not overridden by your data protection rights.
- Consent: where we send you marketing communications, we will only do so if you have given your consent. You can withdraw consent at any time by emailing us at info@questend.co.uk.
05How We Use Your Data
We use your personal data to:
- Respond to your enquiries and prepare quotations or proposals.
- Plan, schedule, and carry out installation and programming works.
- Invoice you and manage payment records.
- Provide after-sales support, warranty call-outs, and ongoing maintenance.
- Grant you access to our secure client portal to view project files and documentation.
- Communicate with you about your project, including updates, scheduling, and follow-up.
- Comply with our legal and regulatory obligations.
- Send you relevant service updates or offers where you have consented to receive them.
- Improve our services and website through analysis of usage data.
We will not use your data for automated decision-making or profiling.
06Sharing Your Data
Quest End Ltd does not sell your personal data to third parties. We may share your data with:
- Our team members: engineers, designers, and administrative staff who need access to carry out or coordinate your project.
- Subcontractors: trusted specialist tradespeople (e.g. electricians, decorators) engaged to support specific projects, bound by confidentiality obligations.
- IT service providers: Microsoft (Microsoft 365, Azure, SharePoint) for email, document storage, and our client portal infrastructure. Microsoft processes data under standard contractual clauses as an approved data processor.
- Accounting software: Sage, used for invoicing and financial records.
- Payment processors: for processing card payments where applicable.
- Professional advisers: solicitors, accountants, or insurers where necessary.
- Legal authorities: where required by law, court order, or to protect our legal rights.
All third parties are required to process your data securely and only for the purposes we specify.
07Data Retention
We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, and to comply with our legal obligations:
- Enquiry data (not converted to a project): retained for up to 12 months from the date of last contact.
- Client and project data: retained for 7 years following project completion, in line with our obligations under UK tax and company law, and to support any warranty or liability claims.
- Financial records: retained for 7 years to comply with HMRC requirements.
- Website technical data: retained for up to 12 months.
When data is no longer required, it is securely deleted or anonymised.
08Security
We take the security of your personal data seriously. We use a range of technical and organisational measures to protect it, including:
- Secure, encrypted cloud storage via Microsoft 365 and Azure (UK/EU data regions).
- Access controls ensuring only authorised personnel can access client data.
- Secure email communications and encrypted client portal access.
- Regular review of our security practices.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform you without undue delay where required.
09International Transfers
We primarily store and process data within the United Kingdom and the European Economic Area. Where any data is transferred outside the UK (for example, as part of services provided by our cloud software suppliers), we ensure that appropriate safeguards are in place in accordance with UK GDPR, such as the use of the International Data Transfer Agreement (IDTA) or equivalent standard contractual clauses.
10Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of Access
You can request a copy of the personal data we hold about you (a Subject Access Request).
Right to Rectification
You can ask us to correct inaccurate or incomplete personal data.
Right to Erasure
You can ask us to delete your data where we no longer have a lawful basis to hold it.
Right to Restrict Processing
You can ask us to limit how we use your data in certain circumstances.
Right to Object
You can object to processing based on our legitimate interests, including direct marketing.
Right to Portability
You can request a structured copy of your data for transfer to another provider.
To exercise any of your rights, please contact us at info@questend.co.uk or by post. We will respond within one calendar month. There is no charge for exercising your rights unless a request is manifestly unfounded or excessive.
11Cookies
Our website uses a small number of cookies to ensure it functions correctly:
- Theme preference: a cookie or localStorage entry to remember whether you prefer the light or dark theme.
- Session cookies: used by our client portal login system to maintain your authenticated session.
We do not currently use third-party advertising or tracking cookies. If we introduce analytics cookies in the future, we will update this policy and obtain your consent where required.
12Children
Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.
13Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any material changes will be published on this page with an updated "last updated" date. We encourage you to review this page periodically.
Continued use of our website or services following any update constitutes your acceptance of the revised policy.