Privacy Policy

Last updated: May 2025

1. Who We Are

Alton Valley Ltd ("Alton Valley", "we", "us", "our") is a company registered in England and Wales (Company No. 07081802) with its registered office at 15 St Christopher's Way, Pride Park, Derby DE24 8JY.

We are the data controller for the personal information we collect about you. We are committed to protecting your privacy and handling your data in an open and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

Depending on how you interact with us — including via our website, WhatsApp Business messaging service, or direct enquiry — we may collect the following categories of personal data:

Identity & Contact Data

• Full name
• Job title and company name
• Email address
• Phone number (including WhatsApp number)
• Postal address

Communications Data

• Messages and enquiries you send us via WhatsApp or our contact form
• Records of correspondence and support interactions
• Timestamps and delivery status of messages

Technical Data

• IP address and browser type
• Pages visited and time spent on our website
• Device type and operating system

Usage Data

• Information about how you use our website and services
• Preferences and settings you have shared with us

3. How We Collect Your Data

We collect personal data through:

• Our website contact and enquiry forms
• WhatsApp Business messaging (via Meta's WhatsApp Business Platform)
• Direct email or telephone correspondence
• In-person meetings, events, and trade shows
• Automated technologies such as cookies and analytics tools
• Third parties such as referrals, publicly available sources, or business partners

4. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiries — processing contact and project requests submitted via our website or WhatsApp
• To deliver services — managing contracts, coordinating project delivery, and providing ongoing support
• To communicate with you — sending service updates, notifications, and relevant information via WhatsApp or email where you have consented or we have a legitimate interest
• To improve our website and services — analysing usage data to enhance user experience
• To comply with legal obligations — meeting our responsibilities under applicable law

5. Legal Basis for Processing

We rely on the following lawful bases under UK GDPR to process your data:

• Contract — where processing is necessary to perform a contract with you or take steps at your request before entering a contract
• Legitimate interests — where processing is necessary for our legitimate business interests (e.g. responding to enquiries, improving our services), provided these are not overridden by your rights
• Consent — where you have given clear consent for us to contact you via WhatsApp or for marketing communications. You may withdraw consent at any time
• Legal obligation — where processing is necessary to comply with a legal or regulatory requirement

6. WhatsApp Business Messaging

We use the WhatsApp Business Platform, operated by Meta Platforms Ireland Limited, to communicate with customers and contacts who opt in to this channel. By messaging us or consenting to receive messages via WhatsApp, you acknowledge that:

• Messages are transmitted via Meta's infrastructure and subject to WhatsApp's Privacy Policy
• We will only send you relevant business communications — we will never use WhatsApp for unsolicited marketing without your explicit consent
• You can opt out at any time by replying STOP or contacting us directly
• Message and call rates from your mobile network provider may apply

7. Data Sharing

We do not sell your personal data. We may share your data with:

• Service providers — trusted third parties who assist in operating our business (e.g. cloud hosting, CRM, analytics, messaging platforms) under strict data processing agreements
• Meta Platforms — as required to deliver WhatsApp Business messaging
• Professional advisors — lawyers, accountants, and auditors where necessary
• Regulatory and law enforcement authorities — where required by law or to protect legal rights
• Business transfers — in the event of a merger, acquisition, or sale of assets

All third-party processors are subject to appropriate contractual safeguards.

8. International Transfers

Some of our service providers (including Meta) may process data outside the UK. Where such transfers occur, we ensure appropriate safeguards are in place, such as UK adequacy decisions or standard contractual clauses approved by the ICO.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Typical retention periods are:

• Client and contract records: 7 years after end of contract
• General enquiry data: 2 years from last contact
• Website analytics: 13 months (aggregated)
• WhatsApp message records: 12 months unless forming part of a contract record

10. Your Rights

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access — to request a copy of the data we hold about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure — to request deletion of your data in certain circumstances (see our User Deletion Policy)
• Right to restrict processing — to ask us to limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw at any time

To exercise any of these rights, please contact our Data Protection Officer at contact_dpo@altonvalley.com. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Cookies

Our website uses cookies and similar technologies to improve your browsing experience and analyse usage. These include essential cookies required for site functionality and optional analytics cookies. You may adjust your cookie preferences via your browser settings.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures are regularly reviewed and updated in line with our ISO 27001 and Cyber Essentials Plus certifications.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. We encourage you to review this policy periodically.