Privacy Policy - Hardrock Groundworks Ltd

Hardrock Groundworks Ltd

Last updated: 29 October 2026

This policy explains what personal information we collect when you use hardrockgroundworks.com or contact us, why we collect it, who we share it with and what your rights are.

1. Who we are

Hardrock Groundworks Ltd is a groundworks contractor working across Surrey and Hampshire. We are the controller of the personal information described in this policy, which means we decide how it is used.

• Registered with the Information Commissioner’s Office (ICO): ZC278098

We have not appointed a Data Protection Officer, as the law does not require one for a business of our size. For anything about this policy or your information, contact us:

• Email: enquiries@hardrockgroundworks.com
• Phone: 01252 214 110

2. What we collect and how

When you send us an enquiry. Our contact form asks for your name, email address, phone number (optional) and details of your project. If you email or phone us instead, we receive whatever you choose to tell us, plus your email address or phone number. We use this to reply, prepare a quote and, if you go ahead, run the job. You don’t have to give us any information, but we can’t reply to you or quote without a way to contact you.

When someone else gives us your details. Sometimes we receive your name and contact details from someone else, for example a main contractor, client or site manager on a job we are working on. We use them only for that job.

When you visit our website. Like most websites, our host records technical information each time a page is requested: your IP address, browser and device type, the page requested, the date and time, and the page you came from. This keeps the site working and secure.

Our cookie banner. When you first visit, our banner asks you to choose Accept or Reject. Until you click Accept, none of the analytics or advertising tools below are loaded, and Google Tag Manager (the tool that loads our Google, Microsoft and LinkedIn tags) is not loaded either. Accept turns on all of the tools below together, and shows the Google Map on our contact page. Reject leaves them all off.

If you click Accept: analytics

• Google Analytics 4 tells us how many people visit, which pages they look at, how long they stay and roughly where they are (city or region level). It uses cookies and a random identifier unique to our site. Google uses your IP address to estimate your location but Google Analytics does not store it. We have Google signals switched on, so if you are signed in to a Google account and have allowed ad personalisation, Google may link this to your account to give us combined reports. Our Google Analytics is also linked to our Google Ads account.
• PostHog (which we are trialling) gives us statistics on how visitors use the site: pages viewed, the page or advert that brought you to us (including advert click codes), clicks and scrolling (including heatmaps), page speed, your browser and device type, and whether the contact form was sent (not what you wrote in it). It does not record your session, and it does not capture what you type. It gives your browser a random ID rather than a named profile, and it uses your IP address, which it may keep, to estimate your rough location. Our PostHog data is stored in the EU (Germany).
• Microsoft Clarity records how visitors use our pages: clicks, scrolling, mouse movement and other page interactions, along with device and browser details and rough location from your IP address. We use these recordings and the “heatmaps” built from them to find pages that are confusing or broken. Text typed into form fields is masked, so it is not captured. Clarity gives each browser a pseudonymous ID.

If you click Accept: advertising

• Google Ads conversion tracking tells us whether someone who clicked one of our Google ads went on to send our contact form or click our email address. This helps us see which adverts work and stop paying for those that don’t. Phone calls are not tracked as advert results. Google may also add your browser to a list of people who have visited our site, which can be used to show you our adverts in Google search and on other websites.
• LinkedIn Insight Tag tells us how many visitors come to our site from LinkedIn, and gives us reports on the kinds of people who visit, such as their job titles, job functions, industries and the companies they work for. LinkedIn only shows us these reports once at least 300 LinkedIn members have visited, and they do not tell us who you are. When the tag loads, LinkedIn receives the pages you view, the page you came from, your IP address, your browser and device details and the time of your visit, and it uses cookies to recognise your browser. If you have a LinkedIn account, LinkedIn can link your visit to it. LinkedIn may also add your browser to a list of people who have visited our site, which could be used to show you our adverts on LinkedIn. We are not running LinkedIn adverts at the moment. We do not send LinkedIn your email address or anything you type into our forms.

Map. Our contact page shows a Google Map only if you have clicked Accept. Before you choose, or if you click Reject, the map is not shown and Google Maps is not contacted. When the map loads, Google receives your IP address and browser details, and may set or read its own cookies. The map cannot access your device’s location.

Spam protection. We check submissions from our enquiry forms (on our contact page, our subcontract groundworks page, our contract groundworker page and our excavation and enabling works page) for spam in two ways. Each form has a hidden field that people can’t see. Automated spam programs tend to fill it in, so any submission that does is rejected. Our host also passes each submission through the Akismet spam filter (see section 4), together with the IP address, browser details and previous page that your browser sends with the message. Neither check uses cookies or stores or reads anything on your device, so they run whether you click Accept or Reject.

We do not collect special category information (such as health data) and ask you not to send it to us through the website.

3. Why we use it and our lawful basis

Cookies and PECR. The Privacy and Electronic Communications Regulations (PECR) mean we must ask before placing any cookie or similar technology on your device, or reading information from it, unless it is strictly necessary to provide the website or a service you have asked for. Analytics, recording and advertising tools, and the Google Map on our contact page, only run after you click “Accept”. If you click “Reject”, we use only what is strictly necessary: the cookie that remembers your choice. Our cookie list sets out every cookie we use.

Where we rely on legitimate interests, we have weighed our interests against yours and you can object (see section 8).

4. Who we share it with

We do not sell your information. We share it only with these service providers, who process it on our instructions under their data processing terms:

• Netlify, Inc. – hosts our website, keeps server logs and receives contact form submissions. Netlify passes submissions through Akismet, run by Automattic, Inc., to filter spam.
• Google LLC / Google Ireland Ltd – Google Analytics 4 and Google Tag Manager.
• PostHog, Inc. – trial website analytics. Our PostHog data is stored in the EU (Germany).
• Google (Google Workspace) – our email system, where enquiries arrive.

These providers make their own decisions about the data they collect and act as separate controllers, so their own privacy policies also apply:

• Microsoft Corporation (Microsoft Clarity). Under Clarity’s terms, Microsoft collects personal data through Clarity and may use it to provide Clarity, to improve Microsoft’s products and services, and for other purposes set out in its privacy statement, including advertising (Microsoft Advertising). See the Microsoft Privacy Statement.
• Google (Google Ads and Google Maps). See Google’s Privacy Policy and how Google uses information from sites that use its services.
• LinkedIn (LinkedIn Insight Tag). For visitors in the UK, the LinkedIn company responsible is LinkedIn Corporation (USA). For visitors in the EU, EEA or Switzerland, it is LinkedIn Ireland Unlimited Company. Under LinkedIn’s advertising terms, LinkedIn controls the data it collects through the tag and uses it for its own purposes. These include providing, measuring and improving its advertising services, retargeting and reporting. See the LinkedIn Privacy Policy and LinkedIn Cookie Policy.

We may also share information:

• with our professional advisers, insurers and, for a job, the main contractor or client you have asked us to work with;
• if the law requires it, for example to the police, HMRC or a court;
• with a buyer or successor if our business, or part of it, is sold or restructured.

5. Transfers outside the UK

Some providers above are based in, or use servers in, the United States or the European Economic Area (EEA).

• The UK treats the EEA as giving adequate protection, so no extra safeguards are needed there. Our PostHog data is stored in Germany, although PostHog’s support staff and network providers may access or route it from the US or elsewhere.
• For transfers to the US, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. Google, LinkedIn, Microsoft, Netlify and PostHog are each listed as active participants, including the UK Extension. LinkedIn stores Insight Tag data on its servers in the US. Where the Framework does not apply, the provider’s terms use the EU Standard Contractual Clauses with the UK’s International Data Transfer Addendum, or the ICO’s International Data Transfer Agreement.
• Akismet (run by Automattic), which Netlify uses to filter spam, is not covered by the Data Privacy Framework. Netlify’s data processing terms require any onward transfer to its sub-processors, including Automattic, to be made under the EU Standard Contractual Clauses with the UK’s International Data Transfer Addendum.

Contact us if you would like more detail about these safeguards.

6. How long we keep it

7. Keeping it safe

We use reputable providers, secure (HTTPS) connections and access controls, and only people who need your information can see it. No system is completely secure, but we take reasonable steps to protect your information and will deal with any breach as the law requires.

8. Your rights

You have the right to:

• access the personal information we hold about you;
• rectification: have inaccurate information corrected or incomplete information completed;
• erasure: have your information deleted;
• restriction: ask us to limit how we use your information;
• object to processing based on our legitimate interests (and always to direct marketing);
• portability: receive information you gave us in a common format, or have it sent to another organisation, where we rely on consent or contract;
• withdraw consent at any time, without affecting anything done before you withdrew.

Some rights have exceptions, for example where we must keep records by law. To use any right, contact us using the details in section 1. It is free, and we will reply within one month (we may extend this by up to two months for complex requests and will tell you if so). We may need to confirm your identity first.

9. Changing your cookie choices

You can change your mind at any time:

• click Cookie settings at the bottom of any page (next to the Privacy Policy link) to reopen the banner and choose Accept or Reject again;
• clear cookies and site data in your browser settings;
• use the Google Analytics opt-out browser add-on or manage Google advertising in My Ad Center;
• manage LinkedIn advertising in your LinkedIn ad settings if you have a LinkedIn account, or use LinkedIn’s opt-out for visitors if you don’t.

If you change to Reject, the tools stop straight away (the page reloads), the map is removed, and we remove the analytics and advertising cookies and browser storage set on our own website, including LinkedIn’s li_fat_id cookie. We cannot remove cookies that Google, Microsoft or LinkedIn set on their own websites (for example LinkedIn’s bcookie, lidc and li_sugr). These stay in your browser until they expire or you delete them, but once you choose Reject our site stops sending them information.

10. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

11. Children

Our website and services are for businesses and adults. We do not knowingly collect information from children under 13. If you think a child has given us information, contact us and we will delete it.

12. Other websites

Our site links to other websites, such as Facebook and LinkedIn. We are not responsible for how those sites handle your information, so please read their privacy policies. Our Facebook link is a plain link: Facebook doesn’t load on our pages unless you click it. LinkedIn is different. If you click Accept, our pages load LinkedIn’s Insight Tag (see section 2).

13. Complaints

If you are unhappy with how we have used your information, please contact us first so we can try to put it right. We will acknowledge your complaint within 30 days and tell you what we have done about it without undue delay. You also have the right to complain to the Information Commissioner’s Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

14. Changes to this policy

We may update this policy, for example if we change the tools on our website. The latest version will always be on this page, with the date it was last updated at the top. If a change significantly affects how we use information you have already given us, we will tell you directly where we can.

Hardrock Groundworks Ltd, registered in England and Wales, company number 14272526. ICO registration ZC278098.

Cookie list

Last updated: 29 October 2026.

Our cookie banner has two buttons. Accept turns on analytics and advertising together, and shows the Google Map on our contact page. Reject leaves them off. Until you choose, and if you choose Reject, we use only what is strictly necessary: the cookie that remembers your choice. You can change your choice at any time with the Cookie settings button at the bottom of any page.

The Google Map on our contact page only loads after you click Accept. Before you choose, or if you click Reject, the map is not shown and Google sets no map cookies.

Durations are the provider’s stated default unless marked “observed” or “about”. “Observed” means measured on our site in Chrome in October 2026 because the provider does not publish a duration. Chrome caps cookie lifetimes at 400 days and Safari may shorten them. Third-party cookies (set on the provider’s own domain) are marked (3P). Some tools also use your browser’s local storage or session storage, which works like a cookie; these are listed too.