PRIVACY POLICY
Last updated: June 29, 2026
This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Website and tells You about Your privacy rights and how the law protects You.
This Privacy Policy has been created with the help of the TermsFeed Privacy Policy Generator and has been amended to reflect the Website's use of Squarespace, Google Analytics and Google reCAPTCHA.
We use Your Personal Data to provide and improve the Website, respond to enquiries, protect the Website from spam and abuse, and understand how visitors use the Website. Where We rely on consent, You can withdraw that consent at any time.
Interpretation and Definitions
Interpretation
The words whose initial letters are capitalised have meanings defined under the following conditions. The following definitions have the same meaning regardless of whether they appear in singular or plural.
Definitions
For the purposes of this Privacy Policy:
· Company (referred to as either "the Company", "We", "Us" or "Our" in this Privacy Policy) refers to O&M Ltd, Suite 5, Sudbury Business Centre, Sudbury, Suffolk, CO10 2XG, United Kingdom.
· Controller means the organisation that decides how and why Personal Data is processed. For the Website, the Company is the Controller unless stated otherwise.
· Cookies means small files placed on Your computer, mobile device or any other device by a website, containing details of browsing activity and preferences among their many uses.
· Country refers to the United Kingdom.
· Device means any device that can access the Website, such as a computer, mobile phone or tablet.
· Personal Data means any information that relates to an identified or identifiable individual.
· Service Provider means any natural or legal person who processes data on behalf of the Company, including website, analytics, security, hosting and communications providers.
· Usage Data means data collected automatically, either generated by use of the Website or from the Website infrastructure itself, such as the duration of a page visit.
· Website refers to O&M Ltd, accessible from https://www.oandm.ltd/.
· You means the individual accessing or using the Website, or the company or legal entity on behalf of which such individual is accessing or using the Website, as applicable.
Who We Are and Our Role
O&M Ltd is the Controller for Personal Data collected through the Website, including information submitted through contact forms, enquiry forms and ordinary business communications.
The Website is hosted and managed using Squarespace. Squarespace may process Website-related data as a Service Provider and may also process some information as an independent controller for its own purposes, such as security, fraud prevention and service improvement.
Collecting and Using Your Personal Data
Types of Data Collected
Personal Data You Provide to Us
When You contact Us through the Website, by phone, by email or through an enquiry form, We may collect the following information:
· First name and last name
· Email address
· Phone number
· Company name, if provided
· Postal address, site address or job location, if You provide it as part of an enquiry
· Details of Your enquiry, project, property, development or service request
· Any other information You choose to provide to Us
We do not intentionally collect sensitive personal data through the Website. Please do not submit sensitive personal data through Website forms unless it is genuinely necessary for Your enquiry.
Usage Data
Usage Data is collected automatically when using the Website.
Usage Data may include information such as Your Device's Internet Protocol address, browser type, browser version, the pages of the Website that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
When You access the Website through a mobile device, We may collect certain information automatically, including the type of mobile device You use, Your mobile operating system, browser type, unique device identifiers and other diagnostic data.
Tracking Technologies and Cookies
We use Cookies and similar tracking technologies to provide, protect, improve and analyse the Website. Cookies can be Persistent Cookies or Session Cookies. Persistent Cookies remain on Your device when You go offline, while Session Cookies are deleted when You close Your web browser.
Where required by law, We will request Your consent before using Cookies or tracking technologies that are not strictly necessary. Strictly necessary Cookies are used to provide and protect the Website and cannot be switched off in Our systems.
The Website may use the following types of cookies and similar technologies:
· Necessary / Essential Cookies: used to make the Website work, keep it secure, prevent spam or abuse, and enable core features.
· Cookie Notice / Preference Cookies: used to remember cookie banner choices or preferences.
· Functionality Cookies: used to remember choices You make when using the Website, where applicable.
· Analytics Cookies: used, where enabled and where consent is required, to understand how visitors use the Website so We can improve it.
For more information about cookies used on the Website, please see Our Cookies Policy.
Squarespace
The Website is built on Squarespace. Squarespace may use Cookies and similar technologies to provide, protect, improve and analyse its services and the Website. Squarespace may process information such as IP address, browser and device information, pages visited and Website interaction data.
You can read more about Squarespace's privacy and cookie practices here:
Google Analytics
Where enabled, We use Google Analytics to understand how visitors use the Website, such as which pages are visited, how long visitors spend on the Website and how visitors found the Website. Google Analytics may process Usage Data, Cookies, online identifiers, approximate location information and device/browser information.
We use this information to review Website performance, understand which content is useful and improve the Website. We do not use Google Analytics to identify individual visitors.
Where required by law, Google Analytics will only be used after You have given consent through the Website's cookie banner or consent settings. You can also control Cookies through Your browser settings.
You can read more about how Google uses information from sites and apps that use its services here:
· How Google uses information from sites or apps that use Google services
Google reCAPTCHA
The Website may use Google reCAPTCHA on forms to help protect the Website from spam, automated submissions and abuse. reCAPTCHA works by analysing interactions with the Website and may process information such as IP address, browser and device information, Cookies and other Usage Data needed for security risk analysis.
Google states that reCAPTCHA sets a necessary cookie named _GRECAPTCHA when executed for the purpose of providing its risk analysis. If reCAPTCHA is used, information collected by reCAPTCHA is processed by Google in accordance with Google's own policies.
Where the reCAPTCHA badge is not visible, the Website should display the following wording near the relevant form: "This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply."
You can read more here:
How and Why We Use Your Personal Data
We only use Personal Data where We have a lawful basis under applicable data protection law, including the UK GDPR and Data Protection Act 2018. The table below explains the main ways We use Personal Data collected through the Website.
Purpose
Personal Data
Lawful Basis
Responding to enquiries and service requests
Name, email address, phone number, company name, message content, project, property or service details
Legitimate interests and/or steps before entering into a contract
Providing services, quotes, support and ordinary business administration
Contact details, enquiry details, job details, correspondence
Performance of a contract and/or legitimate interests
Website security, spam prevention and abuse detection, including reCAPTCHA where used
IP address, device/browser data, interaction data, cookies and usage data
Legitimate interests in keeping the Website secure and preventing spam or abuse
Website analytics and improvement, including Google Analytics where enabled
Usage Data, cookie identifiers, device/browser data, approximate location data
Consent where required by law; otherwise legitimate interests where permitted
Complying with legal, tax, accounting and regulatory obligations
Relevant contact, transaction, correspondence and business records
Legal obligation and/or legitimate interests
Sending service-related communications
Name, email address, phone number and relevant correspondence
Performance of a contract and/or legitimate interests
Sending marketing communications, where applicable
Name, email address and marketing preferences
Consent or soft opt-in where permitted by law, with an opt-out available
Use of Your Personal Data
The Company may use Personal Data for the following purposes:
· To provide and maintain the Website, including to monitor usage and security.
· To respond to Your enquiries, manage requests and communicate with You.
· To provide quotes, services, support and related business administration.
· To protect the Website from spam, automated submissions, fraud and abuse.
· To analyse Website usage and improve the Website, services and user experience.
· To comply with legal obligations, resolve disputes and enforce legal agreements and policies.
· To send marketing communications where We have a lawful basis to do so and where You have not opted out.
Sharing Your Personal Data
We do not sell Your Personal Data. We may share Personal Data only where necessary for the purposes described in this Privacy Policy, including with:
· Website and hosting providers, including Squarespace.
· Analytics providers, including Google Analytics where enabled.
· Security and spam-prevention providers, including Google reCAPTCHA where enabled.
· IT, email, professional, legal, insurance and accountancy providers where required for business administration.
· Public authorities, regulators, courts, law enforcement or other third parties where required by law or where necessary to protect Our legal rights.
· A buyer, successor or professional adviser in connection with any merger, sale, restructuring or transfer of some or all of Our business or assets.
Where We use Service Providers, We expect them to process Personal Data only as necessary to provide their services to Us and to protect that Personal Data appropriately.
International Transfers
Some of Our Service Providers, including Squarespace and Google, may process Personal Data outside the United Kingdom. Where required by applicable law, We will ensure that international transfers are protected by appropriate safeguards, such as adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement or other lawful transfer mechanisms.
Retention of Your Personal Data
The Company will retain Personal Data only for as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law.
We apply different retention periods depending on the category of data and the reason for processing:
· General Website enquiries and correspondence: usually up to 24 months from the last meaningful contact, unless the enquiry becomes part of a customer, job, contract, legal or accounting record.
· Customer, supplier, quote, job and contract records: up to 6 years after the end of the relevant business relationship or transaction, where needed for legal, tax, accounting or dispute purposes.
· Website analytics data: usually up to 24 months, or a shorter period configured within the relevant analytics platform.
· Server, security and spam-prevention logs: usually up to 24 months unless needed longer for security, fraud prevention, legal claims or legal compliance.
· Marketing preferences and suppression records: retained for as long as necessary to respect Your opt-out or unsubscribe request.
When retention periods expire, We securely delete or anonymise Personal Data where reasonably possible. Residual copies may remain in backups for a limited period and are not restored except where necessary for security, disaster recovery or legal compliance.
Your Data Protection Rights
Depending on Your location and the circumstances, You may have the following rights under data protection law:
· The right to be informed about how Your Personal Data is collected and used.
· The right of access to the Personal Data We hold about You.
· The right to rectification if Your Personal Data is inaccurate or incomplete.
· The right to erasure, also known as the right to be forgotten, in certain circumstances.
· The right to restrict processing in certain circumstances.
· The right to data portability in certain circumstances.
· The right to object to processing based on legitimate interests or direct marketing.
· The right to withdraw consent at any time where We rely on consent.
· Rights relating to automated decision-making and profiling, where applicable.
To exercise Your rights, please contact Us using the details at the end of this Privacy Policy. We may need to verify Your identity before responding. We aim to respond within one month, although this may be extended where permitted by law for complex or multiple requests.
You also have the right to complain to the UK Information Commissioner's Office (ICO) if You are unhappy with how We handle Your Personal Data. We would appreciate the chance to deal with Your concern first, but You can contact the ICO here:
Marketing Communications
We may contact You with information about Our services where We have a lawful basis to do so. You can opt out of marketing communications at any time by following any unsubscribe instructions in the message or by contacting Us directly.
We will still be able to send You non-marketing communications, such as responses to enquiries, service updates, quotes, invoices or other necessary business communications.
Automated Decision-Making and Profiling
We do not use Personal Data collected through the Website to make decisions that have legal or similarly significant effects on You. Where Google reCAPTCHA is used, it may carry out automated risk analysis to help decide whether a form submission is likely to be genuine or automated. This is used for Website security and spam prevention.
Delete Your Personal Data
You have the right to delete or request that We assist in deleting Personal Data that We have collected about You, subject to legal, accounting, contractual or legitimate business reasons that may require Us to retain certain information.
You may contact Us to request access to, correction of or deletion of Personal Data that You have provided to Us. Please note that We may need to retain certain information where We have a legal obligation or lawful basis to do so.
Disclosure of Your Personal Data
Business Transactions
If the Company is involved in a merger, acquisition, restructuring or asset sale, Your Personal Data may be transferred as part of that transaction. We will provide notice where required by law before Your Personal Data becomes subject to a different Privacy Policy.
Law Enforcement
Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities, such as a court, regulator or government agency.
Other Legal Requirements
The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:
· Comply with a legal obligation.
· Protect and defend the rights or property of the Company.
· Prevent or investigate possible wrongdoing in connection with the Website.
· Protect the personal safety of Website users or the public.
· Protect against legal liability.
Security of Your Personal Data
The security of Your Personal Data is important to Us. We use reasonable technical and organisational measures to protect Personal Data. However, no method of transmission over the Internet or method of electronic storage is 100% secure, so We cannot guarantee absolute security.
Children's Privacy
The Website is not intended for anyone under the age of 16. We do not knowingly collect personally identifiable information from anyone under 16. If You are a parent or guardian and You believe that a child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under 16 without appropriate consent, We will take steps to delete that information.
Links to Other Websites
The Website may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.
We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top indicates when it was last revised. Changes to this Privacy Policy are effective when they are posted on this page.
Contact Us
If You have any questions about this Privacy Policy or would like to exercise Your data protection rights, You can contact Us:
· By visiting this page on Our Website: https://www.oandm.ltd/get-in-touch
· By phone: +44 (0)7304 078135
· By mail: Suite 5, Sudbury Business Centre, Sudbury, Suffolk, CO10 2XG, United Kingdom