Skip to main content
Your Data, Protected

Privacy Policy

Last updated: October 2026. This policy explains how Leeway Brothers collects, uses, and protects your personal information.

1. Who We Are

Leeway Brothers is a construction company based in Hemel Hempstead, Hertfordshire, providing building services across Hertfordshire and London. For the purposes of data protection legislation, we are the data controller.

Contact: info@leewaybrothers.co.uk | 07482 453438

2. What Data We Collect

We may collect the following personal information:

  • Identity data: First name, last name
  • Contact data: Email address, phone number, postal address, postcode
  • Project data: Details about your construction project, property type, and service requirements
  • Technical data: IP address, browser type, device information (collected automatically via cookies)
  • Advertising measurement data (only with your consent): OpenAI's ad click and browser references, and hashed versions of your contact details — see section 8, Advertising Measurement (OpenAI)

3. How We Collect Your Data

We collect data when you:

  • Fill in our contact or quote request form
  • Call or email us directly
  • Browse our website (via cookies and analytics)
  • Leave a review or testimonial

4. How We Use Your Data

We use your personal information for the following purposes:

  • To respond to your enquiry or quote request
  • To arrange and carry out site visits
  • To prepare and send quotes
  • To manage and deliver your construction project
  • To communicate about project progress
  • To improve our website and services (via Google Analytics, only if you accept analytics cookies)
  • If you accept analytics cookies, to see which of our marketing campaigns led to your enquiry (the campaign tags of the link you arrived from are attached to your enquiry)
  • If you accept advertising measurement, to see whether our adverts on ChatGPT lead to enquiries (see section 8)
  • To limit how many enquiries can be sent from the same IP address, so our forms cannot be flooded

5. Legal Basis for Processing

We process your personal data under the following bases:

  • Consent: When you submit a contact form or accept cookies
  • Consent for analytics and advertising measurement: We only use Google Analytics, and only use OpenAI's advertising measurement, if you agree to them in our cookie banner. For the cookies and the OpenAI pixel, this consent is required by the Privacy and Electronic Communications Regulations (PECR); for sharing your data with OpenAI, your consent is our lawful basis under Article 6(1)(a) of the UK GDPR. You can withdraw it at any time (see section 8).
  • Contract: When we need to process your data to fulfil a contract or quote
  • Legitimate interest: To improve our services, respond to enquiries (including keeping a temporary copy of your enquiry until it reaches our team), and keep our enquiry forms secure (for example, limiting repeated submissions from the same IP address)

6. Data Sharing

We do not sell, trade, or rent your personal data to third parties. We may share data with:

  • Trusted subcontractors who work on your project (only the data necessary to complete the work)
  • Google Analytics, only if you accept analytics cookies (pseudonymous identifiers and page addresses, never your name or contact details)
  • The service providers listed in section 7, which host our website and handle your enquiry
  • OpenAI, only if you accept advertising measurement (see section 8)
  • Legal authorities if required by law

7. Service Providers We Use

We use the following providers to run our website and deal with your enquiry:

  • Vercel — hosts our website. The server functions that receive your enquiry run in Vercel's London region.
  • Resend — sends the notification email containing your enquiry to our team.
  • Upstash — a database in London. It stores each enquiry temporarily until it has been delivered to our team (see section 9), and it limits how many enquiries can be sent from the same IP address (3 per hour for each form).
  • Google Analytics — only if you accept analytics cookies.
  • OpenAI — only if you accept advertising measurement (see section 8).

8. Advertising Measurement (OpenAI)

We use OpenAI's measurement tools to see whether our adverts on ChatGPT lead to enquiries. We only do this if you accept advertising measurement in our cookie banner. If you do not, the OpenAI pixel is not loaded and nothing about you or your enquiry is sent to OpenAI.

Sent from your browser (OpenAI Measurement Pixel)

With your consent, our website loads OpenAI's Measurement Pixel, a script from bzrcdn.openai.com that sends information to bzr.openai.com:

  • when we accept an enquiry from you, a “lead_created” event with the enquiry's reference number — it contains no monetary value and none of your message;
  • the address of the page you are on;
  • OpenAI's click reference (“oppref”), if you arrived on our website from one of our adverts on ChatGPT;
  • a random reference for your browser (“obref”).

OpenAI's automatic advanced matching is switched on for our pixel. This means the pixel may also detect contact details you type into forms on our website (such as your email address, phone number or name), convert them into SHA-256 hashes in your browser, and send only the hashes to OpenAI.

Sent from our server (OpenAI Conversions API)

With your consent, when we accept an enquiry from you, our server also sends OpenAI a record of it. It uses the same reference number as the pixel, so OpenAI counts each enquiry only once. It contains:

  • the enquiry reference number and the time you sent it;
  • the address of the form page you used;
  • the click reference and browser reference described above, if available;
  • your IP address and your browser's user agent (a short description of your browser and device);
  • SHA-256 hashes of your email address, phone number, first name and last name;
  • your postcode and your country (GB), as plain text.

We never send OpenAI your message or project details, the service you selected, or your contact details in plain text.

A hash turns a value such as your email address into a fixed string of characters that cannot simply be read back. This is pseudonymisation, not anonymisation: anyone who already knows your email address can hash it and match the result. That is why we only send hashes with your consent.

OpenAI's role

OpenAI receives this data as an independent controller, under OpenAI's Ad Tools Data Processing Addendum. OpenAI's conversion terms allow it to use conversion data to provide reporting and to improve, measure and deliver its advertising services. OpenAI states that it does not currently use pixel or Conversions API data for user-level personalisation. For more information, see OpenAI's Privacy Policy.

Data about UK users is processed by OpenAI OpCo, LLC in the United States, under the UK international data transfer safeguards described in the Ad Tools Data Processing Addendum.

Lawful basis

We rely on your consent: under PECR to place the pixel and its cookies on your device, and under Article 6(1)(a) of the UK GDPR to share your data with OpenAI.

Withdrawing your consent

You can withdraw your consent at any time using the “Cookie settings” link in our website footer. When you do:

  • the pixel stops and its cookies on our website are deleted;
  • for enquiries you sent from the same browser in the previous 7 days, any conversion not yet sent to OpenAI is cancelled and the advertising identifiers we stored for it are deleted.

Data already sent to OpenAI before you withdrew is then handled under OpenAI's own policies (see the links above).

9. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected. Typically:

  • Enquiry data: 12 months if no project proceeds
  • Project data: 6 years after project completion (in line with UK limitation periods)
  • Analytics data: kept by Google for the retention period set in our Google Analytics account (at most 14 months for user- and event-level data); aggregated reports may be kept longer
  • Temporary copy of your enquiry in our database (Upstash): kept until your enquiry has been delivered to our team, then for 30 days, after which it is deleted automatically. If delivery keeps failing, we keep it until we have resolved the problem.
  • Advertising identifiers stored with your enquiry (your IP address, browser user agent, and the click and browser references): deleted as soon as the conversion has been sent to OpenAI, cancelled or expired. Conversions are only ever sent within 7 days of your enquiry.

10. Your Rights

Under UK GDPR, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Object to or restrict processing
  • Data portability
  • Withdraw consent at any time (for analytics and advertising measurement, use the “Cookie settings” link in our website footer)

To exercise any of these rights, contact us at info@leewaybrothers.co.uk.

11. Cookies

Our website uses cookies and similar technologies, such as your browser's local storage. We only use analytics and advertising measurement cookies if you agree to them. See our Cookies Policy for full details, including each item we store and for how long.

12. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated “last updated” date.

13. Contact & Complaints

If you have questions about this privacy policy or wish to make a complaint, contact us at info@leewaybrothers.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.