Privacy notice.

Last updated: 9 September 2026

1. Who is responsible for your information?

Nicholas James Gregory, a sole trader trading as Decorating by Nicholas James and Decor by Nick, is the data controller for the personal information described in this notice.

The full correspondence address for formal notices is provided on quotations and invoices and can be requested using the contact details above.

2. Information we collect

• Website enquiries: service required, project town or postcode, project description, preferred timing, name, telephone number, email address and preferred contact method, together with any project photographs uploaded and technical metadata contained in those files.
• Direct communications: information you provide by telephone, email or WhatsApp and records of our correspondence.
• Quotes and jobs: property and access information, agreed scope, appointments, quotations, invoices, payment records and notes needed to deliver the work.
• Technical and security information: internet protocol address, requested page, date and time, browser or device information contained in short-lived server logs. The enquiry endpoint also uses an IP address temporarily to prevent automated abuse.

Please do not send special-category or highly sensitive personal information unless it is genuinely necessary and we have agreed how it should be handled.

3. Why we use information and our lawful bases

We do not use website enquiry details for unrelated marketing, sell personal information, or make decisions with legal or similarly significant effects using automated profiling.

4. Who receives information?

Information is shared only where reasonably necessary with:

• providers that host, maintain or secure the website and email service, including delivery of uploaded photographs as email attachments;
• Google email services where messages sent to nick@decorbynick.com are forwarded to the business Gmail inbox;
• accountants, insurers, professional advisers or payment providers where relevant;
• subcontractors or suppliers where this is needed for an agreed project and appropriate information has been given; and
• courts, regulators, law-enforcement bodies or public authorities where disclosure is required or permitted by law.

Service providers are expected to protect information and use it only for the service they provide.

5. International processing

The website itself loads no analytics, advertising tags or third-party fonts. Some email and technology providers, including Google, may process information outside the United Kingdom. Where this happens, the provider is expected to use a lawful transfer mechanism and appropriate safeguards under UK data-protection law.

6. How long information is kept

• Website security and access logs are normally retained for about 14 days.
• The website server copy of an enquiry, including attachment names, types and sizes, is retained for no longer than 24 months from submission, unless it is required for an active dispute or legal obligation.
• Uploaded image files are checked and sent as email attachments but are not stored as separate files in the website enquiry record. Copies remain in the business email account only while the related correspondence is retained. Photos can contain location or device metadata, so remove this before uploading if you do not want to share it.
• Enquiry correspondence is kept only while reasonably needed to respond, quote and follow up, normally no longer than 24 months after the last meaningful contact if no work is agreed.
• Customer, quotation, invoice and payment records may be retained for the statutory accounting, tax, insurance and legal-claims periods that apply.

When information is no longer required, it is deleted or securely disposed of.

7. Your rights

Depending on the circumstances, you may have rights to ask for access to your information, correction, deletion, restriction, data portability or to object to processing based on legitimate interests. Where processing relies on consent, consent can be withdrawn at any time without affecting earlier lawful processing.

We may need to confirm your identity before acting on a request. Some rights have legal exceptions, for example where records must be retained for tax or legal reasons.

8. Security

The site uses HTTPS, access-controlled server storage, input and image-file validation, enquiry rate limiting and restricted file permissions. No internet service can be guaranteed completely secure, but proportionate technical and organisational measures are used.

9. Questions and complaints

Please contact Nicholas first so there is an opportunity to resolve the issue. You also have the right to complain to the UK Information Commissioner’s Office:

• Make a complaint to the ICO
• Telephone: 0303 123 1113

10. Changes to this notice

This notice will be reviewed when the website, business practices or legal requirements change. The latest version and update date will remain on this page.