Privacy policy

Updated 7 October 2026.

This notice covers information collected through our website and enquiries portal. Dundas Building Surveying Ltd, trading as Dundas Building Surveying, is responsible for this information. Our company number is 13185617.

For privacy questions or requests, email info@dundasbuildingsurveying.com or write to Studio 8, We Are Super, Sovereign Centre (Units 24–25), Weston-super-Mare, North Somerset, BS23 1HL.

When you contact us

Contact and quote forms collect the details you enter: your name, email address, telephone number, property address and message, depending on which form you use. We also record the source page, submission time and a reference that helps prevent duplicate enquiries. Please avoid including sensitive personal information or details about other people that we do not need.

We use these details to respond, prepare a quote, discuss a survey and keep track of follow-up conversations. A contact message requires a name, email address and message. A quote request requires an email address; other details help us understand the property. Without a way to contact you, we cannot reply.

Submitting an enquiry does not subscribe you to a marketing list or give consent to optional cookies. The website does not include a marketing subscription form.

Where enquiries go

Forms save enquiries in our private portal, hosted using Cloudflare Workers and Cloudflare D1. An email notification containing the enquiry is sent through Resend to Dundas’s inbox. Saving an enquiry happens before notification delivery, so an email outage does not discard your request.

Authorised portal users can view contact information, move enquiries through a pipeline, add notes and touchpoints, set follow-up dates and export records. Originate provides website hosting and technical support and has administrative access to operate this service. Company email is handled through our email provider, IONOS.

These services receive information needed to deliver hosting, storage, security, email and technical support. This website does not publish your enquiries or send their contents to Google Analytics.

Security and portal access

Cloudflare processes connection and device information, including IP addresses and browser signals, to deliver the site and protect it from abuse. Our forms use Cloudflare Turnstile to check submissions. Read Cloudflare’s Turnstile Privacy Addendum for its processing of these signals.

The website uses hashed, short-lived rate-limit records to limit repeated submissions and sign-in attempts. Portal sign-in uses an approved email address and a one-time link sent through Resend. A successful sign-in creates a secure session cookie. Public users cannot access enquiry records without authorisation.

We use HTTPS and restrict portal access to approved administrators. The portal is excluded from analytics and search indexing. These measures reduce risk; no online service can guarantee absolute security.

Cookies, measurement and videos

Necessary functions support security, your saved cookie choice and staff sign-in. No optional cookie is set until you choose to allow it. You can withdraw or change your choice through Cookie settings in the footer. Read our cookie policy for storage details and durations.

Before you choose, and if you decline, Google Analytics receives cookie-free measurements: which pages are viewed and actions such as sending a form or tapping a phone number, each tagged with a random number that is not stored, so visits cannot be linked together. Google uses the IP address to work out a rough location and then discards it. We rely on our legitimate interest in knowing how the site is used. If you accept analytics cookies, a cookie is set so repeat visits are recognised, and that rests on your consent. If you accept advertising cookies, Google Ads can measure which adverts led to an enquiry, and that also rests on your consent; we do not let Google personalise adverts with that information. Without the Advertising choice, Google Ads receives only the same cookie-free pings with ad-click identifiers removed, so no advert can be attributed to your visit. Your choice is kept in your browser for 180 days. You can change it at any time from Cookie settings in the footer. Data is processed by Google in the EU and the United States under the UK International Data Transfer Addendum.

Google Analytics receives browser, device and session information about page visits, successful enquiry submissions and clicks on our phone and email links. Our events exclude form contents, names, email addresses and telephone numbers, and the page address we send is the page path alone, without any query string or fragment.

With the Advertising choice, our Google tag configures our linked Google Ads account to measure enquiries from adverts, using Google’s ad-click identifiers from the page address together with visit and successful-enquiry information. Advertising personalisation stays switched off: the signal that would allow Google to personalise adverts is never granted, Google Signals remains disabled and we do not send customer details for enhanced conversions. Google’s data processing terms describe its processing arrangements.

Allowing External media (YouTube videos) loads Google’s embedded player on our About page. Google then receives device and connection information and information about use of the player. Its privacy policy describes this processing. Videos stay blocked if you reject them. Following an external YouTube link opens a separate website.

Website fonts and images are served from our own website. We do not use Webflow, WordPress, WPForms or AdSense to run this version of the site.

Why we can use your information

UK data protection law requires a lawful basis for each purpose. Ours are:

• Preparing a quote and arranging or carrying out a survey: taking steps at your request before a contract, and then performing that contract.
• Correspondence and complaints: our legitimate interest in responding to requests and resolving concerns.
• Website security, spam prevention and portal access: our legitimate interest in protecting customers, staff and systems.
• Cookie-free website measurement: our legitimate interest in knowing how the site is used, with no cookie set and no identifier stored.
• Analytics cookies, Google Ads measurement and External media (YouTube videos): your consent, which you can withdraw at any time through Cookie settings.

Where we rely on a legitimate interest, you can object; see Your rights below.

Processing outside the UK

Our providers operate internationally, so information may be processed outside the UK. Resend stores message content and delivery data in the United States; choosing a European sending region does not change that storage location.

Resend’s Data Processing Addendum describes contractual safeguards, including standard contractual clauses and the UK Addendum. Cloudflare’s Data Processing Addendum describes its international processing safeguards. Contact us if you need further information about the arrangements relevant to your data.

How long information is kept

We retain enquiry information only as long as necessary to deal with your request and any resulting service, or as required by law. You can contact us to ask about retention of a particular enquiry or request its deletion. A deletion request may need to be considered alongside any continuing service or legal requirements.

Website security records have specific limits: portal sign-in links expire after 15 minutes; portal sessions expire after 7 days or end when you sign out; rate-limit records expire within a 15-minute window. Expired authentication and rate-limit records are removed by the scheduled cleanup. Cookie choices are stored in your browser for 180 days. Providers may retain delivery logs and backups under their own documented retention arrangements.

Our Google Analytics property is configured to retain event-level data for two months and user data for fourteen months, with user retention restarting after new activity. These settings do not set the lifetime of aggregated reports. Cookie durations are listed in our cookie policy.

Your rights

Depending on the circumstances and the legal basis for processing, you can ask to access or correct your personal information, request deletion or restriction, object to processing, or request a portable copy. Where processing relies on consent, you can withdraw it without affecting processing that was lawful before withdrawal. Cookie settings provides a direct way to withdraw permission for optional website services.

Send requests to info@dundasbuildingsurveying.com. We may need enough information to identify the relevant record and verify that a request comes from the right person. You can also complain to the Information Commissioner’s Office (ICO).

The enquiries portal supports human follow-up. It does not make automated decisions that have legal or similarly significant effects on you.

Changes to this notice

We update this page when website processing changes and show the revision date above. If optional services change, we ask for a fresh cookie choice before enabling them.