Privacy Policy

1. Who we are

EMA Locks 24/7 Ltd (“we”, “us”, “our”) is a company registered in England and Wales, company number XXXXXXXX, with registered office at [TO_BE_CONFIRMED]. We are the data controller of personal information you provide to us through this website and during our services.

2. What personal data we collect

• When you call us: your phone number (via standard call display), your spoken name, address, and details of the locksmith service required.
• When you submit our contact form: your name, phone number, email address, postcode, and any message content you provide.
• When we attend a job: your name and address (for receipt/invoicing), your signature on receipts where applicable, and photographs of work performed if needed for insurance documentation (only with your consent).
• Automatically when you visit our website: IP address, browser type, pages visited, referring URL, time of visit. This is technical data used only to ensure the website works properly and is not linked to your identity.

3. How we use your data

• To respond to your service request (call back, attend job, provide quote).
• To complete the locksmith service you've requested.
• To send you a receipt or invoice.
• To respond to follow-up questions or complaints.
• To comply with our legal obligations (tax records, accounting, insurance).
• To improve our services (aggregated, anonymised data only).

We do not use your data for marketing without your explicit consent.

4. Legal basis for processing

Under UK GDPR, we process your data on the following legal bases:

• Contract: processing is necessary to provide the service you've requested.
• Legitimate interests: processing is necessary for our legitimate interest in running our business (e.g. keeping records of work performed).
• Legal obligation: processing is necessary to comply with UK law (e.g. tax records).
• Consent: where we ask for explicit consent (e.g. before sending marketing emails or taking photos for promotional use).

5. How long we keep your data

• Call logs: up to 6 months.
• Job records and invoices: 7 years (UK tax law requirement).
• Photographs taken for insurance documentation: 12 months unless ongoing claim.
• Marketing consents: until you withdraw consent.

6. Who we share your data with

We share your data only with:

• Our payment processors (card payments) — Stripe Ireland Ltd, processing data under their own privacy policy.
• Our email service provider — Brevo (formerly Sendinblue), used to send transactional emails (receipts, callback confirmations). Brevo is a French company, GDPR-compliant.
• Our hosting provider — Vercel Inc. (US-based with EU data centres) and Cloudflare Ltd (UK). Data is hosted within the EU/UK where possible.
• HMRC and other regulatory bodies when legally required.
• Insurance providers when handling claims related to work we've performed (with your knowledge).

We do not sell your data to third parties under any circumstances.

7. International data transfers

Some of our service providers may process data outside the UK. Where this happens, we ensure appropriate safeguards (UK/EU adequacy decisions, Standard Contractual Clauses) are in place.

8. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (subject to legal record-keeping requirements).
• Restrict processing of your data.
• Object to processing based on our legitimate interests.
• Receive your data in portable form (where applicable).
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email [email protected]. We aim to respond within 30 days.

9. Complaints

If you're unhappy with how we've handled your data, you have the right to complain to the UK Information Commissioner's Office:

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Significant changes will be communicated to active customers by email where possible.