Last updated: 18 October 2026
Who we are
CrossGrid Limited is responsible for the personal information described in this policy. Our website is crossgrid.co.uk. For privacy questions or to exercise your rights, email info@crossgrid.co.uk or telephone 01293 270664.
This policy covers website visitors, people enquiring about our services, customers and people acting for business customers. It explains the information we use, why we need it and your choices.
Information we collect
Our website enquiry form asks for your name, company name, phone number, email address, project location and message. Name, phone number, email address and message are required. Company name and project location are optional. Without the required details, the form cannot be submitted; you can also contact us by email or telephone.
The enquiry email includes the date, time and a page-address field. The form is not configured to add your IP address or browser details to that email. Please provide only information relevant to your enquiry and avoid unnecessary sensitive information.
If you request a quotation or become a customer, we may also hold correspondence, contact and site details, quotations, contracts, invoices and relevant project records. If you act for an organisation, these records may identify you as its contact.
Our hosting and website services receive technical information needed to deliver web pages, such as your IP address, requested resources and browser request headers. Hosting and security logs may record request details, times, errors and suspicious activity.
How and why we use information
Data-protection law requires a lawful reason for using personal information. The reason depends on the activity and your relationship with us.
- General enquiries: we use contact details and messages to answer questions and discuss requirements. Our legitimate interest is handling relevant business enquiries.
- Quotations requested by you personally: where you would be the contracting customer, we use the information necessary to take the steps you request before entering into a contract. When you act for a company or another organisation, we rely on our legitimate interest in preparing quotations and dealing with its representatives.
- Customer contracts: where our contract is with you personally, we use the information necessary to arrange and deliver that contract. For contacts acting for an organisational customer, our legitimate interest is coordinating and delivering the services and managing the business relationship.
- Business contacts: our legitimate interest is maintaining relevant working relationships with customer and supplier representatives and communicating about current or prospective work.
- Website operation and security: our legitimate interest is providing a working website, preventing spam and misuse, and investigating technical problems and security incidents.
- Accounting and tax records: we use information necessary to meet our legal record-keeping obligations. Where records are needed to establish, exercise or defend legal claims, our legitimate interest is protecting our legal position.
Where we rely on legitimate interests, we consider whether the use is necessary and proportionate and how it affects the people concerned. Sending an enquiry does not subscribe you to a marketing list.
How enquiries are delivered
Our form uses Elementor Pro on our WordPress website. It sends an email through the website’s mail system to info@crossgrid.co.uk, using your email address as Reply-To. The current form is not configured to save submissions in the WordPress submissions database or send them to a CRM, marketing list or webhook. It has no automatic-reply or third-party CAPTCHA action.
This does not mean that the information disappears after submission. Email copies and any delivery, hosting or security logs are separate from the form database.
Who handles information
CrossGrid team members who deal with an enquiry or project may use the relevant information. Our website is hosted with 20i and managed by QR WebTech. We use Google Workspace for email. These service providers handle information needed to host, support or deliver the services.
Where necessary for a quotation or project, relevant information may also be shared with contractors or other delivery partners involved in that work. Professional advisers, insurers or public authorities may receive information where needed for advice, claims or legal obligations.
International processing
Our providers operate international services, so information may be processed outside the UK. A UK business address or a selected storage region does not by itself mean all processing takes place in the UK.
20i’s published data-processing agreement describes UK and EEA processing and other locations where services require it, with applicable transfer safeguards. Google’s published data-processing terms allow international processing, subject to applicable location commitments and transfer provisions. Google’s transfer information describes its UK-US Data Privacy Framework arrangements; its contractual clauses also address other applicable restricted transfers.
You can contact us for further information about the arrangements relevant to your information and how to obtain information about applicable safeguards.
How long information is kept
- Enquiries and quotations that do not become work: up to 12 months after the last substantive contact or the quotation is closed, whichever is later.
- Ordinary customer and project records: the duration of the work and normally six years after project closure. This applies to records needed to evidence the work and manage claims, rather than every duplicate or routine message.
- Accounting and tax records: normally six years from the end of the relevant company financial year, with longer retention where tax rules require it.
- Business-contact details: while the working relationship remains relevant, with a review after two years without meaningful contact and removal where no continuing reason exists.
- Website and security records: routine provider logs follow the provider’s applicable rotation settings. Information retained for a specific fault or incident is kept while needed to investigate and resolve it, with a review at least every 90 days.
Longer retention may be necessary for a particular legal obligation, dispute, insurer requirement or project-specific requirement. We retain the relevant records for that reason and review the need, rather than extending every record’s lifetime automatically.
Emails and attachments follow the purpose of the record they contain. Deleting an active copy does not necessarily remove copies immediately from recovery systems or records subject to a legal hold. Backup and provider recovery copies expire through the applicable service’s deletion and rotation process.
Cookies, browser storage and external resources
CookieYes provides a cookie banner with Accept All, Reject All and Customise options. You can reopen it using the Consent Preferences button. It uses the first-party cookieyes-consent cookie to remember your choices, with a configured lifetime of 365 days.
Our current checks did not identify active analytics or advertising scripts, embedded video players or maps on the pages checked. The banner records consent choices, but no analytics or advertising service was identified as being controlled by those choices. Its presence does not by itself demonstrate that tracking is blocked.
WordPress can store an emoji-display capability result and timestamp in your browser’s session storage under wpEmojiSettingsSupports. This helps display emoji correctly. It is tab/session storage, not a tracking cookie; the script treats a result as fresh for up to seven days, subject to the browser session’s lifetime.
WordPress can also request emoji image resources from s.w.org where needed. Some font stylesheets reference wdt1.co.uk. If your browser requests external resources, their host receives the technical request information needed to supply them, subject to your browser’s security controls.
You can manage cookies and site storage in your browser settings. Clearing storage may cause functional checks to run again.
Security
The website uses HTTPS to protect information in transit between your browser and the website. The enquiry form uses required-field checks, email validation and a built-in spam check. Please avoid sending information that is unnecessary for your enquiry.
Your rights
Depending on the circumstances, you can ask to access your personal information, correct it, erase it, restrict its use or receive certain information in a portable format. These rights have legal conditions and exceptions.
Your right to object: you may object to our use of your information based on legitimate interests. We will consider your circumstances and stop that use unless we have grounds that allow it to continue under data-protection law. You can object to direct marketing at any time.
Where we rely on consent for a particular activity, you can withdraw it without affecting the lawfulness of earlier use. Contact info@crossgrid.co.uk to make a request. We may need enough information to verify your identity before disclosing or changing personal records.
Complaints
Please contact us if you have a concern about your information. You can also complain to the Information Commissioner’s Office, the UK’s data-protection regulator, through its complaints page.
Changes to this policy
We may update this policy when our services or information-handling arrangements change. The date at the top shows when the wording was last updated.