Privacy Notice
How FLR Group collects and uses personal data about customers, suppliers, contacts and website visitors
Last updated: 29 October 2026 | Version 2.0 | Replaces the Privacy Policy and Cookie Consent Policy dated August 2022
1. Who we are
FLR Group is a commercial flooring contractor. Our legal name is Floor Restorations Limited, trading as FLR Group, registered in England and Wales under company number 1687815, registered office Unit 25 Monkspath Business Park, Highlands Road, Solihull, West Midlands B90 4NZ. We are the data controller for the personal data described in this notice, and we are registered with the Information Commissioner's Office (ICO).
Our Data Protection Lead is Rose Williams, Finance Director. You can contact her about anything in this notice at accounts@flr.co.uk, by phone on 0121 443 5503, or by post at the address above.
This notice explains what personal data we collect about you when you visit our website, contact us, work with us as a customer or supplier, or are a contact at an organisation we work with; why we collect it; who we share it with; how long we keep it; and your rights. If you apply for a job with us or work for us, our Employee and Applicant Privacy Notice applies instead; it is available from the Careers page and on request.
2. The personal data we collect
We collect and use the following, depending on how you deal with us:
- Enquiry and contact data – your name, organisation, job title, email address, phone number and the content of your enquiry, whether it comes through our website form, email, telephone, WhatsApp or in person.
- Customer and project data – the details we need to survey, quote for, deliver and support a flooring project: site addresses, site contacts, drawings and specifications, correspondence, purchase orders, sign-off records and photographs of completed work, feedback, complaints and warranty requests.
- Supplier and subcontractor data – contact details, company information, bank details, insurance, competence and compliance information for the businesses and self-employed people who supply us.
- Transaction data – quotes, invoices, payments and account history.
- Call recordings – calls to and from our main office numbers are recorded.
- Website data – your IP address, browser type, the pages you visit and how you reached us, collected through cookies and similar technologies where you have agreed to them (section 8).
- Marketing preferences – whether you have opted in to, or out of, our marketing emails.
We do not collect special category data (such as health information) about customers or suppliers, and we do not knowingly collect data from children. Site photographs are of the floor, not of people; if a person is incidentally in shot we do not use that image.
3. How we use your data and our lawful basis
Data protection law requires us to have a lawful basis for each use. These are ours:
| Purpose | Data | Lawful basis |
| Responding to your enquiry and providing a quotation | Enquiry and contact data | Legitimate interests (responding to people who contact us); taking steps at your request before entering a contract |
| Surveying, delivering and supporting a project, including warranty | Customer and project data; transaction data | Performance of a contract with you or your organisation |
| Managing our relationship with customers, main contractors, specifiers and suppliers | Contact, project and transaction data | Legitimate interests (running our business and maintaining business relationships) |
| Accounting, tax, audit and insurance | Transaction data; supplier data | Legal obligation; legitimate interests |
| Training staff and resolving disputes about what was said | Call recordings | Legitimate interests (service quality and accurate records) |
| Sending you news about our services, products and case studies | Contact data; marketing preferences | Legitimate interests, for people acting in their business role, with an opt-out in every message; consent for anyone else |
| Improving our website, measuring our advertising and showing you our adverts on other sites after you visit (remarketing) | Website data | Consent (non-essential cookies) |
| Keeping our premises and sites safe and secure | Visitor sign-in records; CCTV at our premises | Legitimate interests; legal obligation |
| Establishing, exercising or defending legal claims | Any of the above | Legitimate interests; legal obligation |
Where we rely on legitimate interests we have balanced them against your interests and rights, and you can object at any time (section 7). Where we rely on consent you can withdraw it at any time without affecting what we did before. We do not make automated decisions about you, and we do not sell your personal data.
4. Who we share your data with
We share personal data only where necessary, and only with:
- Service providers who process data on our instructions under written contracts: our CRM and marketing platform (HubSpot), our work management platform (Monday.com), our job management and invoicing system (WorkflowMax), Microsoft 365, our website hosting provider, our telephone system provider, our IT support provider, and Google and Meta for advertising, remarketing and analytics where you have consented to cookies.
- Main contractors, clients and site owners where you are a site contact and we need to co-ordinate work, or where they require details of our people on their sites.
- Our bank, payment and finance providers, insurers, accountants, auditors and legal advisers.
- HMRC, the Health and Safety Executive, the police, courts and other authorities where the law requires or allows it.
- A buyer or successor if we sell or reorganise our business, under confidentiality.
Some of our service providers store data outside the UK, principally in the United States and the European Economic Area (including Google and Meta). Where they do, the transfer is protected by the UK's adequacy regulations, the UK Extension to the EU–US Data Privacy Framework (the UK Data Bridge), or the International Data Transfer Agreement or Addendum approved by the ICO. You can ask our Data Protection Lead for details.
5. How long we keep your data
| Data | Kept for | Why |
| Project, contract and sign-off records | 6 years after the project is completed | Warranty, defects and legal claims (Limitation Act 1980) |
| Quotes not accepted and enquiries that do not proceed | 2 years from our last contact | In case you come back to us |
| Accounting and transaction records | 6 years | Companies Act 2006 and HMRC requirements |
| Marketing contacts | Reviewed every 2 years; removed as soon as you object | To keep our lists current |
| Call recordings | 12 months | Training and resolving disputes |
| CCTV at our premises | 30 days | Security, unless needed for an incident |
| Website analytics | 26 months | Google Analytics default |
When data is no longer needed we delete or anonymise it. We may keep it longer where a complaint, claim or investigation is ongoing.
6. How we keep your data secure
We use access-controlled systems with multi-factor authentication, encrypted devices, secure data centres operated by our providers, and staff training. Access to your data is limited to the people who need it for the purposes above. Paper records are kept in locked storage at our office. No transmission over the internet is completely secure, but we take reasonable steps to protect your data, and we will tell you and the ICO where the law requires if a breach affects you.
7. Your rights
You have the right to:
- be told how we use your data – this notice;
- ask for a copy of the personal data we hold about you (a subject access request);
- have inaccurate data corrected and incomplete data completed;
- have your data erased where we no longer need it or you withdraw consent, unless we must keep it;
- restrict how we use your data in certain circumstances;
- object to processing based on legitimate interests – and object at any time to direct marketing, which we will stop immediately;
- receive the data you gave us in a portable format where we process it by automated means on the basis of consent or contract;
- withdraw consent at any time where consent is our lawful basis.
To exercise any of these rights, contact our Data Protection Lead using the details in section 1. We may need to confirm your identity. We will respond within one month; if your request is complex we may extend this by up to two months and will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
8. Cookies
Our website uses cookies and similar technologies. When you first visit, a banner asks whether you accept non-essential cookies; nothing other than strictly necessary cookies is set until you choose, and you can change your choice at any time using the cookie settings link in the website footer.
| Type | What they do | Set by / consent |
| Strictly necessary | Make the website work: page navigation, the enquiry form, CAPTCHA to prevent spam, remembering your cookie choice | FLR Group and our form/CAPTCHA provider – no consent needed |
| Analytics | Tell us how visitors use the site – pages viewed, time on site, how you found us – so we can improve it. Data is aggregated; IP addresses are anonymised | Google Analytics – only with your consent |
| Advertising and remarketing | Measure whether our adverts led to your visit or enquiry, show you our adverts on Google and Meta platforms (Facebook and Instagram) after you have visited our site, and limit how often you see them | Google Ads tag and Meta Pixel – only with your consent |
Where you consent to advertising cookies, Google and Meta may link your visit to your account with them and use it in accordance with their own privacy notices (policies.google.com/privacy and facebook.com/privacy). You can opt out of Google personalised advertising at adssettings.google.com and manage Meta advert preferences in your Facebook or Instagram settings. Links to our social media pages take you to those platforms, whose own privacy notices then apply. You can also block cookies in your browser settings, although parts of the site may then not work.
9. Links to other websites and WhatsApp
Our website contains links to other sites, including the manufacturers whose products we install and our social media pages. We are not responsible for their privacy practices. The WhatsApp button on our site opens a chat with us in WhatsApp; WhatsApp's own privacy notice applies to that service, and we treat the messages you send us as enquiry data under this notice.
10. Changes to this notice
We review this notice at least annually and update it when our practices or the law change. The date at the top shows when it was last updated. Significant changes will be highlighted on the website.
