Privacy Policy

01Who we are

Dhalmia Limited is the data controller responsible for your personal data. We are a design-and-build company specialising in residential interiors, new-build projects, and commercial fit-outs across Scotland and the wider UK.

When we say “Dhalmia”, “we”, “us” or “our” in this policy, we are referring to Dhalmia Limited.

02Data we collect

We may collect and process the following categories of personal data:

Information you provide directly

• Contact details — name, email address, telephone number, postal address when you enquire about our services, request a consultation, or submit a form on our website.
• Project information — property details, design preferences, budget information, and project requirements shared during consultations.
• Client Portal credentials — a password you use to access project progress images and updates via our Client Portal.
• Employment / subcontractor data — CV, qualifications, trade certifications, and references if you apply to work with us.
• Communications — records of correspondence with us by email, phone, or through our website.

Information collected automatically

• Technical data — IP address, browser type and version, operating system, device type, screen resolution, and time zone.
• Usage data — pages visited, time spent on pages, referral source, click paths, and scroll depth.
• Cookie data — see Section 5 below for full details on cookies and similar technologies.

03How we use your data

We use your personal data for the following purposes:

• To respond to your enquiries and provide quotations for design and build services.
• To manage and deliver projects you have commissioned, including sharing progress updates via the Client Portal.
• To communicate with you about your project, including scheduling, design decisions, and completion milestones.
• To process applications from tradespeople and subcontractors who wish to work with us.
• To improve our website, services, and user experience based on aggregated analytics.
• To comply with legal obligations, such as tax, health & safety, and building regulations requirements.
• To protect our legitimate business interests, including fraud prevention and the security of our website and systems.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason compatible with the original purpose.

04Lawful basis for processing

Under the UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

Where we rely on legitimate interest, we have carried out a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may request details of this assessment by contacting us.

05Cookies & tracking

Our website uses cookies and similar technologies. A cookie is a small text file placed on your device when you visit a website.

Cookies we use

Managing cookies

Strictly necessary cookies cannot be disabled as they are essential for the website to function. You can control analytics and non-essential cookies through your browser settings. Most browsers allow you to refuse or delete cookies. The methods vary between browsers, so please consult your browser’s help documentation.

Please note that blocking certain cookies may affect your experience of our website, including access to the Client Portal.

06Who we share data with

We do not sell your personal data. We may share your information with the following categories of recipients where necessary:

• Subcontractors and trade partners — to deliver your project (for example, sharing site address and access details).
• Professional advisers — architects, structural engineers, building control, and quantity surveyors involved in your project.
• IT service providers — our website hosting provider and email service, who process data on our behalf under data processing agreements.
• Analytics providers — Google Analytics (data is anonymised and aggregated).
• Legal and regulatory bodies — HMRC, local authority building control, and the Health & Safety Executive where required by law.

All third parties are required to respect the security of your personal data and to treat it in accordance with the law. We do not allow third-party service providers to use your data for their own purposes and only permit them to process your data for specified purposes and in accordance with our instructions.

07How long we keep data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Enquiry data — 12 months from last contact if no project proceeds.
• Client project data — 6 years after project completion (in line with the Limitation Act 1980 for contractual claims, and up to 15 years for construction-related claims under the Prescription and Limitation (Scotland) Act 1973).
• Financial records — 7 years as required by HMRC.
• Trade/subcontractor applications — 12 months if not engaged; duration of working relationship plus 2 years if engaged.
• Website analytics — 26 months (Google Analytics default retention).
• Client Portal session cookies — automatically cleared after 30 minutes of inactivity.

When data is no longer required, it is securely deleted or anonymised.

08How we protect your data

We have put in place appropriate technical and organisational measures to protect your personal data, including:

• SSL/TLS encryption on all pages of our website.
• HMAC-signed authentication tokens for Client Portal access with automatic session expiry.
• Rate-limited login attempts to prevent brute-force attacks.
• Restricted access to personal data on a need-to-know basis.
• Regular security updates and monitoring of our website and hosting infrastructure.
• Right-click and drag protection on Client Portal images to prevent unauthorised downloads.

While we implement robust security measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to protecting your data to the highest practical standard.

09Your rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no compelling reason for its continued processing.
• Right to restrict processing — request that we limit how we use your data in certain circumstances.
• Right to data portability — request a machine-readable copy of data you provided to us.
• Right to object — object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at info@dhalmia.uk. We will respond within one month of receiving your request. There is no fee for making a request, although we may charge a reasonable fee if a request is manifestly unfounded or excessive.

We may need to request specific information from you to verify your identity before processing your request.

10International transfers

Our servers are based in the United Kingdom and EEA. Some of our third-party service providers (such as Google Analytics) may transfer data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as:

• Transfers to countries with UK adequacy regulations.
• Standard contractual clauses approved by the ICO.
• Certification under the UK Extension to the EU–US Data Privacy Framework.

11Children’s privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete that information.

12Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance (including updates introduced by the Data (Use and Access) Act 2025). The “Last updated” date at the top of this page indicates when this policy was most recently revised.

We encourage you to review this policy periodically. If we make material changes, we will endeavour to notify you by updating our website.

13Contact & complaints

If you have any questions about this privacy policy or wish to exercise your data protection rights, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.