This privacy policy explains how JKS London Ltd collects, uses, shares and protects personal information when you visit our website, ask us for a quotation, book a service, work with us as a client or apply for a job. We are committed to handling your data fairly, lawfully and transparently.
Last updated: 19 October 2026
Please read this policy together with our Cookie Policy, which explains how cookies and similar technologies are used on this website, and our Terms and Conditions. If anything in this policy is unclear, please get in touch.
1. Who we are
JKS London Ltd (“JKS London”, “we”, “us” or “our”) is an NICEIC-approved electrical and mechanical & electrical (M&E) contractor and facilities-management partner, established in 2004. We are a private limited company registered in England and Wales. Our company registration details can be checked on the Companies House register.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, JKS London Ltd is the controller of the personal data described in this policy, which means we decide how and why it is processed. Where we carry out work on behalf of a client and process personal data only on that client’s instructions (for example, information about building occupants that appears in a client’s records), we may act as a processor for that client, and the client’s own privacy notice will also apply.
How to contact us about privacy
- Email: [email protected] (please put “Data Protection” in the subject line)
- Telephone: 020 8859 7512
- Post: Data Protection, JKS London Ltd, The Stables, Unit 10, Bunkers Hill, Sidcup, Kent, DA14 5EX, United Kingdom
We are not required to appoint a statutory Data Protection Officer, but a named member of our management team is responsible for data protection and will deal with your enquiry. Organisations that pay the data protection fee are listed on the ICO’s public register of fee payers.
2. The laws that apply
We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025. PECR governs electronic marketing and the use of cookies and similar technologies. The UK’s data protection regulator is the Information Commission, which continues to operate under the name ICO.
3. The personal data we collect
The information we collect depends on how you interact with us. We aim to collect only what we genuinely need.
3.1 Enquiry, quotation and contact forms
Our contact and quotation forms (built with the Contact Form 7 plugin for WordPress) ask for:
- first name and last name;
- email address;
- telephone number;
- your preferred contact method;
- the service you are interested in; and
- your message, including any details you choose to give about your property, site or requirements.
Please avoid including sensitive information (such as health details) in a free-text message unless it is genuinely needed, for example to explain access requirements for a site visit.
3.2 Online bookings and orders (“Book a Service”)
When you book a service through our Book a Service pages, which run on WooCommerce, we collect:
- billing details: name, company name (if any), billing address, email address and telephone number;
- site or service address, if different from the billing address, and any notes you add about access or timing;
- details of the services booked, prices, order number, order status and order history; and
- if you create an account, your username, a securely hashed password and your account preferences.
Card and payment details are handled by our payment gateway provider(s), not by us. When you pay online you enter your card details directly into the payment provider’s secure systems. We receive confirmation that payment has been made, a transaction reference and limited information such as the card type and last four digits, but we do not see or store your full card number or security code.
3.3 Site visits, surveys and contract delivery
When we carry out a free site visit, survey, inspection, test or project for you, we will hold information such as:
- names, job titles, email addresses and telephone numbers of client contacts, facilities managers, site managers and keyholders;
- site addresses, access arrangements, permit-to-work and isolation requirements, and health and safety information (for example, asbestos register details and site-specific risk information);
- quotations, purchase orders, contracts, variations, invoices and payment records;
- certificates and reports we issue, such as Electrical Installation Condition Reports (EICRs), electrical installation and minor works certificates, emergency lighting certificates, PAT testing records, asset registers and maintenance reports, which may include the names of the people who commissioned, signed or received them; and
- correspondence, meeting notes and job records, including photographs of electrical installations and plant taken for reporting purposes. We take care not to photograph people where this can be avoided.
3.4 Careers and job applications
If you apply to work with us, including for an apprenticeship via our Careers page, we will process the information in your CV and covering letter, your contact details, employment history, qualifications, trade cards and certifications (for example, ECS or JIB cards), references, right-to-work information and interview notes. If you voluntarily provide equal opportunities information, it will be used only for monitoring and kept separately from your application. Where a role requires it, we may carry out background checks, and we will tell you about them first.
3.5 Website security and technical data
Our website uses the Wordfence security plugin to protect against malicious traffic, brute-force login attempts and other attacks. To do this, Wordfence records information about visits and requests, including IP addresses, the date and time of the request, the pages or files requested, the browser user agent and, for login attempts, the username entered. Our hosting provider also keeps standard server logs, which contain similar technical information.
3.6 Cookie consent records
We use CookieYes to manage your cookie choices. When you accept, reject or customise cookies, a record of your consent is kept, including an anonymised or pseudonymised identifier, the date and time, the categories you agreed to and the version of the banner shown. This allows us to respect your choices and demonstrate that we have done so. See our Cookie Policy for details.
3.7 Emails, calls and other correspondence
If you email us, telephone us or write to us, we keep a record of the correspondence, including your contact details and the content of your message, so that we can respond and keep an accurate record of our dealings with you.
3.8 Information from other sources
We sometimes receive personal data from third parties, for example when a managing agent, landlord or facilities-management company gives us the name and number of a site contact, when a main contractor refers a job to us, or when a referee provides a reference for a job applicant. We may also check publicly available sources such as Companies House when setting up a business account.
4. How and why we use personal data, and our lawful bases
Data protection law requires us to have a lawful basis for each purpose for which we use personal data. The table below sets out the main purposes and the lawful basis we rely on.
| Purpose | Types of data | Lawful basis |
|---|---|---|
| Responding to enquiries and preparing quotations | Contact form data, correspondence | Steps at your request before entering into a contract; otherwise our legitimate interests in responding to business enquiries |
| Processing online bookings and orders, taking payment and sending order confirmations | Billing details, order data, payment confirmation | Performance of a contract |
| Arranging and carrying out site visits, inspections, testing, maintenance and installation work | Client and site contact details, access and safety information, job records | Performance of a contract; legitimate interests (where the contract is with your employer or a third party) |
| Issuing certificates, test records and reports (EICRs, emergency lighting, PAT and similar) | Names, signatures, site and installation details | Performance of a contract; legal obligation; legitimate interests in maintaining accurate safety records |
| Invoicing, accounting, tax and VAT records | Billing and transaction data | Legal obligation; performance of a contract |
| Health and safety management on site | Site risk information, incident records | Legal obligation; legitimate interests |
| Recruitment and assessing job applications | CV, application and interview data | Steps at your request before entering into a contract; legitimate interests; legal obligation (right-to-work checks) |
| Equal opportunities monitoring (optional) | Special category data you choose to provide | Your explicit consent, or substantial public interest (equality of opportunity) under the Data Protection Act 2018 |
| Keeping the website secure and preventing fraud and misuse | IP addresses, security and server logs | Legitimate interests (network and information security) |
| Recording cookie consent | Consent records | Legal obligation (to demonstrate compliance with PECR and UK GDPR) |
| Non-essential cookies and similar technologies | Cookie and device data | Your consent, or a statutory exemption under PECR where it applies (see our Cookie Policy) |
| Sending service updates, compliance reminders and information about our services to business contacts | Name, business email, telephone | Legitimate interests, with a simple way to opt out every time (see section 9) |
| Sending marketing emails to individual consumers | Name, email address | Consent |
| Accreditation assessments, audits and quality checks | Job records, certificates | Legitimate interests in maintaining our accreditations; legal obligation where applicable |
| Establishing, exercising or defending legal claims | Any relevant records | Legitimate interests; legal claims condition for any special category data |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms and concluded that they are not. You can ask us for more information about this assessment. Where we rely on consent, you can withdraw it at any time; this will not affect processing that took place before you withdrew it.
If you do not provide information that we need to perform a contract (for example, a site address or access details), we may not be able to carry out the work.
5. Who we share personal data with
We do not sell your personal data. We share it only where necessary, with the following categories of recipient:
- Website hosting provider – hosts our website, databases and server logs.
- Email and business software providers – provide our email, document storage, scheduling, job-management and accounting systems.
- Payment gateway providers – process online payments securely and carry out fraud checks. They may act as independent controllers for some of this processing, under their own privacy notices.
- IT, security and plugin providers – including Wordfence (website security) and CookieYes (cookie consent management), and IT support contractors who maintain our systems.
- Subcontractors and specialist partners – where they help us deliver work at your site, they receive only the contact and site information they need.
- Professional advisers – such as accountants, auditors, lawyers and insurers, where reasonably necessary.
- Accreditation and certification bodies – including NICEIC assessors and health and safety pre-qualification schemes, who may review samples of our work, certificates and job records as part of assessments.
- Regulators, public authorities and law enforcement – such as HMRC, the Health and Safety Executive, local authorities or the police, where we are legally required or permitted to share information.
- Your organisation or the property owner – certificates and reports are issued to the person or organisation who commissioned the work, and may be passed to landlords, managing agents, insurers or fire risk assessors as part of normal compliance processes.
- A purchaser or successor – if we sell or restructure our business, personal data may be transferred to the new owner, who will be bound by data protection law.
Service providers who process personal data on our behalf are bound by written contracts requiring them to keep it secure, use it only on our instructions and comply with data protection law.
6. International transfers
We aim to keep personal data within the United Kingdom. However, some of our service providers (for example, cloud email, software, security or payment providers) may store or access data in the European Economic Area, the United States or other countries.
Where personal data is transferred outside the UK, we make sure it is protected by one of the safeguards permitted under UK data protection law, such as:
- transfer to a country that the UK has recognised as providing an adequate level of protection (UK adequacy regulations), including the EEA and, for certified organisations, the UK Extension to the EU–US Data Privacy Framework;
- the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures needed; or
- another lawful transfer mechanism or exception permitted by the UK GDPR.
You can contact us for more information about the safeguards used for a particular transfer.
7. How long we keep personal data
We keep personal data only for as long as we need it for the purposes described in this policy, including to meet legal, accounting, insurance and reporting requirements. The table below shows our typical retention periods. In some cases we may need to keep data for longer, for example if there is a dispute, an insurance claim or a legal hold.
| Type of record | Typical retention period |
|---|---|
| General enquiries and quotations that do not lead to work | 24 months from our last contact |
| Customer, contract and project records (including correspondence, orders and invoices) | 6 years after the end of the contract or the last transaction, reflecting the limitation period under the Limitation Act 1980 and HMRC record-keeping requirements |
| Contracts executed as deeds | 12 years after the end of the contract |
| Accounting, VAT and tax records | At least 6 years from the end of the relevant financial year |
| Certificates and reports we issue (EICRs, installation and minor works certificates, emergency lighting certificates, PAT records) | For the life of the certificate or report (until it is superseded by the next inspection or test) plus 6 years |
| Health and safety and site incident records | As required by law; generally at least 6 years, and longer where legislation or our insurers require |
| Online account data | Until you ask us to close the account, or after 3 years of inactivity, subject to order records being kept as above |
| Unsuccessful job applications | 6 months after the recruitment decision, or longer with your consent so we can consider you for future roles |
| Successful job applications | Transferred to the employee’s personnel file and kept under our staff privacy notice |
| Website security logs (Wordfence) | Normally up to 90 days, unless needed to investigate a security incident |
| Hosting server logs | As set by our hosting provider, typically between 30 and 90 days |
| Cookie consent records (CookieYes) | Up to 12 months, or as long as necessary to demonstrate your choice |
| Marketing preferences and suppression list | Until you ask us to stop; we keep a minimal suppression record so that we do not contact you again |
When data is no longer needed, we securely delete or anonymise it.
8. How we keep personal data secure
We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. These include:
- encrypted connections (HTTPS/TLS) across our website, including forms and checkout;
- a web application firewall, login security and malware scanning provided by Wordfence;
- keeping WordPress, WooCommerce, plugins and server software updated;
- access controls so that staff and contractors can see only the information they need, with strong passwords and multi-factor authentication where available;
- regular backups held securely by our hosting provider; and
- staff awareness of data protection and confidentiality responsibilities.
No method of transmission over the internet is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, you, in line with the law.
9. Marketing communications
We do not send unsolicited marketing to individual consumers. If you are a consumer, we will only send you marketing emails or texts if you have opted in, for example by ticking a box on a form.
If you are a business contact (for example, a facilities or property manager) and we have worked with you or you have enquired about our services, we may send you occasional information about similar services, regulatory updates or compliance reminders, as permitted by PECR. Every message will include a simple way to unsubscribe.
You can opt out of marketing at any time by clicking “unsubscribe” in any email, replying “STOP” to a text, or emailing [email protected]. We will continue to send service messages that are necessary for any work we are carrying out for you, such as booking confirmations, appointment reminders and certificate renewal notices that form part of an agreed service.
10. Your rights
Under UK data protection law you have the following rights. Some apply only in certain circumstances.
- Right to be informed – to receive clear information about how we use your data, which is what this policy provides.
- Right of access – to ask for a copy of the personal data we hold about you (a “subject access request”).
- Right to rectification – to ask us to correct inaccurate data or complete incomplete data.
- Right to erasure – to ask us to delete your data where there is no longer a good reason for us to keep it. This right does not apply where we must keep data for legal reasons, for example invoices we are required to keep for tax purposes or safety certificates.
- Right to restriction – to ask us to limit how we use your data, for example while we check its accuracy.
- Right to data portability – to receive data you provided to us, which we process by automated means on the basis of consent or a contract, in a structured, commonly used, machine-readable format, or to have it sent to another organisation where technically feasible.
- Right to object – to object to processing based on legitimate interests, and an absolute right to object to direct marketing.
- Rights relating to automated decision-making – we do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
- Right to withdraw consent – where we rely on your consent, you can withdraw it at any time.
How to exercise your rights
To exercise any of these rights, contact us using the details in section 1. We may need to ask you for information to confirm your identity before we act on your request. We will respond without undue delay and in any event within one month of receiving your request (or of receiving any information we reasonably need to confirm your identity or clarify the request). Where a request is complex, we may extend this by up to two further months and will tell you why. We will normally deal with your request free of charge, but we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
11. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so that we can try to put things right. You can make a data protection complaint by emailing [email protected] with “Data Protection Complaint” in the subject line, by using the form on our Contact us page, or by writing to the postal address in section 1. In line with the Data (Use and Access) Act 2025, we will acknowledge your complaint within 30 days, take appropriate steps to investigate it, and tell you the outcome without undue delay.
You also have the right to complain to the UK regulator, the Information Commission (ICO):
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
The ICO will usually expect you to have raised your concern with us first.
12. Children
Our website and services are aimed at businesses and adults. We do not knowingly collect personal data from children under 13 through our website, and online bookings may only be made by people aged 18 or over. Apprenticeship applicants aged 16 or 17 may apply through our careers process, and we take additional care with their data. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will delete it.
13. Links to other websites
Our website contains links to other websites, such as accreditation bodies, regulators and suppliers. We are not responsible for the privacy practices of those websites, so please read their privacy notices. See also our Disclaimer.
14. Cookies
We use cookies and similar technologies, such as browser local storage, to make our website work, to keep it secure and, with your consent where required, to understand how it is used. You can change your choices at any time using the “Cookie settings” button on the website. Full details, including a list of the cookies we use, are in our Cookie Policy.
15. Changes to this policy
We review this policy regularly and may update it to reflect changes in the law, our services or how we use personal data. The “Last updated” date at the top of this page shows when it was last revised. If we make significant changes that affect how we use personal data you have already given us, we will tell you directly where appropriate.
16. Related policies
If you have any questions about this policy or how we handle your information, please contact us.
