This policy explains what personal data Derek Gough Associates collects, why we collect it, how we protect it, and your rights in relation to it. We have written it to be clear and straightforward. If you have any questions, please contact us at info@dgough.co.uk.

1.  Who We Are

Derek Gough Associates Limited (DGA) is a RICS-regulated quantity surveying, contract administration, and project management practice. We operate from offices in Knutsford, Cheshire and London, with services delivered across the Northwest, London, and the Midlands.

For the purposes of UK GDPR, Derek Gough Associates is the data controller in respect of any personal data you provide to us or that we collect about you.

Registered address: The Old Hay Barn, Mere Estate, Warrington Road, Knutsford, WA16 0PY.

Contact: info@dgough.co.uk | 01565 831 999

2.  What Personal Data We Collect

We may collect and hold the following categories of personal data:

• Contact information: name, email address, telephone number, postal address
• Project information: property address, project description, budget information, drawings and specifications provided to us
• Business information: company name, role, and professional relationship where you engage with us as a business contact or referrer
• Financial information: invoicing details, payment records
• Correspondence: emails, letters, and other communications between you and DGA
• Website data: anonymised analytics data collected via cookies when you visit dgough.co.uk see Section 6

We do not collect sensitive personal data (as defined under UK GDPR Article 9) in the ordinary course of our business. If any sensitive data is relevant to a specific engagement, we will explain why we need it and obtain your explicit consent.

3.  How We Collect Personal Data

We collect personal data in the following ways:

• Directly from you: via the contact form on our website, by telephone, email, or in person when you enquire about or engage our services
• From third parties: where an architect, interior designer, or other professional refers you to us, they may share your contact details with your consent
• During a project: project addresses, drawings, specifications, and related correspondence provided during the delivery of our services
• Via our website: cookies and analytics tools collect anonymised data about how visitors use dgough.co.uk see Section 6

4.  Why We Use Your Personal Data (Lawful Basis)

We use personal data only where we have a lawful basis to do so under UK GDPR. The bases we rely on are:

5.  Third-Party Tools and Data Processors

We use several third-party tools to manage our business. Where these tools process personal data on our behalf, they act as data processors under UK GDPR. We ensure each has appropriate data processing terms in place.

We do not sell, rent, or trade personal data with third parties for their own marketing purposes. We do not share personal data with any party not listed above without your knowledge, except where required by law.

6.  Cookies and Website Analytics

Our website (dgough.co.uk) uses cookies, small text files placed on your device, to help us understand how visitors use the site and to improve your experience.

We use Google Analytics to collect anonymised data on site traffic and visitor behaviour. This data does not identify you personally. You may opt out of Google Analytics tracking at any time via your browser settings or by using Google’s opt-out browser add-on.

We do not use cookies to serve you targeted advertising on our own website. Where we run paid advertising campaigns on Google, Facebook, or LinkedIn, those platforms may use their own cookies and audience data in accordance with their own privacy policies.

You may disable cookies in your browser settings at any time. Doing so may affect the functionality of some parts of our website.

7.  International Data Transfers

Some of the third-party tools we use (including HubSpot, Xero, Airtable, and Anthropic) are operated by companies based in the United States. Where personal data is transferred to the USA or other countries outside the UK, we ensure that an appropriate safeguard is in place, being one of the following:

• A UK International Data Transfer Agreement (IDTA) or equivalent Standard Contractual Clauses (SCCs) incorporated into the provider’s terms
• An adequacy decision by the UK Secretary of State confirming that the destination country provides an adequate level of data protection

Details of the transfer mechanism applicable to each provider are available on request. If you have concerns about how your data is protected in transfer, please contact us at info@dgough.co.uk.

8.  Use of Artificial Intelligence Tools

Derek Gough Associates uses AI-assisted tools, including Anthropic’s Claude platform to support internal tasks such as drafting documents, structuring reports, and operational analysis. We are transparent about this use.

Our policy on AI tool use is as follows:

• We use only paid professional accounts, which contractually commit the AI provider not to use our inputs to train their models
• We do not input identifiable personal data (such as client names, addresses, or financial information linked to a specific individual) into AI tools without first anonymising or removing that data
• AI tools are used to assist DGA staff all outputs are reviewed and approved by a qualified DGA professional before use
• We do not use AI tools to make automated decisions about individuals

9.  How Long We Keep Your Data

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law or RICS regulation. Our standard retention periods are:

10.  Your Rights

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you
• Right to rectification: you may ask us to correct inaccurate or incomplete data
• Right to erasure: you may ask us to delete your data where there is no overriding legal reason for us to retain it
• Right to restrict processing: you may ask us to pause processing your data in certain circumstances
• Right to data portability: you may request your data in a structured, machine-readable format
• Right to object: you may object to processing based on legitimate interests, including direct marketing
• Rights in relation to automated decision-making: you have the right not to be subject to decisions made solely by automated means that have a legal or significant effect on you — DGA does not make such decisions

To exercise any of these rights, please contact us at info@dgough.co.uk or write to us at our Knutsford address. We will respond within one calendar month. There is no charge for making a request.

If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11.  How We Protect Your Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These include:

• Use of secure, password-protected systems with access restricted to authorised DGA staff
• Transmission of sensitive data via SSL-encrypted connections
• Use of reputable third-party platforms with their own security accreditations (see Section 5)
• An internal AI data handling policy limiting the input of personal data into AI tools

No method of transmission over the internet is entirely secure. If you have concerns about sharing sensitive information with us electronically, please contact us to discuss alternative arrangements.

12.  Changes to This Policy

We review this privacy policy annually and whenever there is a material change to how we process personal data. The current version will always be available at dgough.co.uk. Where changes are significant, we will notify active clients directly.

This policy was last reviewed in April 2025. The principal changes from the previous version are: updated third-party tool references (HubSpot replaces Insightly as our CRM); addition of Section 7 on international data transfers; addition of Section 8 on AI tool use; addition of data retention periods in Section 9.

13.  Contact Us

If you have any questions about this privacy policy or how we handle your personal data, please contact us: