Privacy notice

Who we are

Cityline Roofing Expert Ltd — “Cityline”, “we” and “us” in this notice — decides how the personal information described here is used, which makes us its controller under UK data protection law. Our company details: Registered in England and Wales, company number 16669422; registered office: 47a Queensbury Road, London, England, NW9 8LS. We trade from 4 Collingham Road, London SW5 0LT.

If you have a question about this notice or about your information, email us at [email protected], telephone 0203 490 8265, or write to us at 4 Collingham Road, London SW5 0LT. Other ways to reach us are on the contact page.

What we collect

Only what we need to deal with your enquiry and to do the work. You do not have to give us your information, but without your name, a way to contact you and the address of the property we cannot answer your enquiry, inspect the roof or quote.

What you give us

• Your name, email address and telephone number, and how you would like us to contact you.
• The address of the property, and what you tell us about the roof and the problem — in the enquiry form, in a message, or when we speak.
• Photographs you send us through this website. Before we store one, we remove the hidden information a phone camera adds to it, such as where it was taken. (Photographs you send by email or WhatsApp arrive as you sent them.)
• Anything you tell us to help us reach the roof, such as parking or how to get in. Please tell us only what we need: a key-safe code, for example, is used only for your job.
• Your choices: the inspection time you ask for, whether you want us to start work within your cancellation period, and whether you would like our occasional marketing emails.
• When you accept a quotation, approve a change to the work or sign off finished work online, the name you type and when you did it.

What we create

• Notes and photographs from our inspection, our findings and recommendations, quotations, job records, completion reports, invoices, payment records and guarantee certificates.
• Messages between you and us, our notes about your enquiry and the work, and a record of the emails we have sent you and whether they were delivered.

What is collected automatically

• When you accept a quotation, approve a change or sign off work online, the internet (IP) address and the browser it was sent from, kept with the record of that decision.
• While you are signed in to your own pages, a record of the session — the internet (IP) address, the browser and when it was last used — which is deleted once the session has expired.
• If you reach us from an advertisement or another website, the details in the link you followed (such as a campaign code or an advertising click reference), the site that sent you, the page you arrived on and the kind of device you used. We keep these with your enquiry to see which of our advertising works.
• To stop the website being misused, a scrambled code made from your internet (IP) address or email address — never the address itself — kept only until the limit it is used for runs out.
• Technical logs kept by our hosting provider, which can include your internet (IP) address.

What other people tell us

If someone else contacts us about a property you own or live in — a landlord, a managing agent or a relative, for example — we may hold your name and contact details as they give them to us, to arrange access or to keep you informed.

Why we do not accept video

This website accepts photographs only, not video. We remove the hidden information from every photograph sent through it before it is stored, and we cannot yet do that reliably for video, which can carry the place where it was recorded. Video files are also large and hard to send on a weak phone signal.

Messages about your job, and marketing

Messages about your enquiry and your job — confirmations, reminders, quotations, invoices — are part of the service you asked for, so they cannot be switched off while the job is running. Marketing is separate. We send three kinds of marketing email: reminders that a roof check is due, requests for a review, and invitations to recommend us to a friend. We send each only if you have agreed to it — the box on our enquiry form covers roof-check reminders only — and every one has a link to stop them. Stopping them changes nothing about your enquiry or your job. Our system marks every message as one kind or the other when it is created, so the two cannot be confused.

You have the right to object to marketing at any time: use the link in any marketing email, or tell us, and we will stop.

Who else handles your information

We do not sell your information, and we do not share it for anyone else’s marketing. These suppliers handle it for us, only on our instructions and under a data processing agreement:

• DigitalOcean hosts this website and its database, and stores the photographs and documents we keep, in its London data centre. DigitalOcean is a US company, and its staff may reach those systems from outside the UK, for example to provide support.
• Google, through its Google Workspace service, carries our email: the messages our system sends you, and our office mailbox. Google may process email in other countries, including the United States.

Where a supplier handles information outside the UK, it is protected by safeguards UK data protection law recognises. DigitalOcean relies on the UK–US data bridge (the UK extension to the EU–US Data Privacy Framework), with standard contractual clauses as a fallback, and Google on the standard contractual clauses in its data processing terms. Ask us if you would like more detail.

If you contact us by WhatsApp, or ask us to contact you that way, those messages are carried by WhatsApp, which Meta runs under its own terms and privacy policy.

This site does not send text messages. If you ask us to contact you by text message or telephone, one of our team does so from a business telephone.

We are not using an analytics service, an advertising network, a card payment provider or an error-monitoring service, and this page will say so until we are.

We also pass information on where we need to: to our accountant, for accounting and tax; to anyone who carries out part of your job for us, such as a scaffolder, who receives only what they need, such as the address; to professional advisers, insurers, courts or the authorities, where the law requires it or to deal with a claim; and to a buyer, if the business or part of it is sold.

How long we keep it

• An enquiry that does not become a job: two years after it is closed.
• Photographs sent with an enquiry that does not become a job: deleted automatically. The current setting is ninety days after the enquiry is closed, and seven days for anything marked as spam, after which there are fourteen more days in which the deletion can still be called off.
• Customer and job records — inspection findings and photographs, quotations, notes on the job (including how to get in), completion reports, messages and our notes: six years after the work is finished, which is the usual period for a claim under a contract.
• The record that you accepted a quotation, approved a change or signed off work: kept with the job record, and kept even if you ask us to delete your information, because it is the evidence of the contract.
• Invoices and payment records: six years, as the law requires for accounting and tax records.
• Guarantee records: for the length of the guarantee, plus six years.
• Your sign-in session: deleted once it has expired, at most thirty days after you signed in.
• Technical logs kept by our hosting provider: kept for a short period and not copied anywhere else, and never for more than twelve months.
• Our internal record of changes, which says who did what and when and, for some actions such as accepting a quotation, the internet (IP) address used: the personal details in it are kept for as long as we keep the record they relate to, and removed when that record is erased. The entries themselves cannot be altered or deleted, which is what makes them a reliable record.

Only the photograph rule above is carried out automatically. The other periods are the ones we work to: we review records and remove them when they are due, rather than to the day.

Your rights

You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, ask us to restrict how we use it while a question about it is settled, object to processing based on legitimate interests, and ask for a portable copy. We respond within one month.

You can withdraw your consent to marketing at any time, using the link in any marketing email or by telling us. Some rights have limits — we must keep invoices, for example — and if we cannot do everything you ask, we will tell you why.

A copy is produced from the system itself rather than assembled by hand: a data file containing everything held about you, and a plain summary of the same thing. Photographs and documents are listed in both by name and date, and we send copies of the files themselves too, unless you tell us you do not need them. We will check who you are before sending anything — usually against something only you would know, such as an invoice reference.

What deletion actually does, in detail

It is worth being specific, because “delete” means different things and we would rather you knew which one we mean.

• Your name, email address, telephone numbers, the address of the property (unless another customer shares it) and the notes about you on your customer record are removed from it. What is left keeps its reference number and its dates but no longer names anybody.
• Messages between us, notes we wrote about you, the contents of your enquiry, and anything recorded about where your enquiry came from are destroyed. One exception, until a change to our system is finished: what you sent from a quotation or job page — a question, a request for a change, a reason for declining, a message about the work — and our answers to it are kept. If you ask us to delete your information before then, we will tell you which remain.
• Notes on a job, including how to get in, the record of any problems put right at the end, and quotations we issued are kept with the job record.
• Photographs that are not part of the record of work done are deleted from storage. Photographs attached to a job, a survey or a defect are kept, because they are the evidence of what was found and what was done — but the captions and file names go.
• Invoices, payments, guarantees and completion reports are kept. An invoice has to carry the name and address it was issued to, and we must keep invoices for tax; a guarantee has to name who holds it, and we keep it so that we can honour it. We will tell you exactly which records these are.
• The record that you accepted a quotation is kept, including the name typed, the date and time, and the internet (IP) address and browser it was sent from — and, if we showed you cancellation information with the quotation, what it said and whether you asked us to start the work early — because it is the evidence that a contract was made.
• Everyone signed in through one of your links is signed out, and any unused links stop working.
• You are removed from marketing, permanently.

We keep a record that the deletion happened — the date, who carried it out, and counts of what was removed. It holds no name or contact details, only our own reference numbers, so that the deletion stays in force if an older backup is ever restored; we keep it for as long as we keep the records it refers to. Our internal change log keeps the record that each change happened, but the copies of your information inside those entries are removed at the same time.

Photographs already published on this website

If a photograph of your property has been published on this site as an example of our work, it was copied to the website when it was published, with a separate record of the permission given. Deleting your customer record does not automatically remove it, because that permission is a separate thing and the published copy may be the only one left. It is flagged for a decision whenever a record is deleted, and if you want it taken down, ask and we will take it down.

Backups

Backups exist so the business can recover from a disaster, and they are snapshots of a moment. We cannot reach inside an old backup to remove one person, and we will not pretend otherwise. If we ever have to restore from a backup, deletions that had already been carried out are re-applied to the restored data as a required step of the restore — so the outcome is the same, even though the intermediate copy existed. Our hosting provider keeps backups of the database for seven days, and then they are destroyed. Our file storage keeps an earlier version of a deleted photograph, so that a deletion made by mistake can be undone. That earlier version is kept until we remove it.

A review you left on Google or another site is held by that site, not by us, and only you can remove it. We can tell you how.

Complaints

If you are unhappy with how we have handled your information, please tell us first — by email to [email protected], by telephone on 0203 490 8265, or in writing to 4 Collingham Road, London SW5 0LT. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome. Our complaints procedure has more detail.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk.

Cookies

This website uses one cookie for customers, and only to keep you signed in to your own pages: it is set when you follow a secure link we sent you, or when you send us an enquiry through the form on this site. It holds a random key and nothing about you, and there are no analytics, advertising or tracking cookies. The cookies page has the details, including the other things your browser keeps.

Changes to this notice

We will update this notice if what we do with personal information changes. Last updated: 23 October 2026.