Privacy Policy

Maull & Co

Last updated: 7 October 2026

Maull & Co respects your privacy. This policy explains what personal information we collect, why we use it, who we share it with, how long we keep it and the choices and rights available to you.

It applies when you visit https://www.maullandco.co.uk, contact us, request a quotation, arrange or receive our property, facilities, estate, cleaning, maintenance or grounds and garden services, or deal with us as a supplier or business contact. It also covers relevant information about property owners, tenants, occupiers and site contacts. Personal information means information relating to an identified or identifiable living person.

1 Who is responsible for your information

Maull & Co is the trading name of Maull & Co Limited, a company registered in England and Wales with company number 15680468. We are the controller of personal information used for the purposes described in this policy, meaning that we decide why and how it is used.

Postal address: Unit 2, Checkpoint Court, Sadler Road, Lincoln, LN6 3PW

Email for privacy enquiries: enquiries@maullandco.co.uk

Telephone: +44 1522 424213
Company number: 15680468
Website: https://www.maullandco.co.uk

Please address privacy enquiries to the person responsible for data protection at Maull & Co using these details. You do not need to use legal terminology to raise a concern or exercise a right.

For some services, we may handle personal information solely on a client’s documented instructions as its processor. In those circumstances, the client’s privacy notice explains its purposes and lawful bases, and we assist it with relevant requests. We remain responsible as controller for our own enquiries, business administration, invoicing and legal obligations.

2 Information we collect

Identity and contact information: your name, postal and service addresses, email address, telephone number, company, job title and the identity of authorised contacts.

Enquiries and communications: messages, quotation requests, service preferences, appointment details, instructions, feedback, complaints and correspondence by email, telephone, website forms or other channels you use to contact us.

Property and service information: the location, type and condition of a site; measurements; requested work; inspection notes; job records; relevant photographs; maintenance history; and information about the people needed to arrange access or approve work.

Access and safety information: access arrangements, key references, entry instructions, alarm or gate codes, emergency contacts and information needed to work safely. We ask only for details relevant to the work.

Transaction information: quotations, contracts, invoices, billing contacts, payment status, bank transfer and standing order references, cash receipts, and cheque information. We currently accept BACS bank transfers, standing orders, cash and cheques. We do not currently collect direct debit mandates or offer online card payments. Please do not send card details through an enquiry form or email.

Website information: IP address, browser and device information, access times, pages requested, error and security logs, and cookie or similar identifiers where the relevant technology is used. Optional analytics or advertising information depends on the tools enabled and your choices, as explained in section 9.

Preferences and permissions: newsletter subscriptions, cookie choices where applicable, written publicity permissions, explicit health-information consents, objections and records needed to demonstrate that we have respected them.

Not every category is collected from every person. Please avoid sending information about other people, identity documents or sensitive details unless they are needed for your enquiry or our services.

3 Where information comes from

Most information comes directly from you when you contact us, complete a form, request services, provide instructions or pay an invoice. We may also collect information while surveying a site or carrying out work, and automatically when you interact with the website.

We may receive your name, contact details and relevant property or access information from a landlord, managing agent, property owner, employer, estate manager or another person arranging work. Subcontractors and suppliers may provide job updates, delivery details or reports relevant to the service. Payment providers may confirm transactions.

If we obtain your information from somebody else, we will explain its source and provide this notice within the applicable legal timescale, normally by our first contact and no later than one month after obtaining it, or earlier if required when disclosing it. If you give us another person’s details, please ensure you are entitled to share them and direct that person to this policy.

4 Why we use information and our lawful bases

UK data protection law requires a lawful basis for using personal information. The basis depends on the particular purpose and our relationship with you. We do not treat use of our website or acceptance of this policy as consent to every activity described here

Enquiries quotations and bookings

We use contact details, correspondence and information about proposed work to answer questions, prepare quotations, arrange surveys and agree services. Where you would personally enter the contract, this is necessary to take steps at your request before entering it. For general enquiries, or where you represent a business or another customer, we rely on legitimate interests in responding to enquiries and organising our business.

Providing and managing services

We use instructions, access details, site records and relevant contact information to schedule visits, carry out work, communicate changes, check quality and resolve service issues. Our basis is performance of our contract where you are the contracting individual. For tenants, occupiers, business representatives and other site contacts, it is our legitimate interests and those of our client in arranging safe, effective services and keeping the right people informed.

Payments accounting and business records

We use transaction and billing information to invoice, collect payments and process refunds under our contract with an individual customer. Where a company is the customer, we rely on legitimate interests in administering that relationship. We keep records required by applicable tax, accounting and other legislation to meet our legal obligations.

Safety security and disputes

We use relevant records to investigate incidents, protect sites and information, prevent misuse, handle complaints and establish, pursue or defend legal claims. We rely on legitimate interests in protecting people, property and our business, and on legal obligations where a specific reporting, safety or disclosure duty applies. In a genuine emergency, vital interests may apply where processing is necessary to protect someone’s life.

Website operation and improvement

We use essential technical and security information on the basis of legitimate interests in providing a reliable, secure website. For optional analytics and advertising described in our cookie information, we rely on consent where required. Details of any applicable exception and the associated choice will be provided in the cookie information.

Marketing and publicity

Where we send marketing or publish identifiable testimonials or promotional photographs, we use the bases and choices explained in sections 7 and 8. We keep limited preference records on the basis of legitimate interests in respecting your choices and, where applicable, legal obligations to demonstrate compliance.

Where we rely on legitimate interests, we consider whether the processing is necessary and balance those interests against your rights, expectations and potential impact on you. You can ask us for more information about that assessment.

5 Whether you must provide information

You can browse the website without submitting an enquiry. However, we need certain contact, location, instruction and billing details to prepare a meaningful quotation, arrange access, perform agreed work and administer payment. If you do not provide required information, we may be unable to offer or complete the service. We will explain which information is necessary when we request it, including where it is required by law or contract. Optional marketing consent is not a condition of receiving our services.

6 Sensitive information and site access

We may record limited health or disability information where you ask us to accommodate your needs when arranging or providing services. We collect only what is relevant to the adjustment, such as a necessary communication or access arrangement, and avoid recording a detailed medical history.

For this optional health-information record, we rely on your consent under Article 6(1)(a) of the UK GDPR and your explicit consent under Article 9(2)(a). We explain what we propose to record, why, who needs to see it and how long it is needed, and ask for a specific affirmative statement of consent. Simply mentioning a condition in a conversation is not treated as explicit consent to keep or share it.

You may decline or withdraw that consent by contacting enquiries@maullandco.co.uk. We then stop the consent-based use and remove the information unless a separate lawful ground and special category condition justify retaining particular records. Where possible, we agree a practical adjustment without retaining the underlying health details. We explain any specific effect on the requested arrangement; withdrawing health consent does not automatically end your service.

Only authorised people who need the information to implement an adjustment receive it. Subcontractors normally receive practical instructions rather than a diagnosis. If sharing health information itself is necessary, our consent request identifies that sharing.

Different rules may apply to information strictly necessary for a legal claim or an emergency. For legal claims, we rely on the relevant legitimate interest in establishing, exercising or defending the claim and the condition in Article 9(2)(f). In a life-protecting emergency where the individual cannot physically or legally consent, vital interests and Article 9(2)(c) may apply. We limit such records to the relevant purpose.

We hold keys, access codes and relevant tenant or emergency contact details only where needed for the work. Paper records and keys are kept in a locked cabinet at our premises. Access instructions are restricted to people who need them and are not included unnecessarily in routine correspondence or publicity. Please notify us promptly if a code or access arrangement changes.

7 Property photographs and testimonials

Where necessary, we take photographs to assess a job, record an existing condition, show completed work, check quality or address a complaint. Such images may become personal information where they identify a person or connect a home or other property to an individual. Our basis is performance of a contract with you where necessary, or legitimate interests in documenting work and resolving issues where appropriate.

We aim to exclude people, private belongings, documents, registration plates and security details unless they are relevant to the record. Operational photographs are not automatically approved for advertising.

Before using an identifiable customer’s testimonial, name or personal information in promotional photographs, we obtain written permission and explain the intended channels, such as our website and social media. We rely on consent for this use and also obtain any necessary permission from the property owner or authorised client. You can withdraw consent by contacting us. We will stop new use and remove material from channels we control without undue delay unless a lawful exception applies. We cannot necessarily recall printed material already distributed or copies independently shared by others. Withdrawal does not affect earlier lawful use.

8 Marketing and your choices

We use Wix Email Marketing to send newsletters and promotional emails only to people who actively subscribe. Our lawful basis is consent. Making an enquiry, paying an invoice or becoming a customer does not automatically add you to our newsletter list. We record the subscription and the wording shown when you signed up. Wix processes subscriber details, subscription status and relevant delivery information to provide this service. Any optional email-open or click tracking requiring consent is used only with that consent; you can contact us about your preferences.

You can unsubscribe at any time using the link in an email or by contacting enquiries@maullandco.co.uk. You have an absolute right to object to direct marketing, including any related profiling. We will stop using your information for that purpose. We keep only the minimum suppression record needed to avoid contacting you again against your wishes.

Administrative messages, such as appointment arrangements, access questions and invoices, are sent to manage your enquiry or service and are separate from marketing. Unsubscribing from newsletters does not prevent these necessary messages.

We do not share our subscriber list with other businesses for their independent marketing. If we introduce another promotional channel, we explain it and obtain the appropriate consent before using your details for that channel.

9 Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies can also store information or access device information. Our website is hosted on Wix and uses Usercentrics for Wix to present cookie information and manage relevant privacy choices.

The website’s current consent-management declaration lists these components as essential:

WIX CMS: provides the website platform and supports core operation, security and stability.
Usercentrics for Wix: provides cookie-consent management and records relevant privacy choices.

This component declaration is not a separate inventory of every individual cookie. The cookies used can vary with the page, feature and interaction. Some last only for your browser session; others remain for a defined period or until deleted. Wix publishes cookie names, purposes and typical durations in its Cookies and Your Wix Site guidance, linked below.

We rely on legitimate interests in operating a secure and functional website for personal information processed through necessary technologies. Technologies that satisfy the strictly necessary exception under the cookie rules do not require consent. Calling a component “essential” does not exempt any unrelated optional tracking it may contain.

Where optional technologies requiring consent are used, we ask for consent before they operate and use consent as the basis for the associated processing. You can manage available choices through the cookie banner and its privacy settings control. You can withdraw optional consent without affecting its earlier lawful use. If you cannot find the control, contact enquiries@maullandco.co.uk for assistance.

Your browser also allows you to inspect, block and delete stored cookies. Deleting them may remove remembered preferences, and blocking essential technologies can affect website functions. If we introduce analytics, advertising or other optional technologies, we update the information and controls as required before using them.

Wix cookie information

10 Who receives information

We share only information reasonably needed for the relevant purpose. Depending on the service and systems in use, recipients include:

Authorised personnel and subcontractors: only the contact details, job instructions and access information needed to fulfil our work requirements. We do not supply customer details to subcontractors for unrelated marketing or independent referrals. Appropriate confidentiality and data protection requirements apply.

The client or authorised property representative: relevant progress reports, evidence of work and information needed to manage the site. We do not routinely pass unrelated private correspondence to a landlord or another client.

Technology and administration providers: Wix for website hosting, enquiry forms and Wix Email Marketing; Usercentrics for Wix for cookie consent management; Google Workspace, including Gmail and Google Drive, for business communications and records; QuickBooks and Xero for accounting and invoicing; and relevant IT support providers. Cloudflare provides our domain services and processes relevant technical information where required to deliver those services.

Financial providers and advisers: banks, payment processors, accounting providers, accountants, insurers and legal advisers for payments, records, insurance and professional advice.

Public authorities and other parties: regulators, tax authorities, emergency services, courts or law enforcement where disclosure is required by law or otherwise necessary and lawful.

Some providers process information on our behalf under written terms. Others, such as banks or professional advisers, may act as independent controllers for their own regulated activities. Their notices explain that processing.

If our business is sold or reorganised, relevant information may be disclosed to professional advisers and a prospective or new owner under appropriate confidentiality and access restrictions. Any subsequent use must remain lawful, and we will explain material changes affecting you.

We do not sell your personal information or supply it to other organisations for their independent marketing.

11 International transfers

Our technology providers operate internationally. Information handled through our website, email, cloud storage, newsletter and accounting services may be stored or accessed outside the United Kingdom. This can include processing in Israel, the United States, the European Economic Area and other countries where the relevant provider and its authorised subprocessors operate. Not every provider or record uses every location.

For these services we rely on the applicable provider data protection terms and transfer arrangements. Transfers covered by UK adequacy regulations use that protection. Other restricted transfers require appropriate safeguards, such as Standard Contractual Clauses with the UK Addendum or a UK International Data Transfer Agreement, together with any required assessment and additional measures.

Wix’s published terms describe initial processing by Wix.com Ltd in Israel and onward transfers using applicable adequacy arrangements or contractual safeguards. Google’s cloud processing terms provide for recognised transfer arrangements and contractual clauses where required. Xero’s terms incorporate the UK Addendum for relevant restricted transfers. Intuit, the provider of QuickBooks, describes adequacy arrangements, the UK Extension to the EU–US Data Privacy Framework where applicable, and contractual safeguards for other transfers.

The precise arrangement depends on the provider, recipient, service and transfer. Current information about locations, subprocessors and safeguards is available through the provider documents linked below. You can also contact enquiries@maullandco.co.uk for information about the arrangements relevant to your personal information and a copy of applicable safeguards, with confidential information redacted where necessary.

Wix data processing terms

Google Workspace data processing terms

Xero data processing terms

Intuit privacy statement

Cloudflare data processing terms

12 How long we keep information

We use the retention periods below to limit how long we keep personal information. A specific legal requirement, insurance requirement or documented dispute may make longer retention necessary. We retain only the information needed for that exception and review it when the matter ends. The period for one record does not automatically apply to every piece of information associated with a customer.

Unsuccessful enquiries and quotations: 12 months after our last meaningful contact, unless the enquiry remains active or becomes a contract.

Core contracts, completed job records and relevant correspondence: six years after the contract or relevant work ends to address contractual queries and claims. Access codes and unnecessary sensitive information are excluded from this general period.

Company accounting and tax records, including invoices and payment records: six years from the end of the last company financial year to which they relate, and longer where applicable tax rules require it, including certain ongoing enquiries, late returns and asset records.

Routine operational photographs: 12 months after completion and acceptance of the work. Images needed as evidence of agreed scope, condition, a complaint or a claim are retained with the relevant job or claim record. Unnecessary duplicates are removed sooner.

Keys and operational access information: only while we remain authorised to access the site. Keys are returned and codes and unnecessary temporary contact details are removed promptly when that need ends. A minimal key handover record may be kept with the job record.

Health and disability information used for adjustments: while the adjustment remains relevant and explicit consent remains valid. We check continued need at least annually and remove the information promptly after the service relationship ends or consent is withdrawn, unless a separate lawful retention requirement applies.

Newsletter details: until you unsubscribe or our annual review shows there is no continuing reason to retain the subscription. We review subscriptions with no recorded interaction for 24 months and remove those no longer reasonably needed. Minimal suppression records are retained for as long as needed to respect your objection.

Promotional photographs and testimonials: while the permission remains valid and the material is relevant, with an annual review. After withdrawal, we stop promotional use. A minimal record of the permission and withdrawal is retained for six years after the last use to demonstrate how we handled it.

Privacy requests and complaints: three years after closure, unless a related claim or regulatory matter requires longer. Safety incidents, injury claims or safeguarding matters are assessed separately against the applicable legal and insurance requirements, with unnecessary sensitive detail removed.

Technical logs and backups: retained for the time needed to operate the service, investigate security events and support recovery, taking account of the relevant supplier’s retention settings and backup cycle. Incident evidence may be retained for the particular investigation or claim. Cookie lifetimes vary by purpose and are explained in the cookie information described in section 9. You can ask us for details relevant to your information.

When information is no longer required, we delete it, securely dispose of it or anonymise it. Deleted information may remain in supplier backups until the applicable cycle expires; it is not used for ordinary business purposes. Relevant deletion and suppression instructions are reapplied if records are restored.

13 How we protect information

We use technical and organisational measures appropriate to the information and risks, including two-factor authentication, password-protected devices and restricted access to customer records. Paper records and keys are kept in a locked cabinet at our premises. Access is limited to authorised people who need the information for their role. We use confidentiality requirements and review the security arrangements relevant to our suppliers.

No website or transmission method can be guaranteed completely secure. Please use the agreed method for sharing keys, alarm codes or other sensitive access information and contact us if you suspect misuse. We assess suspected personal information breaches and notify the regulator and affected people when legally required.

14 Your rights

Subject to the applicable legal conditions and exemptions, you may ask us to:

Confirm whether we use your information and provide access to it and the required supporting information.

Correct inaccurate information or complete information that is incomplete.

Erase information where there is no lawful reason to continue keeping it.

Restrict use in specified circumstances, such as while a relevant accuracy dispute is investigated.

Provide information you supplied in a structured, commonly used, machine-readable format, or transmit it to another controller where technically feasible, where portability applies to automated processing based on consent or contract.

You can withdraw consent at any time by contacting us or using the relevant settings. This does not affect processing that was lawful before withdrawal. Some information may still need to be kept for another lawful purpose, which we will explain.

Your right to object

You can object to processing based on legitimate interests for reasons relating to your particular situation. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. For direct marketing, your right to object is absolute and we will stop processing for that purpose.

Making a request

Contact enquiries@maullandco.co.uk or write to the address in section 1. We may request proportionate information to verify your identity or an agent’s authority. We normally respond without undue delay and within one month. Where legally permitted because a request is complex or you have made several requests, we may extend this by up to two further months and explain the extension within the initial month. If the law allows a pause or different starting point because clarification or identity information is needed, we will explain this.

Requests are normally free. We may charge a reasonable fee or refuse a request only where the law permits, and will explain our reasons and your options. Rights are not unlimited; for example, some records may need to be retained for legal obligations or claims, and we must protect other people’s rights.

15 Automated decisions and artificial intelligence

We do not currently use customer information in AI tools or make decisions about you based solely on automated processing that produce legal or similarly significant effects. Ordinary functions such as sending a form acknowledgement or an email do not amount to that type of significant automated decision.

We do not currently use CCTV, body-worn cameras, vehicle tracking or call recording for the activities covered by this policy. If we introduce these activities or AI processing, we will assess their privacy implications and provide the relevant information and safeguards before they begin.

16 Children and other websites

Our website and services are intended for adults arranging property and facilities services. We do not deliberately seek children’s information through the website. Please avoid including identifiable children in photographs or messages unless necessary for a specific issue. If we become aware that unnecessary information about a child has been collected, we will assess and remove it as appropriate. Any necessary processing connected with a site incident receives particular care.

Links to other websites lead to services operated by their own controllers. Read their privacy notices before providing information. This does not remove our responsibility for information we disclose to them or for third-party technologies we choose to include on our website.

17 Privacy concerns and complaints

If you believe we have mishandled your personal information, contact enquiries@maullandco.co.uk or write to the address in section 1. Explain your concern and how we can contact you. You can complain by email or post and ask for help or an accessible way to raise your concern.

We will acknowledge a data protection complaint within 30 days, investigate appropriately without undue delay, keep you informed as appropriate and communicate the outcome and any action taken.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator. You can find its current complaint procedure at https://ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address your concern, but this does not remove your right to approach the regulator.

18 Changes to this policy

We review this policy when our services, systems or legal obligations change. The date at the top shows when it was last updated. If we introduce a materially different use of personal information, we will provide the required information before that use begins and obtain fresh consent where required. For questions about this policy, contact us using the details in section 1.