Last updated: 11 November 2026
This privacy policy explains how Rische Group collects, uses and protects personal information when you visit rischegroup.co.uk, send us an enquiry or otherwise contact us through the website. We are committed to handling your information fairly and lawfully under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
The controller responsible for your personal information is Rische Group [registered company name and company number to confirm], whose office is at Fields View Office, Brook Farm, Swineyard Lane, WA16 0SD [registered office address to confirm if different].
We are registered with the Information Commissioner’s Office (ICO) under registration number [to confirm].
If you have any questions about this policy or how we use your information, please contact us:
- Email: info@rischegroup.co.uk
- Telephone: 0161 877 6200
- Post: Rische Group, Fields View Office, Brook Farm, Swineyard Lane, WA16 0SD
We have not appointed a Data Protection Officer [to confirm]. Data protection queries are handled by [named contact or role to confirm].
2. The information we collect
Information you give us
We only collect personal information that you choose to give us when you get in touch.
- “Send us a message” form (shown on most pages of the website): your full name, email address, phone number (optional) and the details of your project or message.
- “Tell us about your project” form (on our Start a Project page): your full name, company name, email address, phone number, the details of your project, how you heard about us, and your confirmation that you have read this privacy policy and our terms and conditions.
- Email, telephone and WhatsApp: if you contact us directly, we receive your contact details and whatever information you include in your message or call. If you use our WhatsApp link, your messages are also handled by WhatsApp (Meta) under its own privacy policy.
Please do not include sensitive personal information (for example, health information) in an enquiry. We do not need it to respond to you.
Information collected automatically
- Form submission data: when you submit a form, our website records the date and time, the page you submitted it from, your IP address and your browser type, alongside your answers. We use this to manage enquiries and to detect misuse.
- Spam and bot protection: our forms use Cloudflare Turnstile to check that a real person is submitting them. Turnstile processes information such as your IP address and technical details about your browser and device to make that check. It does not show adverts or build a marketing profile.
- Server and security logs: like most websites, our hosting provider keeps technical logs of requests made to the website (IP address, date and time, pages requested, browser type) to keep the site secure and working.
- Cookies: we use a small number of cookies. Essential cookies remember your cookie choices. Our embedded Google Map is only loaded after you consent to marketing cookies. We do not currently use analytics or advertising tracking on this website. See our Cookie Policy for full details and to change your choices at any time.
3. How we use your information and our lawful basis
Under UK GDPR we must have a lawful basis for each way we use your information.
- To respond to your enquiry, discuss your project and prepare proposals or quotations. Lawful basis: our legitimate interests in responding to business enquiries and, where you ask us for a quotation or proposal, taking steps at your request before entering into a contract.
- To manage our relationship with you if you become a client, including delivering projects, invoicing and keeping records. Lawful basis: performance of a contract, and compliance with our legal obligations (for example, tax and accounting rules).
- To protect our forms and website from spam, abuse and security threats. Lawful basis: our legitimate interests in keeping the website secure and usable.
- To show an interactive Google Map of our location. Lawful basis: your consent, given through our cookie banner. You can withdraw it at any time through the “Manage consent” option.
- To deal with legal claims or regulatory requirements. Lawful basis: our legitimate interests and, where applicable, compliance with a legal obligation.
We do not use your information for automated decision-making or profiling, and we do not sell it. We will not add you to a marketing mailing list unless you have asked us to or the law otherwise allows it, and you can opt out of any marketing from us at any time.
Where we rely on legitimate interests, we have considered your rights and expectations and concluded that our use is proportionate. You can ask us for more information about this balancing assessment.
4. Who we share your information with
We only share your information where necessary, with trusted service providers who process it on our behalf and under contract, or where the law requires it.
- Website hosting: [hosting provider to confirm] hosts our website and its database, where form submissions are stored.
- Brevo (Sendinblue SAS): delivers the notification emails our website sends when a form is submitted, so the contents of your submission pass through Brevo’s email service. Brevo is based in France.
- Cloudflare, Inc.: provides the Turnstile spam and bot protection on our forms.
- Google LLC / Google Ireland Limited: provides the embedded map on our Contact page, loaded only after you consent. When it loads, Google receives your IP address and may set its own cookies.
- Our email and IT providers: enquiries are received and stored in our business email system [email provider to confirm].
- Professional advisers and authorities: such as our accountants, insurers or legal advisers, or law enforcement and regulators where we are legally required to share information.
If we work on your project with subcontractors or consultants, we only share the information they need to carry out that work.
5. International transfers
Some of our service providers process information outside the UK. Brevo processes data in the European Economic Area, which the UK recognises as providing adequate protection. Cloudflare and Google may process data in the United States and other countries. Where information is transferred outside the UK, we rely on the protections required by UK law, such as the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Addendum to the standard contractual clauses.
6. How long we keep your information
- Enquiries that do not lead to work: we keep form submissions and related correspondence for [to confirm, for example 24 months] after our last contact, so we can refer back to your enquiry, and then delete them.
- Clients: we keep project, contract and financial records for as long as necessary for the project and any warranty or defects period, and then for [to confirm, typically 6 years, or 12 years where a contract is signed as a deed] to meet legal, tax and insurance requirements.
- Server and security logs: kept by our hosting provider for a limited period [to confirm] and then deleted automatically.
- Cookies: see our Cookie Policy for how long each cookie lasts.
7. How we keep your information secure
We use appropriate technical and organisational measures to protect your information, including encrypted (HTTPS) connections, restricted access to the website administration area and to enquiry records, and contracts with our service providers that require them to protect it. No method of transmission over the internet is completely secure, but we work to protect your information and to respond promptly to any incident.
8. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you (right of access)
- ask us to correct information that is inaccurate or incomplete (right to rectification)
- ask us to delete your information (right to erasure)
- ask us to restrict how we use your information (right to restriction)
- object to our use of your information where we rely on legitimate interests, and object at any time to direct marketing (right to object)
- ask us to transfer information you gave us to you or another organisation, where we process it on the basis of consent or a contract (right to data portability)
- withdraw your consent at any time where we rely on consent, for example through the “Manage consent” option for cookies
Some rights only apply in certain circumstances. To make a request, contact us using the details in section 1. There is normally no charge, and we will respond within one month. We may need to confirm your identity before we act on your request.
9. Complaints
If you are unhappy with how we have handled your personal information, please contact us first at info@rischegroup.co.uk and we will do our best to put things right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
10. Links to other websites
Our website links to other websites and social media platforms, such as LinkedIn, Instagram and WhatsApp. These links do not share your information with those platforms until you click them. Once you leave our website, the other site’s own privacy policy applies, and we are not responsible for how it handles your information.
11. Children
Our website and services are aimed at businesses and are not intended for children. We do not knowingly collect personal information from anyone under 18.
12. Changes to this policy
We may update this privacy policy from time to time, for example if we start using a new service on our website. The latest version will always be published on this page, with the date it was last updated shown at the top.