What your privacy notice should include
The ICO lists the privacy information you must provide. For a typical builder’s website that means:
- your business name and contact details;
- the purposes you use personal data for (for example, replying to quote requests);
- the lawful basis you rely on for each purpose;
- who you share data with (for example, your email or form provider);
- how long you keep it, or the criteria you use to decide;
- people’s rights over their data;
- that people can complain to the ICO. The ICO says that if you’re UK-based it’s good practice to tell people this and give its contact details.
Cookies and consent
Under PECR, the ICO says you must tell people if you set cookies, explain what they do and why, and get consent. Consent must be a clear positive action; it can’t be implied just because someone keeps using the site, and you can’t set non-essential cookies before consent (ICO). There is an exemption for cookies that are strictly necessary to provide a service the user has asked for. Cookies that are helpful but not essential still need consent.
In practice: a simple site with no analytics or advertising tags may not need a consent banner at all. Adding analytics, advertising pixels or some embedded content usually means you need one. Cookie rules have been changing under the Data (Use and Access) Act 2025, so check the ICO’s current guidance before relying on any exemption.
Contact forms
- Only ask for what you need to reply.
- Link to your privacy notice next to the submit button.
- Don’t add people to a mailing list unless they’ve clearly agreed.
- Know where submissions go (an inbox, a form service) and who can see them.
A quick checklist
- Privacy notice linked in the footer and next to forms.
- A list of every cookie and tag the site sets, and why.
- Consent banner only if non-essential cookies are used, with a real “reject” option.
- Form submissions stored securely and deleted when no longer needed.
Questions people ask
Do I need a cookie banner on my builder’s website?
Only if the site sets cookies that aren’t strictly necessary, such as most analytics and advertising tags. If it sets none, you don’t need a consent banner, though it’s good practice to say so in your privacy notice.
Is a privacy notice a legal requirement?
If you collect personal data, for example through a contact form, UK GDPR requires you to give people privacy information. The ICO publishes a list of what to include.
Can I copy another company’s privacy policy?
It won’t describe what you actually do with data, which is the point of the notice. Use the ICO’s list and describe your own processes.
Related guides
Pages a construction website needs
The core pages for a builder or construction company site, what goes on each, and what visitors look for first.
Company details on your website
What a limited company must show on its website, and the details sole traders and partnerships should include.
Reviews and the law
What the 2025 fake-review ban means for builders who show testimonials or review scores on their website.
Google Business Profile for builders
Setting up a Google Business Profile as a service-area business, and keeping it consistent with your website.