GDPR and your data rights

The controller

RJ Energy Electrical Solutions, a sole trader business run by Ryan Jones from Birmingham, is the data controller for the information described here. We are a small electrical contractor, so there is no separate data protection officer. Ryan handles data requests personally.

Your rights in full

Each of these applies to the information we hold about you. Most can be used at any time, free of charge.

• The right to be informed. To know what we collect, why, and who we share it with. That is what our privacy policy is for.
• The right of access. To get a copy of the personal information we hold about you, along with an explanation of how we use it. This is often called a subject access request.
• The right to rectification. To have anything inaccurate corrected, and anything incomplete filled in. A wrong phone number or a misspelled name counts.
• The right to erasure. To have your information deleted where we no longer need it. This one is not absolute: certificates, invoices and test records that we are legally required to keep cannot be erased on request, and we will tell you plainly if that applies.
• The right to restrict processing. To have us pause using your information while a dispute about its accuracy or our basis for holding it is sorted out.
• The right to data portability. To receive the details you gave us in a common machine readable format, or to have them sent to another provider.
• The right to object. To object to any use we base on legitimate interests. If you object to marketing of any kind, we will stop immediately and without question.
• Rights around automated decisions. We do not make automated decisions or profile anyone, so no decision affecting you is ever made by a machine alone.

How to make a request

Email or call us using the details above and tell us which right you want to use. A sentence is enough, for example "please send me a copy of everything you hold about me" or "please delete my enquiry".

You do not need a special form or a legal reason. We may ask a question or two to confirm you are who you say you are, which protects your information from anyone pretending to be you.

• Cost: nothing. There is no fee unless a request is clearly excessive or repetitive, in which case we would tell you before doing anything.
• Timescale: we respond within one calendar month. If a request is complicated we can extend that by up to two further months, and we will explain why before the first month is up.
• Format: we will send information in the same way you contacted us, unless you ask for something different.

What we are likely to hold

So you know what to expect back from a subject access request, in most cases the answer is one or more of the following:

• Your enquiry, with the name, phone number, email address, chosen service and message you submitted, plus the date it arrived.
• Text, WhatsApp and email threads between you and Ryan.
• The quotation, the job notes, the property address and the invoice.
• Any electrical installation certificate, minor works certificate or EICR issued in your name, and the test results behind it.
• Photographs taken of the work carried out at your property.

Lawful bases, plainly

We use four of the six lawful bases in the UK GDPR, and none of our routine work relies on consent, so there is nothing you need to opt into to get a quote:

• Contract. Quoting for and carrying out the work you asked for, and invoicing it.
• Legal obligation. Issuing and registering certificates, notifying building control, and keeping financial records for HMRC.
• Legitimate interests. Running the business, keeping records that protect both sides if a question comes up later, and understanding which website pages generate enquiries. We have weighed this against your privacy and use the minimum information that does the job.
• Consent. Only for anything genuinely optional, such as using a photograph of your job as an example. You can withdraw consent at any time and we will stop.

Where your data is held

Enquiries, records and correspondence are held in the United Kingdom and the European Economic Area. Two of our suppliers, Google and Meta, are American companies that may process some data outside the UK. Where that happens it is covered by the UK International Data Transfer Addendum and the standard contractual clauses, which are the safeguards the law requires.

We do not transfer your information anywhere else, and we do not use overseas call centres or outsourced administration.

Breaches and complaints

If a personal data breach ever occurred that was likely to risk your rights and freedoms, we would report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly without undue delay.

If you are unhappy with how we have handled your information or your request, please raise it with us first so we can put it right. You also have the right to complain to the supervisory authority at any time:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline 0303 123 1113
• ico.org.uk/make-a-complaint

This statement was last updated on 28 August 2026 and sits alongside our privacy policy.

See also: Privacy Policy.