Privacy Policy

Last updated: 23 September 2026

1. Who we are

Brokehall Heating & Plumbing Ltd (“BHP”, “we”, “us”) is the data controller for the personal information described in this notice. Our registered address is 36 Arundel Way, Ipswich, IP3 8SG; company number 17342516. We are registered with the Information Commissioner's Office (ICO), registration reference ZC205468, and with the Gas Safe Register, number 670614.

We are a small business and are not required to appoint a Data Protection Officer. Our director, Sarah Stannard, is responsible for data protection. Contact details are in section 11.

2. Personal information we collect

Information you give us online, by telephone, email or in person:

• Identity and contact details: your name, email address, telephone number and preferred contact method;
• Property details: the address where work is needed and any access notes you give us (for example, a key-safe arrangement or parking information);
• Job details: the service requested and your description of the work;
• Your choice about service, appointment and certificate-renewal reminders, with the date and way you gave or withdrew consent.

Information we create while providing our services: job numbers, appointment dates, quotes, invoices and payment status, gas-safety and other certificates (including appliance details, inspection results and signatures), and a record of emails and text messages we send you.

Information from other people: if a landlord, letting agent or family member books work on your behalf, they may give us your name, contact details and address so we can arrange access. If you are a tenant, your landlord receives a copy of any landlord gas-safety record we issue, as the law requires.

We do not ask for special-category information (such as health details) through this website. If you tell us about a vulnerability or medical need so we can prioritise a repair, for example no heating for an elderly resident, we use it only for that purpose and with your agreement. Please don't include unnecessary sensitive information in a job enquiry.

3. Why we use your information and our lawful basis

• Responding to your enquiry, visiting to quote and preparing a quote: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)).
• Carrying out booked work, appointment confirmations, invoicing and after-care: performance of our contract with you (Article 6(1)(b)).
• Gas-safety records, tax, accounting and other statutory records: compliance with our legal obligations (Article 6(1)(c)), including the Gas Safety (Installation and Use) Regulations 1998 and HMRC requirements.
• Where someone else books work for you, or you are a tenant at a property we service: our legitimate interest in carrying out the work safely and arranging access (Article 6(1)(f)).
• Optional renewal and service reminders by text or email: your consent (Article 6(1)(a)). You can withdraw it at any time — see section 7. We will never send these reminders without it.
• Keeping our systems secure, preventing fraud and handling complaints or legal claims: our legitimate interests (Article 6(1)(f)).

You need to give us your contact details and address to get a quote or book work. Without them we can't provide the service. Reminders are optional.

We do not use your information for marketing to third parties, we do not sell it, and we do not use automated decision-making or profiling that has legal or similarly significant effects on you.

4. Who we share your information with

We use the following service providers (“processors”) who handle information only on our instructions and under written data-processing terms:

• Vercel Inc. — website hosting;
• Supabase Inc. — our customer, job and document database, hosted in the European Union (Ireland);
• Resend (Plus Five Five, Inc.) — sending quote, booking, invoice and certificate emails;
• ClickSend — sending text messages, such as reminders you have agreed to;
• our email provider, accountant and IT support, where needed.

We may also share information with the Gas Safe Register, HMRC, our insurers, professional advisers, the police or courts where the law requires or allows it, and with a landlord or letting agent for work they have instructed at their property.

5. International transfers

Some of our providers are based in, or use support staff or sub-processors in, the United States or other countries outside the UK. Where personal information is transferred outside the UK, we rely on UK adequacy regulations (including the UK–US “data bridge” where the provider is certified) or the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for more information about these safeguards.

6. How long we keep information

• Enquiries that do not go ahead (no quote accepted): up to 2 years from our last contact, then deleted or anonymised.
• Quotes, invoices and payment records: 6 years after the end of the financial year they relate to, as required for tax and company records.
• Gas-safety records and certificates: at least 2 years as required by law, and normally 6 years from completion so we can deal with warranty questions and claims.
• Job and warranty records: 6 years from completion of the work.
• Emails and text messages we send you: 2 years, unless linked to a complaint or claim.
• Reminder consent records: for as long as you receive reminders, plus 2 years after you withdraw consent, as evidence that we respected your choice.
• Security logs of team sign-ins: 12 months.

If there is a complaint, claim or legal requirement, we may keep the relevant records for longer, only for as long as needed.

7. Your rights

Under UK data-protection law you have the right to:

• Access the personal information we hold about you and receive a copy;
• Rectification — have inaccurate or incomplete information corrected;
• Erasure — ask us to delete your information. We will delete or anonymise everything we are not legally required to keep, such as issued invoices and gas-safety records;
• Restriction — ask us to limit how we use your information;
• Object to processing based on our legitimate interests;
• Portability — receive information you gave us in a structured, machine-readable format;
• Withdraw consent for reminders at any time, by replying STOP to a text, replying to a reminder email, or contacting us. Withdrawing consent doesn't affect anything we did before you withdrew it.

To use any of these rights, contact us using the details in section 11. There is normally no charge. We will respond within one month; if your request is complex we may extend this by up to two further months and will tell you why. We may need to confirm your identity first.

8. Security

We protect personal information with appropriate technical and organisational measures. These include encrypted (HTTPS) connections, a password-protected staff area with protection against repeated password guessing, hashed passwords, encryption of stored credentials, private document storage, access limited to staff who need it, and a security log of sign-in activity. If a personal data breach is likely to put you at risk, we will notify the ICO within 72 hours and tell you without undue delay.

9. Cookies and third-party content

Our public website uses no advertising, analytics or tracking cookies. Our fonts and images are served from our own website, so simply visiting a page doesn't send your details to a third party. A single strictly necessary cookie is used only after a team member signs in to the protected staff area. See our Cookie Policy.

10. Children

Our services are for adults responsible for a property. We do not knowingly collect information directly from children.

11. Contact us and complaints

For privacy questions or to exercise your rights, email sarahlstannard17@gmail.com, call 07729 854111, or write to the Data Protection Lead, Brokehall Heating & Plumbing Ltd, 36 Arundel Way, Ipswich, IP3 8SG.

If you're unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.

12. Changes to this notice

We review this notice at least once a year and whenever our services or suppliers change. The date at the top shows when it was last updated.