Privacy Policy

Your privacy is important to us. When we process your personal data we comply with the UK GDPR and the Data Protection Act 2018, together with any other applicable data protection and privacy laws.

Your personal data includes all the information we hold that identifies you or is about you. More information about the types of personal data we process about you is set out below.

Everything we do with your personal data counts as processing it, including collecting, storing, amending, transferring and deleting it.

This privacy policy provides information about the personal data we process about you, why we process it and how we process it. It applies to our customers, visitors to our website, suppliers and business contacts as well as candidates contacting us in relation to job vacancies.

Our responsibilities

Thormer Solutions Ltd t/a heatly (“heatly”) is registered in England with registered company number 13849866 and address at Gtec House, Charcoals Way, Upper Wensleydale Business Park, Hawes, North Yorkshire DL8 3AU. Heatly is the controller of the personal data you provide.

If you have any questions about the ways in which we process your personal data, please contact us at info@heatly.com.

What data do we process about you?

1. Home owners

We are delighted that you have chosen to work with heatly in relation to the installation of a heat pump at your property (the “Property”).

Contact Data

As part of our relationship with you we will collect and process your name, email address, age / date of birth, residential address, the address of the Property (if different to your residential address) and your telephone number.

Video Data

As part of the heat pump installation process, a video will be taken of the Property. This video may be taken by you, by heatly, by a third party installation company or by an energy company.

It is possible that the video may capture additional personal data that we do not need, for example images of letters on tables or photographs of you within the Property (the “Accidental Data”). After your video has been uploaded to the heatly portal, we will promptly take steps to ensure any Accidental Data is erased using pixellation software. No Accidental Data will be used or further processed for any reason.

In most circumstances, the video will be automatically uploaded to the heatly portal as it is being filmed. If, however, the phone is not connected to the Internet when the video is filmed, the video will remain in temporary storage on the phone until there is an internet connection at which point the video will be automatically uploaded to the heatly portal and automatically deleted from the phone. While the video is stored on the device it will be within an area that is not readily accessible.

Payment Data

We may process your credit or debit card details solely for the purpose of taking payment from you for the services provided by us. Alternatively, we may outsource the provision of payment services to a third party provider.

We process your Contact Data, Video Data and Payment Data on the grounds of fulfilment of our contract with you, namely to confirm your order, to contact you about and provide you with our services and, if applicable, to arrange for your payment to be processed.

2. Website Visitors

Cookies

To help us improve our website and the products and services we offer, we collect data about the ways in which you use our website. This includes, for example, technical data such as your IP address, which is collected through our use of cookies. More information can be found in our cookie policy, available here.

Contact Us

If you choose to contact us via our website we will process your name, email address and any other personal data you provide as part of your message to us.

3. Suppliers, contacts and visitors to our premises

If you work for one of our suppliers or are one of our business contacts, we usually process your name and business contact details, such as your business email address and phone number and the address of your organisation. We process the information on the grounds of our legitimate interests in maintaining our relationship with you.

We use CCTV in and around our premises on the grounds of our legitimate interests for the purposes of crime prevention, detection and security. We retain CCTV images for 28 days after which it is permanently deleted unless it is relevant to a crime, incident or other event that has arisen in which case we will retain it for as long as required in relation to such crime, incident or event.

4. Owners, landlords, managers and maintenance workers

We process your personal data if you are one of our contacts for the property at which we are providing heat pump installation services. In this case, we process your name and contact details (usually email address and telephone number) on the grounds of our legitimate interests in fulfilling our installation contract.

5. Occupiers

If you are an occupier of a residence within an apartment block or similar building, we may obtain your name and contact details from the owner, landlord, manager or maintenance worker of the building. We process this information on the grounds of our legitimate interests in fulfilling our installation contract.

6. Candidates

If you apply for a job vacancy with us, or speculatively send us your CV, the personal data that we are likely to process about you includes:

• identity data such as your first name, middle names, last name, marital status, title, date of birth and gender;
• contact data such as your postal address, email address and telephone numbers;
• background data such as your education, career background and work experience;
• personal information such as your skills and qualities; and
• any other information that you include on any CV, application or covering letter you send to us.

We process your information on the grounds of our legitimate interests to determine whether or not we have a suitable vacancy for you. To the extent we need to process special categories of data about you (for example, to ensure our premises are suitably equipped for you if you attend for an interview), we will do so in accordance with our legal obligations. If you provide special categories of data to us which we have not requested, we will process it on the grounds of your consent because you have voluntarily provided the information to us.

Who will receive your personal data?

Your personal data is only transferred to the extent necessary. Recipients of your personal data may include:

• if you are a home owner, third party installers of the heat pump;
• if you are a home owner, the relevant energy provider;
• third party providers of IT support services;
• our hosted data centre;
• third party payment processors;
• third parties where you have given your consent to us provide the data to them;
• legal advisors to the extent they need to see your personal data to provide us with legal advice;
• third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy; and
• if you are a candidate, we may provide feedback to you via the recruiter or agency that recommended you to us.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

Your personal data may be accessible from outside of the EEA as a result of heatly using data centres located outside of the EEA. Any such transfers take place in accordance with either the EU standard contractual clauses or a UK international data transfer agreement.

If we have provided services to you in the EEA, your personal data will be transferred to heatly in the UK and processed in accordance with this privacy policy.

How long will we keep your personal data?

Where we reference a 7 year retention period below, we will delete your personal no later than the end of the relevant calendar year. For example, if you provide us with your personal data in July 2024 we will delete it before the end of December 2031.

1. Home owners

We will retain your personal data for no more than 7 years from the later of:

• the date we complete the provision of services to you; or
• if you have chosen to purchase a subscription from us to provide you with continued access to the 3D model of the Property, from the date your subscription ends either because it is cancelled by you or because you have failed to pay for your subscription in line with our terms and conditions; or
• the date of our last interaction with you.

We retain your data for a period of 7 years to enable us to deal with issues or queries you may have in relation to the services we have provided to you. After the end of the retention period, your personal data will be deleted or anonymised so that it is no longer personally identifiable. Your information will always be kept securely.

2. Website visitors

We will retain your personal data in accordance with the “Home owners” retention period set out above.

Cookies will be retained in accordance with the retention periods set out in our cookies policy.

3. Suppliers, business contacts and visitors to our premises

With the exception of installers and corporate clients, your personal data is retained for the duration of our relationship with you or the organisation for which you work. Please let us know if you leave the organisation or if your details change. If we receive notification from you or your organisation that you no longer work at that organisation, or if we no longer maintain a working relationship with your organisation, we will delete your information from our system.

If we are corresponding with you as a potential supplier, we will retain your details until we receive notification from you or your organisation that you no longer work at that organisation or for a period of 7 years from the date we no longer engage with the organisation for which you work.

If you are an installer or a contact from one of our corporate clients we will retain your personal data for a period of seven years from the date of our last interaction with you.

4. Building owners, landlords, managers and maintenance workers

We process your personal data for a period of seven years from the date of installation of a heat pump at the property for which you are owner, landlord, manager or maintenance worker.

If we are liaising with you but we do not install a heat pump at the property, we will process your personal data for a period of seven years from the date of our last interaction with you.

5. Occupiers

We process your personal data for a period of seven years from the date of installation of a heat pump at the property in which you reside.

If we are provided with your personal data but we do not install a heat pump at the property, we will process your personal data for a period of seven years from the date of our last interaction with the owner, landlord, manager or maintenance worker of the property or, if earlier, promptly after notification that you no longer reside at the property.

6. Surveys

If you have requested that we carry out a survey at your property, we will retain your personal data for a period of seven years from the date of the survey. If you subsequently choose to purchase services from us, we will retain your personal data in line with the relevant section set out above – this is likely to be either the “home owner” section or the “building owners, landlords, managers and maintenance workers” section.

7. Candidates

If you are successful, we will retain your personal data in line with our employee facing privacy policy, a copy of which will be provided to you. If you are unsuccessful, we will retain your application, CV and/or covering letter and any other personal data you provided to us for 6 months from the date we reach our decision in case any other suitable roles arise in which we think you may be interested, or in case you have any questions about our decision. After that date, your personal data will be permanently deleted or destroyed.

Marketing

If you are one of our customers or you have previously asked us to provide you with a quote, we may send you information and offers in relation to our services and products by email, post, SMS and phone call. We send this to you on the grounds of our legitimate interests, but you will always have the opportunity to unsubscribe.

If you submit a contact form on our website we will ask you if you would like to receive information from us and we will only send it to you if you agree.

If you ask us to, we will also send you information about products and offers from third parties, such as new tariffs that become available from our partner energy providers.

What are your rights?

You benefit from a number of rights in respect of the personal data we hold about you. We have summarised your rights below, and more information is available from the Information Commissioner’s Office website (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/). These rights apply for the period in which we process your data. There are certain caveats and exemptions to those rights which mean that in some circumstances you may not be entitled to exercise them, if we believe that is the case upon receipt of a request from you we will let you know.

Access to your data

You have the right to ask us to confirm that we process your personal data, as well as access to and copies of your personal data. You can also ask us to provide a range of information, although most of that information corresponds to the information set out in this fair processing notice.

Rectification of your data

If you believe personal data we hold about you is inaccurate or incomplete, you can ask us to rectify that information.

Right to be forgotten

In some circumstances, you have the right to ask us to delete personal data we hold about you.

Right to restrict processing

In some circumstances you are entitled to ask us to suppress processing of your personal data. This means we will stop actively processing your personal data but we do not have to delete it.

Data portability

You have the right to ask us to provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit the personal data to another data controller.

Right to object

You are entitled to object to us processing your personal data:

• if the processing is based on legitimate interests or performance of a task in the public interest or exercise of official authority;
• for direct marketing purposes (including profiling); and/or
• for the purposes of scientific or historical research and statistics.

We do not intend to use your personal data for scientific or historical research and statistics.

Automated decision making

Automated decision making means making a decision solely by automated means without any human involvement.

We do not carry out any automated decision making.

Your right to complain about our processing

If you think we have processed your personal data unlawfully or that we have not complied with GDPR, please get in touch with us so we can help. You can report your concerns to the supervisory authority in your jurisdiction. The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You can call the ICO on 0303 123 1113 or get in touch via other means, as set out on the ICO website - https://ico.org.uk/concerns/.