Privacy Notice

Version 1.0 · July 2026

This Privacy Notice explains how Best Choice Plumbing Limited collects, uses, stores, and shares the personal data we hold about you. It applies whenever you contact us, request a quotation, subscribe to one of our service plans, or visit our website. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. About this Privacy Notice

1.1 Who we are

Best Choice Plumbing Limited is the “data controller” for the personal data described in this Notice. That means we decide what personal data we collect about you, why we collect it, and how it is used.

1.2 When this Notice applies

This Notice applies whenever you:

(a) request a quotation, book a service, or engage us to carry out work at your property;

(b) subscribe to our Annual boiler service and plumbing package or any other recurring service we offer;

(d) contact us by telephone, email, or via any form on our website;

(e) visit our website at https://bestchoiceplumbing.co.uk.

1.3 Other documents that apply alongside this Notice

This Notice should be read alongside:

(a) our Cookie Policy, which explains how we use cookies and similar technologies on our website;

(b) the Terms and Conditions for any service you have engaged us to provide (including our general Service Terms and Conditions and, where applicable, our Annual boiler service and plumbing package Terms and Conditions).

2. The personal data we collect

2.1 Data you give us directly

When you contact us, request a quotation, sign up for a service, or use any form on our website, you may provide us with:

(a) Identity data — your name and (for landlords) the trading name under which you let property;

(b) Contact data — your postal address, email address, and telephone number(s);

(c) Property data — the address at which work is to be carried out, the make and model of your boiler, the condition of your heating system, and any access information you provide;

(d) Payment data — for plan subscribers, the bank account details required to set up a Direct Debit (we do not see your full bank details; these are collected directly by GoCardless on our behalf);

(e) Referral data — where you refer a friend or family member to us, the name, telephone number, and email address of the person you are referring, together with confirmation that you have their consent to share these details;

(f) Communication data — the content of any messages, emails, or notes you send us, and our records of telephone calls or visits.

2.2 Data we collect automatically when you use our website

When you visit our website, we automatically collect certain technical data:

(a) device and connection information (such as your IP address, browser type, and operating system);

(b) usage information (such as the pages you visit and how long you spend on them);

Most of this data is collected via cookies and similar technologies — see our Cookie Policy for full details.

2.3 Data we receive from third parties

We may receive personal data about you from:

(a) GoCardless, which confirms successful Direct Debit set-up, payment status, and any failed collections;

(b) people who refer you to us as part of our referral scheme, with your consent;

3. How we use your personal data and our lawful bases

Under UK GDPR, we must have a “lawful basis” for processing your personal data. The bases we rely on are set out below alongside the purposes for which we use the data.

3.1 To deliver the services you have requested (lawful basis: performance of a contract)

(a) preparing quotations and estimates;

(b) scheduling and carrying out work at your property;

(c) operating your Annual boiler service and plumbing package, including booking annual service visits, attending callouts, and issuing Landlord’s Gas Safety Certificates (CP12s);

(d) collecting payment, including via GoCardless Direct Debit;

(e) issuing invoices, receipts, and warranty confirmations;

(f) responding to your enquiries and providing aftercare.

3.2 To meet our legal and regulatory obligations (lawful basis: legal obligation)

(a) maintaining accounting and tax records as required by HMRC;

(b) maintaining Gas Safe Register records and Landlord’s Gas Safety Certificates as required by the Gas Safety (Installation and Use) Regulations 1998;

(c) reporting incidents under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) where applicable;

(d) responding to lawful requests from law enforcement, regulators, or our insurers.

3.3 To run and improve our business (lawful basis: legitimate interests)

(a) keeping records of the work we carry out, including for warranty and liability purposes;

(b) administering the referral scheme and applying Referral Credits to subscriber accounts;

(d) understanding which pages of our website are most useful to visitors;

(e) seeking feedback on the work we have carried out;

(f) detecting and preventing fraud or misuse of our services;

(g) defending or pursuing legal claims.

Where we rely on legitimate interests, we have considered your rights and freedoms and concluded that our processing does not override them. You have the right to object — see clause 7 below.

3.4 Marketing communications (lawful basis: consent)

Where you have opted in, we may send you marketing communications about our services, special offers, and seasonal tips. You may withdraw consent at any time by clicking “unsubscribe” in any marketing email, or by contacting us using the details in clause 9.

Service communications about your Plan or about work we have carried out (such as appointment reminders, callout updates, and your annual CP12 renewal) are not marketing and will be sent regardless of marketing preferences, on the basis of performing our contract with you.

4. Who we share your personal data with

4.1 Our engineers and contractors

Personal data necessary to carry out work at your property is shared with the Gas Safe registered engineer assigned to your job. All engineers are required to handle your data confidentially and in accordance with this Notice.

4.2 Third-party processors

We use a small number of trusted third parties to process personal data on our behalf. Each of them is bound by a written agreement that limits how they may use your data and requires them to keep it secure.

(a) GoCardless Limited (United Kingdom) — Direct Debit collection. GoCardless handles your bank details directly under its own privacy notice.

(b) ivy.mayhem GmbH, trading as Deftform (Germany) — secure form submission delivery and storage. We use Deftform to receive enquiries, plan onboarding details, and referrals submitted through our website.

(c) Google LLC (United States) — Google Workspace for email and document management, Google Sheets for record-keeping of customer enquiries and Annual boiler service and plumbing package Terms and Conditions acceptance, and Google Analytics / Google Tag Manager for understanding website usage (see our Cookie Policy).

4.3 International transfers

Where your data is processed outside the United Kingdom, we make sure that an appropriate transfer safeguard is in place. For Deftform (Germany) we rely on the UK’s adequacy decision in favour of the European Union under the UK GDPR. For Google LLC (United States) we rely on the UK Extension to the EU–US Data Privacy Framework and, where required, Standard Contractual Clauses adopted by the Information Commissioner’s Office.

4.4 Other sharing

We may also share your personal data with:

(a) our accountants and other professional advisers, where reasonably necessary for them to advise us;

(b) our insurers, where reasonably necessary to handle a claim, complaint, or potential liability;

(d) a purchaser of our business, or part of it, in the event of a sale or restructuring, subject to appropriate confidentiality undertakings.

We do not sell your personal data to third parties.

5. How long we keep your personal data

We keep your personal data only for as long as we need it for the purposes set out in this Notice, after which it is securely deleted or anonymised. The following retention periods apply:

(a) Enquiries that do not lead to engagement — up to 12 months from the date of the last contact;

(b) Records of services carried out (including job sheets, photographs taken with consent, and warranty records) — six years from the end of the relevant tax year, in line with HMRC requirements;

(c) Landlord’s Gas Safety Certificates and related records — at least two years, in line with the Gas Safety (Installation and Use) Regulations 1998, and longer where we have an ongoing relationship with the landlord;

(d) Annual boiler service and plumbing package subscription records (including the audit log of Terms and Conditions acceptance) — for the duration of your Plan plus six years from cancellation, in line with HMRC requirements;

(e) Marketing consent records — until you withdraw consent or until 36 months from the last engagement, whichever is sooner;

(f) Website usage data collected through cookies — see our Cookie Policy.

Where we are required to keep certain records for longer to meet a legal obligation or to defend a legal claim, we may extend these periods. In all cases, we will only keep data for as long as is necessary.

6. Security of your personal data

We take the security of your personal data seriously. The measures we have in place include:

(a) access controls and password protection on all systems holding your data;

(b) encryption of data in transit between you and our website, and between our systems and our processors;

(d) staff training on data protection responsibilities;

(e) written agreements with all our processors requiring equivalent security measures.

No system can be guaranteed to be 100% secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours, and where required by law we will notify you directly.

7. Your rights under UK GDPR

You have a number of rights in relation to your personal data. Most rights are not absolute and may be limited where we have a legal basis to refuse the request. The rights are:

(a) the right to be informed — through this Notice;

(b) the right of access — to ask us for a copy of the personal data we hold about you;

(d) the right to erasure — to ask us to delete data where we no longer have a lawful basis to hold it;

(e) the right to restrict processing — to ask us to pause processing in certain circumstances;

(f) the right to data portability — to receive your data in a structured, commonly used, machine-readable format;

(g) the right to object — to processing carried out on the basis of legitimate interests or for direct marketing;

(h) rights in relation to automated decision-making — we do not make decisions about you using purely automated means.

To exercise any of these rights, please contact us using the details in clause 9. We will respond within one month of receiving your request. There is normally no charge.

8. Cookies and website tracking

Our website uses cookies and similar technologies for essential functions, performance measurement, and (with your consent) tagging. Full details are in our Cookie Policy. You can manage your cookie preferences at any time using the cookie banner that appears on our website.

9. How to contact us

If you have any questions about this Privacy Notice or about how we handle your personal data, or you wish to exercise any of your rights, please contact us using the details below:

By email: dan@bestchoiceplumbing.co.uk

By telephone: 01792 677 451

By post: Best Choice Plumbing Limited, 8 Station Road, Llanelli, Carmarthenshire, Wales, SA15 1AL

We do not currently have a statutory obligation to appoint a Data Protection Officer. Day-to-day data protection matters are handled by Dan Macmillan.

10. How to complain

If you are not satisfied with how we have handled your personal data, please tell us first using the contact details in clause 9 so we have an opportunity to put things right.

If you remain unsatisfied, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator:

Website: https://ico.org.uk

Telephone: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

More information about complaints relating to our services generally is set out in our Complaints Policy.

11. Changes to this Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, new services we offer, or changes in the law. The most current version is always available on our website. Where we make material changes that affect how we use your data, we will notify Annual boiler service and plumbing package subscribers by email and update the version number and date at the top of this Notice.