Privacy Policy

This Privacy Policy explains how [INSERT LEGAL ENTITY NAME], a company registered in England and Wales under company number [INSERT COMPANY NUMBER], with its registered office at [INSERT REGISTERED ADDRESS] ("PlumbGrade", "we", "us" or "our"), collects, uses and protects personal data in connection with the PlumbGrade platform (the "Service").

This Policy should be read alongside our Terms of Use, which governs use of the Service more generally.

The Service handles two different kinds of personal data, and we act in a different capacity for each:

• Account data — the name, email address, role and (for engineers) Gas Safe ID of the people who log in to use the Service on behalf of a PlumbGrade business ("Customer"), plus that Customer's own company and billing details. For this data, we are the data controller.
• End customer data — the records a Customer inputs into the Service about its own customers: names, addresses, contact details, inspection results, photographs, signatures, quotes and reports relating to the properties and people that Customer works with. For this data, the Customer is the data controller and we act only as a data processor, handling it solely to provide the Service on that Customer's instructions (see our Terms of Use).
• If you are a homeowner, landlord, letting agent or tenant whose details appear in the Service, your relationship is with the PlumbGrade business that carried out your inspection, quote or gas safety check — they control that data, and are the right people to contact about it in the first instance. We process it on their behalf and in accordance with their instructions.

Depending on how the Service is used, we (or a Customer, using the Service) collect:

• Account details: name, email address, password (stored hashed, never in plain text), role (admin/engineer), and Gas Safe registration ID where provided.
• Company details: company name, logo, trading domain, and — where a company chooses to be listed — public directory details such as service area and public contact number.
• Billing details: plan, subscription status and payment history. Card details themselves are entered directly with our payment processor, Stripe, and never pass through or are stored on our own servers.
• Customer directory and job records entered by a Customer: names, property addresses, email addresses, phone numbers, job type, and any notes recorded against them.
• Inspection and CP12 records: checklist responses, boiler details, appliance details, defect notes, photographs taken during a job, and customer/engineer signatures.
• Quote records: line items, parts and labour pricing, and the customer details a quote is addressed to.
• Technical data: log-in timestamps and basic technical information (such as IP address and browser type) generated automatically by using a web application, used for security and troubleshooting.
• Website analytics data: on our public website only (not inside the signed-in Service), Google Analytics collects information about how visitors use the pages — such as pages viewed, approximate location, device and browser type, and how you arrived at the site. See the Cookies section below.

We use personal data to:

• provide, operate and maintain the Service, including generating reports, certificates and quotes;
• create and administer accounts, and authenticate sign-ins;
• process subscription payments and manage billing, via Stripe;
• send service-related emails — for example a report or quote a Customer sends to their own customer via the Service, or account/billing notifications;
• provide customer support;
• maintain the security of the Service and investigate misuse; and
• comply with our legal obligations, such as tax and accounting record-keeping.

Where UK GDPR applies, we rely on the following legal bases: performance of a contract (providing the Service you've subscribed to), legitimate interests (keeping the Service secure, preventing misuse, and improving it), legal obligation (tax and accounting requirements), and, where applicable, consent (for example, optional marketing communications, which you can opt out of at any time).

We do not sell personal data. We share it only with the following categories of third party, each acting under a contract with us:

• Stripe — payment processing and subscription billing.
• Our database, authentication and file storage provider — hosting the Service's data and infrastructure.
• Resend — delivering transactional emails sent through the Service (for example, a report emailed to a customer).
• Google (Google Analytics) — measuring how visitors use our public website, as described in the Cookies section below.
• Professional advisers, regulators or law enforcement, where we are required to by law or to protect our rights.
• A buyer or successor, in the event of a merger, acquisition or sale of assets — subject to the same protections described in this Policy.

Some of the providers listed above may process personal data outside the UK or European Economic Area. Where that happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK's International Data Transfer Addendum or the provider's own adequacy/certification arrangements, to protect the data.

We retain personal data for as long as a Customer's account is active, and for a reasonable period afterwards to allow data export, resolve disputes, and meet our legal and accounting obligations, after which it is deleted or anonymised. A Customer can delete individual customer/job records from within the Service at any time (see the Terms of Use's Customer Content section).

Strictly necessary cookies: the Service uses cookies that are needed to keep you signed in and to operate securely (session/authentication cookies set by our authentication provider).

Analytics cookies: on our public website pages (the homepage, Home Buyer Health Check page, business directory, contact page, and the Privacy Policy and Terms of Use), we use Google Analytics, a web analytics service provided by Google, but only if you click "Accept" on our cookie banner — no analytics cookies are set or Google Analytics script loaded before then, or if you reject. We use it to understand how visitors find and use the site so we can improve it. Google Analytics sets cookies (typically named _ga and _ga_*) in your browser and collects information such as your IP address, pages viewed, approximate location, device and browser type, and referring website. Google Analytics is not used inside the signed-in Service, and we do not use it to collect the content of inspection, customer or job records. Google may process this data outside the UK; see International transfers above.

We do not use advertising cookies. You can change your choice at any time using "Cookie settings" in the site footer, you can control or block cookies in your browser settings, and you can also opt out of Google Analytics across all websites using the links below. For more on how Google uses data from sites that use its services, see Google's own explanation.

• Google Analytics opt-out browser add-on
• How Google uses information from sites or apps that use its services
• Google Privacy Policy

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls that restrict each Customer's data to that Customer's own users, and least-privilege access for our own staff. No system is completely secure, and we cannot guarantee absolute security, but we take reasonable steps to protect personal data against unauthorised access, loss or misuse.

If we are the controller of your personal data (see the "Whose data this covers" section above — broadly, your account data as a PlumbGrade user), UK data protection law gives you the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to erase your data, subject to any legal reason we may need to keep it;
• ask us to restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights over your own account data, email hello@plumbgrade.co.uk. If your query relates to data a PlumbGrade business holds about you as their customer (for example, details from an inspection or quote), please contact that business directly — we will support them in responding as their processor.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.

The Service is intended for use by trade businesses and their staff, not by children, and we do not knowingly collect personal data from children.

We may update this Policy from time to time, for example to reflect changes to the Service or to applicable law. Where changes are material, we will give reasonable advance notice, such as by email or an in-app notice, before they take effect.

Questions about this Policy, or requests relating to your personal data, can be sent to hello@plumbgrade.co.uk.