Legal
Privacy policy
What we collect, why, who we share it with, how long we keep it and what you can ask us to do about it. Our booking terms are in our terms & conditions.
Version 1.2 · Last updated 11 October 2026
1. Who we are
Heat Pump Biker is the trading name of Heat Pump Biker Limited, registered in England and Wales, company number 17135239. Registered office: 203 West Street, Fareham, Hampshire, PO16 0EN. VAT registration number 518305406.
We are the data controller for the personal information described in this policy. We are registered with the Information Commissioner's Office under registration reference ZC230343 and pay the data protection fee.
Contact for any question about your information:
- Email: info@heatpumpbiker.com
- Telephone: 0330 043 6253
- Post: the registered office above
We are not required to appoint a Data Protection Officer. Email is the fastest route.
2. What this policy covers
This policy applies when you:
- make an enquiry through our website, by telephone or by email;
- book a service, repair, call-out or survey;
- join, hold or leave a care plan;
- have work carried out at your property; or
- visit heatpumpbiker.com.
It sits alongside our Terms & Conditions.
3. What information we collect
Enquiries and bookings: name, email address, mobile number, property address and postcode, the service requested, the date and arrival window selected, and any information entered in the notes field.
Payments: amount, date, payment reference and whether the payment succeeded. We do not receive or hold card details or bank account details. These are handled by Stripe, our payment provider.
Quotes: the work quoted, the options and prices, the quote document, the date it was sent, and when you first open your quote link. We record that so we know you have received it.
Acceptance of our terms: the version of the terms displayed, the name typed, the date and time, the IP address and the browser identification string. This constitutes your electronic signature and the record of what was agreed.
Work carried out at your property: findings, work done, parts fitted, photographs and video of the work, an audio recording of the visit and the transcript produced from it, meter and serial numbers, and equipment and system details.
System history: service history, next service due date, guarantee and registration details, and installation notes.
Care plans: plan level, join date, anniversary, payment history and discounts applied.
Collected automatically on the booking page: IP address, and an approximate driving time from our base to your postcode, calculated from the postcode alone, to determine whether the property is within the area we cover.
Incomplete bookings: details already entered, retained so that one reminder can be sent with a link to resume.
Special category information. We do not request information concerning health, disability or any other special category. Where a customer volunteers such information because it affects the visit, we record only what is necessary to carry out the visit safely.
Children. Our services are sold to adults. This website is not directed at children and we do not knowingly collect information about anyone under 18.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Taking and managing your booking, holding your slot, issuing confirmations and changes | Contract |
| Taking payment, issuing refunds, recovering unpaid invoices | Contract; legitimate interests for debt recovery |
| Sending your quote, reminders while it is open, and booking, payment and balance reminders for quoted work | Contract, including steps you ask us to take before entering into one |
| Carrying out the work, maintaining the job record, producing your written report | Contract |
| Operating your care plan — collecting payment, applying discounts, service-due reminders, price change notices | Contract |
| Maintaining your service history and contacting you when your next service falls due | Contract; legitimate interests |
| Registering equipment with its manufacturer to validate your product guarantee | Legitimate interests (section 7) |
| Photographing, filming and audio-recording work for the job record, for report production and for the safety of both the customer and a lone engineer | Legitimate interests (sections 5.1 and 5.2) |
| Publishing photographs and video of our work for marketing | Legitimate interests, subject to the opt-out in section 5.1 |
| Recording telephone calls | Legitimate interests (section 5.3) |
| Sending one reminder where a booking is started but not completed | Legitimate interests |
| Sending occasional marketing about our services to enquirers and customers | Legitimate interests, within the soft opt-in permitted by PECR (section 8) |
| Maintaining and filing accounting and VAT records | Legal obligation |
| Preventing and investigating fraud, and rate-limiting the booking page | Legitimate interests |
| Obtaining advice from our accountant, insurer or solicitor | Legitimate interests |
Where we rely on legitimate interests, we have assessed whether the processing is fair and whether it exceeds what you would reasonably expect. You may object to any of it — see section 11. We will stop unless we have compelling grounds not to, and we will give those grounds.
Automated decisions. We do not take decisions about you by automated means producing legal or similarly significant effects. The driving-time check on the booking page determines only whether a property falls within our service area, and a property assessed as outside it may still be submitted for review by a person.
5. Photographs, video and recordings
5.1 Photographs and video of the work
We photograph and film our work as a matter of course. The material forms part of the written report supplied to you, and we publish it on our website, on social media and on our video channels.
Photography and filming of the work is a condition of us carrying out work, and is confirmed separately at the point of booking. It is how the job record and the report are produced.
Publication for marketing is not a condition, and you may opt out. At the point of booking you may tick a box to tell us not to use material from your job in our marketing. There is no charge, no consequence and no follow-up. You may also opt out at any time afterwards by emailing info@heatpumpbiker.com.
What we photograph is the equipment and the work — the heat pump, the cylinder, the pipework, the controls and the standard of the installation. Because a heat pump is fixed to a building, part of your property will usually appear behind it. In most cases that is a section of the rear elevation, which rarely makes a property recognisable.
We do not publish your name, your address, or your personal possessions.
Where an image would make a property recognisable, we apply two additional safeguards:
- We do not publish it alongside a precise location. We may identify the county or region. We do not identify the town, village or street.
- We ask you on site before photographing the property as a whole — a wide shot of the front of a house, for example — in addition to the opt-out at booking.
Where any person is identifiable in material we intend to publish, we obtain that person's agreement before using it.
Removal. You may ask us to stop using material from your job at any time, by email to info@heatpumpbiker.com. We will remove it from every channel we control and use reasonable endeavours to secure its removal elsewhere. We cannot guarantee removal of material that has been copied, shared or republished by others, or that persists in a search engine cache or third-party archive.
Opting out or requesting removal has no effect on the work we carry out for you, on the price you pay, or on our willingness to attend in future.
Retention: photographs and video form part of your job record and are retained accordingly — see section 10.
5.2 Audio recording of visits
We audio-record our visits, from arrival to departure. Recording is a condition of us carrying out work and is confirmed at the point of booking. Recordings are not published.
We record for two reasons:
- Accuracy of the job record and report. The recording ensures the report reflects what was found, what was done, and what was requested or agreed on site.
- Protection of both parties. Our engineer works alone in a customer's home. A recording provides an accurate account for both of us if a question later arises about what was said or done.
Recordings are not sent to any third party. They are transcribed by software we operate on our own systems. The audio does not leave our infrastructure.
Retention: 12 months, then deletion. The transcript is retained with the job record. Where a recording relates to a complaint or dispute, it is retained until the matter is concluded.
5.3 Recording of telephone calls
We do not record telephone calls at present. Calls to and from our business number may be recorded in future, for accuracy of record. If we introduce it, you will be informed at the start of any recorded call, and if you would prefer the call not to be recorded you can tell us and we will conduct the matter by email instead.
Were recording to be introduced, recordings would be held by our telephone provider, Air Landline, and deleted by them after 30 days. Where a call recorded something agreed, or related to a dispute, we would download it and retain it with the job record for 12 months, or until the dispute was concluded, whichever was later. This section will be updated to the present tense on the day recording is switched on.
6. Who we share your information with
We do not sell your information.
We share it only with organisations that assist us in operating the business, and where the law requires it.
Processors acting on our instructions
| Organisation | Purpose | Location |
|---|---|---|
| Stripe (Stripe Payments UK Ltd and group companies) | Card and Direct Debit payments, care plan subscriptions, refunds. Holds card and bank details. | UK, EU, USA |
| Hostinger (Hostinger International Ltd) | Website hosting and the database holding customer and booking records | EU |
| Brevo (Sendinblue SAS) | Delivery of booking confirmations, reminders and other emails | EU (France) |
| Google (Google Ireland Ltd, Google LLC) | Email, calendar and documents; the diary; the job sheet; postcode-to-driving-time lookup | EU, USA |
| Air Landline | Business telephone line, and call recordings once recording is enabled | UK |
| FreeAgent | Accounting records, invoices and payment reconciliation | UK |
| Spruce | Heat loss calculations and quotations, where an installation quotation is requested | UK |
postcodes.io, used to convert a postcode to a location for the service-area
check, receives the postcode only.
Transcription is not on this list. The software that transcribes visit recordings runs on our own systems. No third party receives your recordings.
Independent controllers
These organisations determine their own purposes, and their own privacy policies apply.
- Equipment manufacturers — Vaillant Group UK Ltd, Mitsubishi Electric, Stiebel Eltron and others, for guarantee registration (section 7).
- Benchmark, where a manufacturer notifies them of an installation.
- Our accountant, insurers and solicitors, where a job, claim or account requires it.
- A debt collection agency or the courts, where an account is unpaid and recovery is necessary.
- Any body the law requires — HMRC, a regulator, or under a court order.
Transfers outside the UK
- EU countries (Hostinger, Brevo, Google's Irish entity) are covered by a UK adequacy decision.
- The USA (Stripe's and Google's US entities) is covered by the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, and otherwise by the International Data Transfer Addendum to the standard contractual clauses.
7. Registering equipment with its manufacturer
Where equipment must be registered with its manufacturer for the product guarantee to be valid, we register it on your behalf. This requires us to provide the manufacturer with your name, address, contact details and the installation details.
Vaillant. Registration of a Vaillant product requires us to share your personal information with Vaillant Group UK Ltd. Vaillant use it to record the guarantee, issue guarantee documentation and send annual service reminders so the guarantee remains valid. Vaillant also notify Benchmark of the installation where applicable, and may contact you regarding your product or a recall. Vaillant's privacy policy is published at www.vaillant.co.uk. Their Data Protection Officer may be contacted at The Data Protection Officer, Vaillant Group UK Limited, Nottingham Road, Belper, Derbyshire, DE56 1JT.
Other manufacturers. Equivalent arrangements apply to Mitsubishi Electric, Stiebel Eltron and others. We will identify the recipient and direct you to their privacy information.
If you do not wish your details to be shared, tell us before installation. We will comply, but the guarantee cannot be registered without it and you will not have the benefit of it.
8. Emails, messages and marketing
Messages about your booking, your job and your care plan are part of the service. We send them by email, text message or WhatsApp. Confirmations, changes to your visit, reminders that we are coming, service-due reminders, reports, invoices and annual price notices are not marketing and are sent for as long as you are a customer.
Marketing is separate. Where you have enquired or purchased from us, we may send occasional marketing about our services by email, text message or WhatsApp. Every marketing message has an easy way to stop it: an unsubscribe button in an email, or reply STOP to a text or WhatsApp. You can also email info@heatpumpbiker.com to be removed.
We do not sell your details and we do not purchase marketing lists.
8.1 WhatsApp
Our published number, 0330 043 6253, is a WhatsApp Business number. You can message us on it, and we may also message you on it about your enquiry, your booking, your job or your care plan: arranging or confirming a visit, letting you know we are on the way, sending a photograph, or answering a question. Where you have contacted us privately about work, we may reply from the business number.
Your message, your WhatsApp profile name and your number are handled by Meta Platforms Ireland Limited under their own privacy policy as well as by ours. Where a message concerns a job, we copy the relevant details into your job record.
We may also use WhatsApp for occasional marketing, as described in section 8. You can stop it at any time.
If you would rather we did not use WhatsApp, tell us and we will use email or the telephone instead.
9. Cookies and the website
Our website uses only the cookies necessary for it to function — retaining your position in a booking, and maintaining a secure session during payment. These are strictly necessary cookies and do not require consent.
We do not use advertising cookies and we do not track you across other websites.
Stripe sets its own cookies on the payment page, to process payment and detect fraud. Stripe's privacy policy applies to those.
10. Retention
| Information | Retained for | Basis |
|---|---|---|
| Customer record, job records, reports, photographs | 6 years from the last work carried out | HMRC record-keeping; the limitation period for a claim concerning our work |
| Care plan records, payment history, discounts applied | 6 years from the end of the plan | As above |
| Accounting and VAT records | 6 years from the end of the financial year | HMRC |
| Acceptance of terms — typed name, timestamp, IP address, terms version | 6 years from the work | Evidence of what was agreed; must outlast any claim |
| Audio recording of a visit | 12 months, or until a related complaint or dispute is concluded | The recording is the evidence of what was said. A transcript is a derived document and is not equivalent for that purpose |
| Transcript of a visit | 6 years, with the job record | Part of the job record |
| Telephone recordings | 30 days at our provider; 12 months for any we download, or until a related dispute is concluded | As above |
| Raw video footage of a job | 6 months | Raw 1080p footage is approximately 130MB per minute. The finished cut and the report stills are retained permanently |
| Published photographs and video | Until removal is requested | |
| Enquiries and incomplete bookings that did not become a job | 24 months from last contact | Seasonal re-engagement |
| Booking-page security records (failed verification attempts) | 24 hours | |
| Marketing list entry | Until you unsubscribe or ask us to stop |
On expiry, information is deleted or anonymised so that it no longer identifies you.
11. Your rights
You may:
- Request a copy of the information we hold about you.
- Request correction of information that is inaccurate or incomplete.
- Request erasure. We will comply where we are able. We cannot erase records we are required to retain, such as accounting records, or records required to defend a claim.
- Object to processing carried out on the basis of legitimate interests. This includes our use of photographs and video of your job, and marketing. You may object to marketing at any time and we will stop. Objection has no effect on the service we provide.
- Request restriction of processing while a dispute concerning it is resolved.
- Request portability of information we hold on the basis of a contract with you or your consent.
- Withdraw consent, where consent was the basis on which information was obtained.
To exercise any of these rights, email info@heatpumpbiker.com. We will respond within one month. There is no charge for this. We may require you to confirm your identity before personal information is released.
12. Security
Records are held in a password-protected database on secure hosting, and in our Google Workspace account, which is protected by two-factor authentication. Payment details are not held on our systems.
Access is limited to those who require the information to carry out the work.
Where a breach occurs, we will notify the Information Commissioner's Office within 72 hours where the law requires it, and will notify you directly where the breach presents a high risk to you.
13. Complaints
Please raise any concern with us first — info@heatpumpbiker.com or 0330 043 6253.
If you remain dissatisfied, you may complain to the Information Commissioner's Office:
- ico.org.uk/make-a-complaint
- 0303 123 1113
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Raising a concern with us first does not affect your right to complain to the ICO.
14. Changes to this policy
We update this policy when our use of information changes. The current version is always on this page, with its version number and date, and it is shown to you when you book. We do not send a notice to every customer each time it changes.
Heat Pump Biker Limited, company number 17135239. VAT registration number 518305406.
Heat Pump Biker Limited, registered in England and Wales, company number 17135239. VAT registration number 518305406.