Privacy Policy — Reading Heat Pumps

Effective date: [PRIVACY_EFFECTIVE_DATE_TBD] (= site launch date)

Last updated: [PRIVACY_LAST_UPDATED_TBD] (= site launch date)

Summary

Reading Heat Pumps is a matching service that connects Reading-area homeowners with MCS-certified air source heat pump installers — see About for the full description of how the service works and Terms for the legal framework. We collect the information you provide when you submit our enquiry form, share it with one installer in our network for the purpose of responding to your enquiry, and retain it for as long as needed to support the enquiry and any follow-up. We do not sell your data, do not share it with anyone outside our installer network for marketing, and do not use tracking cookies.

The rest of this page is the detail.

Data controller

The data controller for personal data processed through this site is:

Robert Alsop Individual Entrepreneur (Georgian: მეწარმე) Tbilisi, Georgia Tax ID: [TAX_ID_TBD] Registered: [REG_DATE_TBD] Contact: [email protected]

Because the data controller is established outside the UK, an appointed UK representative serves as the local contact point for UK data subjects and the Information Commissioner’s Office, as required by Article 27 of the UK GDPR.

UK representative: [UK_REP_DETAILS_TBD] — appointment in progress; details to appear here at appointment.

You can address all data-protection enquiries either to the data controller ([email protected]) or to the UK representative once appointed.

What data we collect

We collect the following categories of personal data through this site:

Form enquiries

When you submit the enquiry form on any page of this site — typically via the contact page or the form on the homepage — we collect:

Name (required) — to address our reply to you.
Email address (required) — to reply to your enquiry.
Your enquiry message (required) — the description you provide.
Phone number (optional) — if you provide it, the matched installer will use it to call you back.
Postcode (optional) — if you provide it, we use it to confirm you fall within the installer’s service area before routing.
Source URL and UTM parameters (technical, automatic) — the page you submitted from and the marketing-source tags, if present. Used to understand which pages generate enquiries.
IP address (technical, automatic, transient) — logged briefly for fraud-prevention purposes (to block automated/bot submissions); not stored as part of the enquiry record beyond this purpose.

Information we do NOT collect

We do not use analytics cookies. The site uses Cloudflare Web Analytics, which is cookieless and does not track individual visitors. No third-party analytics (Google Analytics, Meta Pixel, or similar) are deployed on this site.
We do not deploy advertising cookies, retargeting pixels, or any cross-site tracking.
We do not collect financial information (we do not handle payments — the installer you are matched with handles any commercial relationship directly).
We do not collect special-category data under UK GDPR (health, biometric, ethnic, etc.) — your enquiry should not need to include any of this; if you do include it in a free-text field, we will redact it before routing.

Why we process your data (lawful basis)

We process your data on the following lawful bases under UK GDPR:

Consent (Article 6(1)(a)) — by submitting our enquiry form, you provide clear consent for us to use the information you give us for the purpose of routing your enquiry to an installer in our network. You can withdraw consent at any time by emailing [email protected]; withdrawal does not affect the lawfulness of any processing carried out before withdrawal.

Legitimate interests (Article 6(1)(f)) — we briefly log IP addresses on form submissions to prevent automated/bot submissions. We assess this as a clear-cut legitimate interest of preventing site abuse, with minimal impact on data subjects (IP not retained as part of the enquiry record).

We do not process your data for any other purpose. We do not use it for direct marketing, profiling, automated decision-making, or any purpose other than the one you submitted it for.

We share your enquiry data with:

One installer in our Reading-area network, for the purpose of responding to your enquiry. The selection of which installer is governed by our methodology and depends partly on which of the eight Reading-area neighbourhoods we cover your property falls in. Enquiries are not broadcast to multiple installers and not shared with installers outside our vetted pool. Once your enquiry has been routed, the installer becomes responsible for handling any follow-up communication with you; their data-handling practices are governed by their own privacy policies.

We use the following data processors who handle data on our behalf:

Cloudflare, Inc. (United States) — hosts the website, processes form submissions through Cloudflare Workers, and provides cookieless web analytics. Cloudflare is a GDPR-adequate processor under standard contractual clauses. See Cloudflare’s privacy policy.
Google LLC (United States) — provides the Google Sheet that stores enquiry records, accessed via Google Sheets API by our Cloudflare Worker. Google is a GDPR-adequate processor under standard contractual clauses. See Google’s privacy policy.

We do not share your data with any other parties. We do not sell your data, ever, to anyone, for any purpose.

International data transfer

Because the data controller is established in Tbilisi, Georgia, and the processors named above are established in the United States, your personal data is transferred outside the United Kingdom in the course of normal processing.

Georgia is not currently the subject of a UK adequacy decision under UK GDPR Article 45. United States transfers to the processors named above are made under the EU-US Data Privacy Framework where applicable, supplemented by Standard Contractual Clauses (the UK Addendum to the EU SCCs as approved by the ICO).

If you have specific concerns about the international transfer arrangements, please contact [email protected].

How long we keep your data

We retain personal data only as long as necessary for the purpose for which it was collected:

Form enquiry records — 24 months from the date of your last interaction with us. After 24 months, records are deleted from the enquiry store.
Source URL / UTM / IP records — held only for the duration of fraud-prevention validation and operational analytics; the IP-address element is not retained beyond initial submission.

We may retain anonymised aggregate data (e.g., “how many enquiries arrived in a given month from a given page”) for longer, for the purposes of understanding site performance, but no individually identifiable data is retained beyond the periods above.

Your rights

Under UK GDPR you have the following rights in respect of your personal data:

Right of access — you can ask us for a copy of the personal data we hold about you.
Right to rectification — you can ask us to correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”) — you can ask us to delete your personal data, subject to certain limitations.
Right to restrict processing — you can ask us to stop processing your data while we consider another request.
Right to data portability — you can ask us to provide your data in a structured, commonly-used, machine-readable format.
Right to object — you can object to our processing of your data on grounds of legitimate interests.
Right to withdraw consent — where processing is based on consent (the routine case for this site), you can withdraw consent at any time.
Right to lodge a complaint — you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk if you are unhappy with how we have handled your data.

To exercise any of these rights, email [email protected]. We will respond within one month, as required by UK GDPR. There is no charge for exercising these rights, except in cases where requests are manifestly unfounded or excessive.

Cookies and similar technologies

This site uses essential cookies only. Specifically:

Cloudflare may set short-lived security cookies (e.g., for bot detection or rate limiting). These are essential for site security and operation and are not used for tracking or advertising.

The site does not use:

Analytics cookies (Cloudflare Web Analytics is cookieless).
Advertising or retargeting cookies.
Social-media tracking pixels.
Third-party tracking of any kind.

Because we use no non-essential cookies, this site does not display a cookie consent banner. If we change our approach in the future, this policy will be updated accordingly and an appropriate consent mechanism added.

Changes to this policy

We review this privacy policy periodically and may update it to reflect changes in our processing activities, our processor relationships, or applicable law. The “Last updated” date at the top of this page tells you when the current version took effect.

If we make material changes, we will indicate the nature of the changes here. Continued use of the site after an update constitutes acceptance of the updated policy; if you do not agree with a change, you can email [email protected] to request deletion of your data.

Contact

For any privacy-related question, request, or concern:

Email: [email protected] Data controller: Robert Alsop, Individual Entrepreneur, Tbilisi, Georgia (Tax ID [TAX_ID_TBD]) UK GDPR Article 27 representative: [UK_REP_DETAILS_TBD]

If we cannot resolve your concern, you may complain to the UK Information Commissioner’s Office at ico.org.uk.