Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

ICO registration number: [CRAIG TO SUPPLY: ICO registration number]

All organisations that process personal data must pay a data protection fee to the Information Commissioner’s Office (ICO). Current annual fee tiers are £52 (micro organisations), £78 (small and medium organisations), and £3,763 (large organisations).

2. What Data We Collect

When you submit our quote request form, contact us by phone or email, or use our website, we may collect the following personal data:

We do not collect special category data (health, biometric, religious, political, or similar sensitive information). We do not process data relating to children.

3. Lawful Basis for Processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Legitimate interest — to respond to your quote enquiry, arrange a home survey, and provide the services you have requested. Our legitimate interest is providing accurate, relevant information about renewable energy solutions to people who have actively enquired.
• Consent — where you have opted in to receive marketing communications such as newsletters, offers, or follow-up information about solar panels, battery storage, or grants. You may withdraw consent at any time by emailing info@scottishenergyefficiency.co.uk or clicking the unsubscribe link in any marketing email.
• Legal obligation — where we are required by law to retain certain records (e.g. MCS certification documentation, financial records for HMRC).

4. Who We Share Your Data With

We share your personal data only where necessary to deliver the services you have requested. We never sell your data to third parties. Your data may be shared with:

• Home Heating Services (Scotland) Ltd (company number SC484353) — our MCS-registered installation partner who carries out surveys and installations. They receive your name, contact details, address, and property information to fulfil your enquiry.
• Zapier Inc. — a data processing platform used to route form submissions to our CRM. Zapier processes data on our behalf under a Data Processing Agreement and does not use your data for its own purposes. Zapier is certified under the EU–US Data Privacy Framework.
• Grant administrators — such as Home Energy Scotland or ECO4 providers, where you are applying for a grant and we submit the application on your behalf with your explicit consent.
• Website hosting and analytics — Netlify (hosting), Google Analytics (anonymised site usage data, with your cookie consent).

5. Data Retention

We keep your data only for as long as necessary:

When data reaches the end of its retention period, it is securely deleted from all systems. You may request earlier deletion at any time (see “Your Rights” below), subject to any legal obligations we are required to meet.

6. Your Rights Under UK GDPR

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your data where there is no compelling reason for continued processing.
• Right to restriction — Request that we limit how we use your data while a concern is resolved.
• Right to data portability — Request your data in a structured, commonly used, machine-readable format.
• Right to object — Object to processing based on legitimate interest, including direct marketing.

To exercise any of these rights, email info@scottishenergyefficiency.co.uk or call 0141 230 0198. We will respond within one calendar month.

7. Complaints

If you are unhappy with how we have handled your data, please contact us first and we will do our best to resolve the matter. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

8. Cookies

Our website uses only analytics cookies to understand how visitors interact with the site. We do not use marketing cookies, advertising cookies, or third-party tracking cookies.

Analytics cookies are only set after you give consent via our cookie banner. You can withdraw consent or change your preferences at any time through your browser settings. The website functions fully without analytics cookies.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or misuse. All data transmitted through our website is encrypted using TLS (HTTPS). Form submissions are transmitted securely and stored in access-controlled systems. We regularly review our security practices and update them as necessary.

10. International Data Transfers

Some of our data processors (such as Zapier and Google) are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including the use of Standard Contractual Clauses approved by the ICO and reliance on adequacy decisions or international data transfer agreements under UK GDPR.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this page periodically. Material changes will be communicated by email where we hold your contact details.

12. Contact Us

For any questions about this privacy policy, your personal data, or to exercise your rights, contact us at: