Privacy Policy

Who we are

The data controller is JPF Plumbing Heating & Gas Ltd, a company registered in England and Wales (company number 09110431). Our VAT number is 216 6109 28.

Correspondence address: Granby Trading Estate: Unit 2, 15 Cambridge Rd, Charlestown, Weymouth DT4 9TJ
Registered office: 14a Albany Road, Weymouth, Dorset, DT4 9TH
Gas Safe Register: 564139
APHC (Association of Plumbing & Heating Contractors) membership: 12348147
Phone (Monday to Friday, 09:00–17:00): either 01305 774804 (office) or 07894 741143 (mobile) — for any enquiry, including urgent jobs. We do not provide an out-of-hours emergency service.
Email: info@jpfplumbing.co.uk

We do not have a dedicated Data Protection Officer. For any question about this policy or your personal information, contact us using the details above and mark your message for the attention of the management team.

Scope

This policy applies to information we process through our website at jpfplumbing.co.uk, when you contact us by phone or email, and when we deliver plumbing, heating, and gas services. We do not knowingly collect information about children through this website.

What personal information we collect

Depending on how you interact with us, we may process:

Website enquiry form: first name, last name, email address, optional phone number, your message, and hidden technical fields that tell us which page the form was sent from ( source-label, source-path).
Phone and email enquiries: whatever you choose to share when you call or write to us (for example name, address, contact details, and details of the job).
Customers and jobs: contact details, property and job information, records needed to provide quotations and carry out work, invoices and payment-related records, and (where you give us your mobile number) details needed to send service-related messages such as appointment reminders.
Photos of work: we may take photographs on site to document progress or completed work. We do not use the website to publish photos of people or personal belongings; images are focused on the work itself.
Website analytics (Umami): privacy-focused, aggregated statistics about visits (for example pages viewed and approximate location derived from anonymised network data — not full IP addresses stored for analytics in our default setup).

Why we use your information and lawful bases

We use personal information only where we have a lawful basis.

Contract and pre-contract: to respond to enquiries, provide quotes, schedule and carry out work, invoice, and manage the customer relationship.
Legitimate interests: to operate and secure our website; to understand aggregated use of the site (Umami); for limited internal business administration; and to keep records that a reasonable plumbing and heating business would maintain (always weighing your interests and rights).
Legal obligation: where we must comply with law (for example certain tax, health and safety, or regulatory requirements).

We use mobile numbers you provide to send essential notifications about bookings and work we are undertaking for you. We do not use those numbers for general marketing to people who are not customers, and we do not sell personal data.

Cookies and similar technologies

Our Astro site does not load third-party advertising or analytics cookies. Website analytics uses Umami, self-hosted on infrastructure provided through our hosting arrangement (see below), configured so that measurement is privacy-oriented (for example without storing full IP addresses for analytics and without relying on optional analytics cookies — so you typically do not need to accept analytics cookies for us to improve our understanding of traffic).

Our contact forms are processed through Netlify Forms. The form includes a hidden “honeypot” field to reduce spam (bots that fill every field are filtered). That mechanism does not rely on storing advertising cookies on your device.

Your browser may still store essential cookies or similar data needed for basic operation (for example session or security features). Our hosting provider may also use strictly necessary measures on its network; features such as Netlify Identity, password protection, or A/B testing can introduce additional cookies — we do not use those features on this public site unless we update this policy.

Who we share information with

We share personal information only when needed to run the business or meet legal duties. Categories of recipients include:

South Pier Media Ltd — website design, development, and ongoing technical support for this site. The Netlify account that hosts jpfplumbing.co.uk (including hosting and form handling) is held and administered by South Pier Media Ltd for JPF Plumbing Heating & Gas Ltd. South Pier Media may access technical or submission-related data when maintaining the site or infrastructure.
Netlify — provides the hosting and form-processing platform used under that arrangement (for example serving pages and delivering contact form submissions).
Advoco Accountants, Weymouth — accounting and tax services.
Tradify — job management / operational software. Tradify may process data on servers in the United States; where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK law (such as the UK International Data Transfer Agreement / Addendum or other valid transfer tools), as provided by the supplier.

We may also disclose information if required by law or to protect our legal rights.

How long we keep information

UK data protection law requires storage limitation: we must not keep personal information longer than we need for the purposes we collected it. ICO good practice is to know what you hold, why you hold it, and when it should be deleted: decide retention periods by purpose and type of information, document those decisions, review them periodically, and securely delete or anonymise data when it is no longer needed (unless we must keep it for a specific legal reason).

We keep personal information only as long as necessary for the purposes we collected it, including legal, accounting, and customer service needs. Indicative periods:

Enquiries that do not become jobs: typically up to around two years unless we need to keep them longer for a limited purpose (for example an ongoing dispute).
Customer and financial records: often up to six years where needed for tax and accounting rules and defending legal claims — aligned with common HMRC guidance for business records.
Analytics: aggregated statistics are retained according to our Umami configuration (short retention by default for many installs).

Exact retention can vary by record type. We review what we hold and delete or anonymise data when it is no longer needed, in line with the approach above.

Security

We take steps proportionate to the nature of our business to protect personal information. Measures include:

Website: this site is served over HTTPS (encrypted connection between your browser and our hosting).
Access: limiting access to business systems and accounts on a need-to-know basis.
Devices: using screen lock / passcodes on phones, tablets, and laptops used for business.
Accounts: using multi-factor authentication (“2FA” or “MFA”) on email, cloud storage, and operational software where the provider offers it.
Email: avoiding sending unnecessary sensitive personal information by email where a more secure channel or less data would do.
People: basic awareness of phishing and suspicious messages before clicking links or attachments.

No online transmission or storage is completely secure. If you have a concern about sending information to us, call us or ask what channel we prefer for sensitive details.

Your rights

Under UK data protection law you may have rights including: access, correction, erasure, restriction of processing, objection (where we rely on legitimate interests), and data portability (where processing is automated and based on contract or consent). You also have the right to lodge a complaint with the supervisory authority.

We do not use automated decision-making or profiling that produces legal or similarly significant effects for visitors or customers in the way described in UK GDPR Article 22.

To exercise your rights, contact us using the details at the top of this page. We may need to verify your identity before responding.

Complaints

If you have concerns about how we use personal information, please contact us first so we can try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

ico.org.uk/make-a-complaint/ · Telephone 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of the page will change when we do. Please review this page occasionally; material changes may also be highlighted on our website where appropriate.