Core Plumbing + Heating

Privacy Policy

Last updated:

1. Who we are

Core Plumbing + Heating is a Gas Safe registered plumbing and heating business based in Plymouth, Devon. Our registered address is Carroll Road, Crownhill, Plymouth, PL5 3RZ.

We are the data controller for the personal information we collect through this website and in the course of providing our services. If you have any questions about how we handle your data, please contact us:

We are not required to appoint a Data Protection Officer, but we take our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 seriously.

2. What information we collect

We may collect and process the following categories of personal data:

Information you give us directly

  • Your name
  • Your phone number
  • Your email address
  • Your property address (where relevant to a job)
  • The nature of your enquiry or the work required
  • Any other information you choose to include in your message or provide during a job

Information collected automatically

When you visit our website, our hosting platform may collect standard technical data such as your IP address, browser type, and pages visited. This is used solely for security and operational purposes and is not used to identify you personally.

We do not use cookies for tracking, profiling, or advertising purposes. No third-party analytics or advertising cookies are set by this website.

Special category data

We do not intentionally collect any special category data (such as health information, ethnicity, or religion). Please do not include such information in your enquiries unless it is strictly necessary for the work you are requesting.

3. How we use your information

We use the personal data we collect for the following purposes:

  • To respond to your enquiry and provide you with a quote
  • To arrange and carry out plumbing, heating, or heat pump installation work at your property
  • To issue invoices and process payments
  • To follow up on completed work, including warranty and guarantee matters
  • To comply with our legal obligations (e.g. Gas Safety Regulations, HMRC record-keeping)
  • To process applications for the Boiler Upgrade Scheme (BUS Grant) where applicable

We will not use your information for direct marketing without your explicit consent, and we will never sell your personal data to third parties.

4. Legal basis for processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

  • Contract (Article 6(1)(b)): Processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract (e.g. providing a quote or carrying out work).
  • Legal obligation (Article 6(1)(c)): Processing is necessary to comply with a legal obligation, such as Gas Safety Regulations, tax record-keeping,.
  • Legitimate interests (Article 6(1)(f)): Processing is necessary for our legitimate interests in running our business and responding to enquiries, provided those interests are not overridden by your rights and interests.

Where we rely on legitimate interests, you have the right to object to that processing — see Section 8 for details.

5. How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this policy:

  • Enquiries that do not result in a job: up to 12 months, then securely deleted.
  • Customer and job records: up to 6 years from the date of the last transaction, in line with HMRC requirements and our 12-month workmanship guarantee period.
  • Gas Safety records: as required by law (typically 2 years for Gas Safety certificates).
  • BUS Grant application records: for the duration required by Ofgem and the scheme rules.

After the applicable retention period, records are securely deleted or anonymised.

6. Who we share your data with

We do not sell or share your personal data with third parties for their own marketing purposes. We may share data with the following categories of recipient, only to the extent necessary:

  • Our website and inbox platform (GoDaddy / Airo): to operate this website and receive your enquiries. Data is processed under a data processing agreement.
  • Boiler Upgrade Scheme administrators: where applicable, if you proceed with a Boiler Upgrade Scheme application, your details may be shared as required for that application.
  • Gas Safe Register: we are required to notify Gas Safe of certain gas work carried out at your property.
  • Our accountant or bookkeeper: for invoicing and tax purposes, under a confidentiality agreement.
  • Law enforcement or regulators: where we are legally required to disclose information.

We do not transfer your personal data outside the United Kingdom. Where any of our service providers process data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR.

7. Cookies

This website uses only essential cookies necessary for the site to function (for example, to maintain your session when submitting a form). We do not use analytics, advertising, or tracking cookies.

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the contact form.

8. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access: to request a copy of the personal data we hold about you (a Subject Access Request).
  • Right to rectification: to request correction of inaccurate or incomplete data.
  • Right to erasure: to request deletion of your data where there is no compelling reason for us to continue processing it.
  • Right to restriction: to request that we restrict processing of your data in certain circumstances.
  • Right to data portability: to receive your data in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
  • Right to object: to object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
  • Rights related to automated decision-making: we do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

9. How we protect your data

We take appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These include using secure email, limiting access to personal data to those who need it, and using reputable third-party platforms with their own security certifications.

No method of transmission over the internet is completely secure. While we do our best to protect your data, we cannot guarantee absolute security.

10. Third-party links

This website may contain links to third-party websites (for example, Gas Safe Register or Ofgem). We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page will always reflect the most recent version. We encourage you to review this policy periodically.