Power Point (Glos) Ltd – Privacy Policy (UK GDPR)

Who we are:
Power Point (Glos) Ltd, “The Office”, Cuffries Fold, Sandhurst Lane, Sandhurst, Gloucester, GL2 9NP. (“Power Point”, “we”, “us”).
Contact for privacy matters: Louise Fivash – Data Protection Lead – louise@powerpointglos.co.uk.
IT/Security contact: Ben Brown.

Effective date: 18 August 2025 (replaces 1 Feb 2022 version).

1) Scope

This notice explains how we collect and use personal data about customers, tenants, landlords, letting agents, suppliers, engineers and website users in the course of providing domestic appliance services and related administration.

2) The data we collect

Depending on the service, we may process:

• Identity & contact: names, addresses, emails, phone numbers (customers/tenants/landlords/letting agents, supplier contacts).
• Job & appliance info: appointment dates/times, location of work, appliance details (brand/model/serial), photos, documents, warranty/recall information.
• Communications: emails, website forms, WhatsApp messages, and call recordings (see legal basis below).
• Finance/admin: transaction records, invoice and warranty references. We do not store full payment card details.

We do not intentionally collect special-category data. If you voluntarily share health or vulnerability information (e.g., for access arrangements), we minimise and protect it.

3) Why we use your data (lawful bases)

We only use personal data where a lawful basis applies under the UK GDPR and Data Protection Act 2018:

• Contract (Art. 6(1)(b)) – to take bookings, attend jobs, supply parts/appliances, manage warranties/returns, and respond to enquiries.
• Legal obligation (Art. 6(1)(c)) – to keep records for tax and accounting; and to comply with product-safety and recall duties under applicable safety regulations (which can require us to retain contact and appliance data so affected customers can be notified).
• Legitimate interests (Art. 6(1)(f)) – to run and secure our services (scheduling, proof of work, training/quality, fraud prevention, and reasonable record-keeping). We rely on this basis for call recording and routine business communications where proportionate.
• Consent (Art. 6(1)(a)) – for optional marketing communications. You can withdraw consent at any time.

Call recordings. We record some inbound/outbound calls to help us take accurate instructions, resolve queries, and train staff. We provide notice at the start of calls; recordings are kept only as long as needed for these purposes and then securely deleted.

4) Our data-retention & deletion schedule

We apply the storage limitation principle: keep data no longer than necessary for the purposes above, legal obligations, and to defend legal claims. Practically:

Years 0–2 (recent jobs)

• We retain full job records and contact details (all parties) so we can manage repeat visits, warranty issues and disputes efficiently.

Years 3–7 (archive window)

• We move records into an archive list.
• We retain:
• Letting agent and landlord contact details (including names, phone, email and address) and relevant job/appliance details.
• Customer contact details only where we supplied a new appliance (so we can contact you in case of safety notices or recalls connected to that product).
• We delete or redact other contact names/numbers/emails not required for safety, recall, legal, or warranty purposes (e.g., routine occupant/tenant phone numbers if not needed for the safety exception).
• Attachments and photos are kept only where still necessary for safety, warranty/recall, or legal/audit purposes, otherwise they are removed.

After 7 years

• We delete the record (including any residual contact details), unless we must keep a limited subset to establish, exercise or defend legal claims or to comply with a legal obligation (in which case we keep only what is strictly necessary and for the shortest possible time).

Why we may keep some data in years 3–7:

We follow the storage-limitation principle in UK GDPR Article 5(1)(e) (keep data no longer than necessary). However, UK GDPR and product-safety law allow limited retention in specific circumstances:

• Legal obligation (UK GDPR Art. 6(1)(c))
  When we supply a new appliance, we act as a “producer/distributor” for product-safety purposes. UK product-safety law requires traceability, incident monitoring and, where needed, notification to authorities and consumers and the ability to organise a recall. To meet these duties we must retain minimal contact and appliance details so we can identify and contact affected customers/landlords/agents. (See General Product Safety Regulations 2005 (GPSR) — duties to notify/co-operate and take action: reg. 9; and recall notices: reg. 15; plus OPSS/DBT guidance and Business Companion traceability guidance.) Legislation.gov.uk+1GOV.UKBusiness Companion
• Legitimate interests (UK GDPR Art. 6(1)(f))
  We may also retain minimal contact/appliance data where it is necessary and proportionate to manage product-safety communications (e.g., safety notices) and to run our service safely, and where those interests are not overridden by individuals’ rights. We record a balancing test for this basis. Information Commissioner’s Office
• Right to erasure – built-in GDPR exceptions (UK GDPR Art. 17(3))
  If someone asks us to delete data during years 3–7, we may refuse to erase the minimal data we must keep (a) to comply with a legal obligation (Art. 17(3)(b)) or (b) for the establishment, exercise or defence of legal claims (Art. 17(3)(e)). We explain this when it applies. Information Commissioner’s Office
• Defending legal claims (Limitation Act 1980)
  Typical civil claims (e.g., contract or non-injury negligence) have a six-year limitation period. Keeping a 7-year archive allows us to defend claims that may be brought late in that window and to evidence safety actions/recalls. We keep only what is necessary for that purpose. Legislation.gov.uk

How we apply this in practice (years 3–7):

• We retain letting-agent and landlord contact details and relevant job/appliance details.
• We retain customer contact details only where we supplied a new appliance (so we can notify about safety issues/recalls).
• We redact/delete other contact names/numbers/emails not required for safety/legal-obligation/claims purposes.
• We continually apply data minimisation and storage-limitation principles from Art. 5.

5) Where we get data and who we share it with

We collect data directly from you (phone, email, website forms, WhatsApp) and from letting agents/landlords when they instruct us. We share data only with:

• Our engineers and trusted suppliers/partners (e.g., manufacturers, warranty providers, parts distributors, couriers) as needed to fulfil a job or safety/recall obligation.
• Professional advisers, insurers, and authorities where legally required.
• IT service providers we use to host email and business systems under contracts that include confidentiality and data-processing terms.

We do not sell personal data.

6) International transfers

Our core systems are located in the UK/EEA. If we ever need to transfer data outside the UK/EEA, we’ll use a lawful transfer mechanism (e.g., UK IDTA or EU SCCs) and additional safeguards where appropriate, and we’ll tell you when applicable.

7) Security

We use reasonable technical and organisational measures: access controls, encryption in transit, strong passwords, restricted staff access, device security, backup and recovery, and staff awareness.

8) Your rights

You can ask us to:

• Access your data; correct inaccuracies; erase data; restrict or object to processing; and obtain data portability (where applicable).
• Requests are free of charge and we’ll respond within one month (we may extend by two months for complex requests and will tell you why).
• Your right to erasure/objection may be limited where we must keep data to comply with legal obligations, handle legal claims, or meet product-safety/recall duties in the public interest.

How to exercise your rights: email louise@powerpointglos.co.uk. We will verify identity before acting.

If you’re unhappy, you can complain to the Information Commissioner’s Office (ICO). We’d appreciate the chance to resolve issues first.

9) Marketing & website forms

We only send marketing with your consent (opt-in). You can unsubscribe at any time using the link in our messages or by emailing us. Website form enquiries are used to respond to you and, if you opt-in, to send updates; we never share your details with third parties for their marketing.

10) WhatsApp

We communicate with some customers/agents via WhatsApp in line with our WhatsApp Policy and this Privacy Policy. Messages are used only for service delivery/coordination and retained in line with the retention schedule above.

11) Changes to this notice

We’ll update this notice when our practices or legal requirements change. Please check the latest version on our website.