Privacy Policy
This policy explains what personal information Heatflow Plumbing Limited collects, why we hold it, who we share it with, how long we keep it and what you can ask us to do with it. It covers this website, our online quote pages, our customer record system and the work we carry out.
Last updated 23 September 2026
1. Who we are
SD Plumbing & Heating is the trading name customers deal with. The company behind it — and therefore the data controller for everything described in this policy — is Heatflow Plumbing Limited, a private limited company registered in Scotland with company number SC785550 and VAT number 474449558. Our registered office is Argyll House, Quarrywood Court, Livingston, West Lothian, EH54 6AX and we trade from 16 Ashley Place, Edinburgh, EH6 5GB.
We are registered with the Information Commissioner’s Office as a data controller under registration ZC124177, which also records “sd plumbing and heating” as a name we operate under.
We are a plumbing and heating company, not a data business. We do not have a statutory Data Protection Officer; responsibility for data protection sits with our office management team, and any question, request or complaint should be sent to info@sdplumbingandheating.com or 0131 392 8722.
2. What this policy covers
It applies to personal information we handle about:
- people who ask us for a quote, submit an online form or telephone us;
- customers, including the contact at a commercial or letting customer;
- people who use our customer portal to view quotes, jobs or documents;
- suppliers, subcontractors and professional contacts;
- our own staff and job applicants, in the course of employing them.
It does not cover third-party websites we link to, including our review platforms and social media pages. Those organisations have their own privacy notices.
3. The information we collect
Information you give us
| When | What we collect |
|---|---|
| Online quote and enquiry forms | Your name, telephone number, email address, the address or postcode of the property, the service you need, your message, and any answers you give to the questions on the form (for example property type, budget range, timescale, preferred style, preferred contact time). |
| Telephone calls and emails | Your contact details and a record of what you have asked us for, so the person who visits already knows the history. |
| Site visits and installations | Details of the property, the work agreed, photographs of the work area, and records we are legally required to keep — for example Gas Safe registration details and gas safety certificates. |
| Quotes, invoices and payments | The quote and invoice history for your property, payment method and the last four digits of a card or your bank details where you pay us by transfer or direct debit. We do not store full card numbers. |
| Finance applications | If you choose to apply for finance, the application is made with our credit broker partner and not with us. See section 6. |
| Customer portal accounts | Your email address and a securely hashed password. We never store your password in readable form. |
Information we collect automatically
- Traffic and attribution data. When you open one of our quote pages we record the page you landed on, the page that referred you, any campaign parameters in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), an anonymous session identifier, your IP address and your browser user-agent string. This tells us which advertising is working and is not used to identify you personally.
- Advertising data. Our quote pages load the Meta Pixel, which sets its own cookies (including
_fbp) and reports page views to Meta. See section 4. - Map tiles. Where we show a map, map data is requested from OpenStreetMap and your IP address is visible to that service as a normal part of the request.
Information we collect on site
Our engineers use a mobile app while working at your property. With your permission, the app records the location at the point an engineer marks arrival and departure, and lets the engineer take photographs of the work. Location is used for job records and to confirm attendance — it is not tracked continuously and it is not used for marketing.
4. Cookies, the Meta Pixel and advertising
We keep the cookies and similar technologies on this site to a minimum.
| What | Type | Purpose |
|---|---|---|
| Sign-in session cookie | Strictly necessary | Keeps you signed in to the customer portal or our staff system. Cannot be switched off without breaking sign-in. |
| Theme preference (localStorage) | Preference | Remembers whether you prefer the light or dark interface. |
| Anonymous visit identifier (sessionStorage) | Analytics | Counts a page view once per browser tab so our own traffic figures are not inflated by refreshes. Deleted when you close the tab. |
| Meta Pixel (connect.facebook.net) | Advertising | Reports page views to Meta so we can measure our adverts and show relevant adverts to people who have visited our pages. |
The Meta Pixel is operated by Meta Platforms, Inc. It allows Meta to link your visit to our page with your Facebook or Instagram account where you have one and are signed in. We receive aggregated reporting from Meta; we do not receive your Facebook profile from Meta.
How to limit advertising technologies
- Adjust your advertising settings in your Facebook or Instagram account (Settings → Ad preferences), including “Off-Facebook activity”, which lets you see and disconnect the data Meta holds about activity on other sites.
- Use the industry opt-out tools at youronlinechoices.com/uk to control participating advertisers.
- Block or clear cookies for this site in your browser settings. Blocking cookies may stop parts of the site working.
5. How and why we use your information
Under the UK GDPR we must have a lawful basis for everything we do with your information. In practice ours are: performing a contract with you, our legitimate interests in running the business, complying with the law, and — for marketing emails or texts — your consent.
| What we do | Why | Lawful basis |
|---|---|---|
| Respond to your enquiry and prepare a quote | You asked us to | Steps towards a contract |
| Carry out the work, order materials, arrange access | To deliver what you have agreed to buy | Performance of a contract |
| Take payment and keep accounting records | To be paid and to meet tax and company law | Contract and legal obligation |
| Record gas work and issue safety certificates | Gas Safe and building regulations require it | Legal obligation |
| Honour workmanship guarantees and manufacturer warranties | So we can put problems right | Contract |
| Measure which advertising brings in enquiries | To spend our marketing budget sensibly | Legitimate interests |
| Show adverts to people who visited our pages (Meta Pixel) | To reach people who showed interest | Consent where required by law; otherwise legitimate interests |
| Send you an occasional offer or update by email or text | Only if you have agreed | Consent |
| Prevent misuse of our systems and keep them secure | To protect you and us | Legitimate interests |
We do not use your information for automated decision-making or profiling that has a legal effect on you, and we do not sell your information to anyone.
6. Who we share it with
We share personal information only where we need to in order to quote for, carry out or record work, or where the law requires it.
Suppliers who process data for us
- Hosting and database. Our customer record system and quote pages run on our own server infrastructure with a self-hosted Supabase (PostgreSQL) database, administered by us.
- Xero. Our accounts, invoices and contacts are kept in Xero (Xero (UK) Limited).
- Email delivery. Transactional and service emails are delivered through Brevo (Sendinblue SAS).
- Customer messages. Enquiries, replies and other messages you send us through the website, email or WhatsApp may be handled in Chatwoot, our customer conversation platform.
- SMS delivery. Service text messages are sent through Twilio Inc.
- Meta. Advertising measurement on our quote pages, as described in section 4.
- OpenStreetMap. Map tiles, as described in section 3.
Others we may disclose to
- Finance partners. If you choose to pay by finance, your application is made with our credit broker, Ideal Sales Solutions Ltd (trading as Ideal4Finance), Financial Conduct Authority reference 703401, which acts as a credit broker and not a lender, and with the introducer that arranges access to the lender, Tradehelp Ltd. They will tell you who is processing your application and provide their own terms.
- Manufacturers and warranty administrators. To register your manufacturer guarantee (for example Worcester Bosch), we pass the details the warranty requires.
- Gas Safe Register and building control. Where a notification or certificate is required for the work.
- Our insurers and professional advisers. If we need to make or defend a claim.
- HMRC, courts and regulators. Where we are legally required to disclose, or where a valid request is made.
- A purchaser of the business. If the company or its assets are sold, customer records would form part of what transfers; we would tell you if that happened.
We never share your details with other trades, lead-generation companies or data brokers.
7. Sending information outside the UK
Our customer record system and quote pages run on server infrastructure we administer ourselves. Some of the suppliers listed in section 6 are based in the United States, so a limited amount of data — typically email addresses and advertising measurement data — may be transferred there. Where that happens we rely on a lawful transfer mechanism: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the supplier is certified under it. You can ask us for more detail about a particular transfer.
8. How long we keep it
We keep personal information only as long as we need it. Our standard retention periods are:
| What | How long |
|---|---|
| An enquiry that does not become a job | 24 months, then deleted or anonymised |
| A job, including photographs and certificates | 12 years from completion — the longest manufacturer guarantee we offer — so we can honour warranty claims |
| Invoice, payment and accounting records | 6 years from the end of the financial year the record relates to, as required by tax and company law |
| Gas safety and gas work records | As required by gas safety legislation, and in any event no longer than the periods above |
| Customer portal account | Until you ask us to close it, or 24 months after the property ceases to be a customer |
| Marketing consent (email or text) | Until you withdraw consent, plus 24 months |
| Website traffic and attribution records | 24 months |
| Advertising measurement data held by Meta | Governed by Meta’s own retention schedule, not ours |
| Job applicant records | 12 months after the decision, unless you ask us to keep them longer |
9. Keeping it secure
Everything you send through our quote pages and portal is encrypted in transit using TLS. Access to our customer record system is limited to the staff who need it to quote for, schedule or carry out your work, is protected by individual named accounts and role-based permissions, and is logged. Database access is additionally restricted at row level, so a member of staff who has no reason to see a job cannot read it.
No system can be guaranteed completely secure. If we ever became aware of a breach affecting your rights we would tell you and the Information Commissioner’s Office as required by law.
10. Your rights
You have the right to:
- Be informed — this policy, and anything you ask us in addition.
- Access a copy of the personal information we hold about you.
- Rectification — have inaccurate or incomplete information corrected.
- Erasure — have your information deleted where we no longer need it and there is no legal reason for us to keep it.
- Restriction — have us pause using your information while a dispute is resolved.
- Portability — receive information you gave us in a structured, commonly used format, or have it sent to another organisation.
- Object to processing based on our legitimate interests, and to stop receiving marketing altogether.
- Withdraw consent at any time where we rely on consent; this does not affect anything done before you withdrew it.
To exercise any of these, email info@sdplumbingandheating.com or telephone 0131 392 8722. There is no charge. We may ask you to confirm your identity so that we do not hand your information to someone else, and we will respond within one month. Our data deletion instructions set out exactly how an erasure request is handled.
Complaining
Please come to us first — most concerns are easily sorted out. If you are not satisfied you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You can also complain to the ICO without contacting us first if you prefer.
11. Marketing
We may contact you about the work you have asked us about, and we will follow up on completed work to check you are happy. We will only send you marketing — offers, reminders or updates — where you have agreed to receive it, and every message includes a way to opt out. Opting out of marketing does not stop us contacting you about a quote, a booking or a job you have with us.
12. Children
Our services are sold to adults. We do not knowingly collect information from anyone under 16 through our website or quote pages. If a job is booked on behalf of a child, or an adult is arranging work for a property occupied by a child, we hold only the adult customer’s details.
13. Changes to this policy
We review this policy at least annually and whenever the way we handle information changes. The version published here is always the current one, and the “last updated” date at the top tells you when it last changed. If the change is significant and affects you, we will tell you directly where we hold a contact for you.
14. How to contact us
For anything in this policy:
- Email: info@sdplumbingandheating.com
- Telephone: 0131 392 8722 (Monday to Friday 08:00–17:00, Saturday 09:00–12:00)
- Post: Heatflow Plumbing Limited, 16 Ashley Place, Edinburgh, EH6 5GB
- Tell us what you need — access, correction, deletion, or an answer to a question.
- We confirm we have received it and, if needed, ask you to verify your identity.
- We respond within one month with the outcome, or explain why we need longer and keep you updated.