Privacy Policy

Last Updated: January 2026

INTRODUCTION

Home Assist 365 Ltd takes the privacy of personal data seriously and the legal and compliant treatment of this data is at the core of our operations.

We therefore ask you to please read the following important information which explains how we collect, store, process, and use your personal data.

Home Assist 365 Ltd is registered under the Data Protection Act 2018 and complies with the UK General Data Protection Regulation (UK GDPR). We are committed to protecting your privacy and ensuring your personal information is handled responsibly and in accordance with data protection law.

1. WHO ARE WE?

1.1 Company Information

Home Assist 365 Ltd is a heating and plumbing business offering a range of services including boiler installations, repairs, servicing, and finance options to our customers.

Registered Company Name: Home Assist 365 Ltd Company Registration Number: 11955704 Gas Safe Registration Number: 632778 Registered Office: Henleaze Business Centre, Harbury Road, Bristol, BS9 4PN

1.2 Financial Services

Home Assist 365 Ltd (FRN: 971539) are an appointed representative of Koze Group Ltd, a credit broker and not a lender. Koze Group Ltd are authorised and regulated by the Financial Conduct Authority (FRN 811281) registered in England (08357963). Credit facilities are offered from a panel of lenders.

1.3 Contact Details

Email: helpdesk@homeassist365.co.uk Telephone: 0117 9474040 Address: Henleaze Business Centre, Harbury Road, Bristol, BS9 4PN

2. DATA CONTROLLER AND DATA PROTECTION OFFICER

2.1 Data Controller

Home Assist 365 Ltd is the data controller for the personal information we process about you. This means we determine the purposes for which, and the manner in which, your personal data is processed.

2.2 Data Protection Officer

Our Data Protection Officer is responsible for overseeing our data protection strategy and implementation to ensure compliance with UK GDPR.

Data Protection Officer: Shaun Downton Email: helpdesk@homeassist365.co.uk Telephone: 0117 9474040 Address: Henleaze Business Centre, Harbury Road, Bristol, BS9 4PN

If you have any questions about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer using the details above.

3. WHAT DO WE MEAN BY PERSONAL DATA?

3.1 Personal data (or personal information) means any information that relates to you and can be used to identify you, either directly or in conjunction with other information we hold.

3.2 This includes information such as: • Your name • Your address • Your telephone number • Your email address • Your date of birth • Your financial information • Your payment details • Information about your property • Information about your heating system • Any other information that can identify you

3.3 We may also process special categories of personal data (sensitive personal data) which includes: • Health information (if you inform us of vulnerable circumstances or medical conditions that may affect our service delivery) • Financial information relating to your ability to pay or creditworthiness

3.4 We process this sensitive data only when necessary and with appropriate safeguards in place, and only with your explicit consent or where we have another lawful basis to do so.

4. HOW DO WE COLLECT INFORMATION FROM YOU?

4.1 We collect personal information about you in the following ways:

Direct Collection: • When you contact us by phone, email, or through our website • When you request a quotation or book our services • When you complete forms (online or paper-based) • When you sign contracts or service agreements • When you apply for finance • When you sign up for a Care Plan • During face-to-face meetings or site visits • When you make a payment • When you provide feedback or make a complaint • When you participate in customer surveys

Automatic Collection: • When you visit our website (through cookies and similar technologies) • Through our telephone recording systems (calls may be recorded for training and quality purposes) • Through our email systems (we may track whether emails are opened or links are clicked)

Third Party Sources: • Credit reference agencies (when you apply for finance) • Fraud prevention agencies • Publicly available sources (such as Companies House for business customers) • Manufacturers (when we register warranties on your behalf) • Finance providers (in relation to finance applications)

4.2 We only collect information that is necessary for the purposes of providing our services and complying with legal obligations.

4.3 We gather your consent before entering into business relations with you, either: • In writing (by signing our Data Consent forms or contracts) • Electronically (by ticking consent boxes on our website or online forms) • Verbally (by confirming your consent during telephone calls, which may be recorded)

5. WHAT TYPE OF INFORMATION DO WE COLLECT?

5.1 The specific information we collect depends on the nature of our relationship with you and the services you request. This may include:

Contact and Identification Information: • Full name • Home address and property address (if different) • Email address • Telephone number(s) (landline and mobile) • Date of birth (for finance applications) • Proof of identity (passport, driving license) • Proof of address (utility bills, bank statements)

Property Information: • Property type, age, and ownership status (owned, rented, landlord) • Details of existing heating system • Boiler make, model, and serial number • Property access requirements • Location of gas meter and controls • Photographs of heating equipment and installation

Service Information: • Details of services requested and provided • Appointment dates and times • Engineer visit notes and reports • Gas safety check results and certificates • Service history and maintenance records • Warranty and guarantee information • Customer preferences and requirements

Financial Information: • Payment card details (processed securely via third-party payment processors) • Bank account details (for direct debit or refund purposes) • Credit/debit card information (not stored by us) • Invoice and payment history • Finance application information including:

Employment status and income
Expenditure and financial commitments
Credit history (obtained from credit reference agencies)
Affordability assessment information

Communication Information: • Records of telephone calls (which may be recorded) • Email correspondence • Text messages (SMS) • Letters and written correspondence • Live chat transcripts • Notes from meetings and site visits • Complaint records and resolutions • Customer service interactions

Marketing and Preferences: • Marketing preferences (whether you wish to receive marketing communications) • Communication preferences (email, SMS, post, phone) • Product and service interests • Feedback and survey responses

Technical Information: • IP address (when you visit our website) • Browser type and version • Device information • Cookie data • Website usage data

Health and Vulnerability Information (Special Category Data): • Information about vulnerable circumstances (if disclosed to us) • Health conditions that may affect service delivery • Accessibility requirements • Details of carers or representatives who assist you

5.2 We only collect information that is relevant and necessary for the purposes set out in this Privacy Policy.

5.3 You are not obliged to provide all of this information, but if you do not provide certain information, we may not be able to provide our services to you. For example: • Without your contact details, we cannot book appointments or communicate with you • Without property information, we cannot provide accurate quotations • Without identification documents, we cannot process finance applications • Without payment information, we cannot process payments

6. WHY DO WE COLLECT AND USE YOUR PERSONAL INFORMATION?

6.1 We collect and use your personal information for the following purposes:

Service Provision: • To provide the heating and plumbing services you have requested • To carry out repairs, installations, and maintenance work • To conduct boiler servicing and gas safety inspections • To issue gas safety certificates and other documentation • To register product warranties with manufacturers • To arrange appointments and confirm bookings • To provide customer support and respond to your enquiries • To process payments and issue invoices • To manage and administer Care Plans • To maintain service records and history

Contractual Obligations: • To enter into and perform contracts with you • To fulfil our obligations under service agreements • To enforce our terms and conditions • To manage complaints and disputes

Legal and Regulatory Compliance: • To comply with Gas Safety (Installation and Use) Regulations 1998 • To maintain gas safety records as required by law • To comply with Building Regulations and notify Building Control where required • To comply with health and safety legislation • To comply with anti-money laundering regulations • To comply with Financial Conduct Authority (FCA) requirements • To respond to requests from law enforcement and regulatory bodies • To comply with court orders and legal processes • To maintain records for tax and accounting purposes

Financial Services: • To assess your eligibility for finance • To process finance applications • To conduct credit checks and affordability assessments • To share information with finance providers and credit reference agencies • To comply with Consumer Credit regulations • To prevent fraud and financial crime

Business Operations: • To manage our business and operations efficiently • To maintain accurate records and databases • To analyse and improve our services • To train staff and monitor quality • To conduct customer satisfaction surveys • To manage complaints and resolve disputes • To protect our legal rights and interests

Marketing and Communications: • To send you marketing communications about similar services (with your consent or where we have a legitimate interest) • To inform you about special offers, promotions, and new services • To send service reminders (such as annual service due notifications) • To request feedback and reviews • To send newsletters and updates

Risk Management and Security: • To prevent and detect fraud • To protect our systems and networks • To verify your identity • To assess and manage risk • To protect against liability

6.2 We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your information for an unrelated purpose, we will notify you and explain the legal basis for doing so.

7. WHAT IS OUR LAWFUL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION?

7.1 Under UK GDPR, we must have a lawful basis to process your personal information. The lawful bases we rely upon are:

Consent (Article 6(1)(a)): • When you have given clear and explicit consent for us to process your personal data for specific purposes • For example: receiving marketing communications, storing payment card details, processing special category data about health or vulnerability

Contract (Article 6(1)(b)): • When processing is necessary for the performance of a contract with you • When processing is necessary to take steps at your request before entering into a contract • For example: processing your booking, carrying out the work you requested, processing payments

Legal Obligation (Article 6(1)(c)): • When we are required by law to process your personal data • For example: maintaining gas safety records, complying with tax law, anti-money laundering checks, responding to court orders

Legitimate Interests (Article 6(1)(f)): • When processing is necessary for our legitimate interests or those of a third party (provided your interests and rights do not override those interests) • For example: sending service reminders, fraud prevention, improving our services, marketing similar services to existing customers, maintaining business records, protecting our legal rights

We will rely on legitimate interests only when we have balanced your rights and interests against ours and determined that our interests do not override yours. You have the right to object to processing based on legitimate interests.

Vital Interests (Article 6(1)(d)): • When processing is necessary to protect someone’s life • For example: if we identify a dangerous gas situation that poses an immediate risk to life

Public Task (Article 6(1)(e)): • This basis does not typically apply to our business operations

7.2 For special category (sensitive) personal data, we rely on:

Explicit Consent (Article 9(2)(a)): • When you have given explicit consent to process sensitive data • For example: information about health conditions or vulnerability that you have disclosed to us

Substantial Public Interest (Article 9(2)(g)): • When necessary for reasons of substantial public interest (such as safeguarding)

7.3 You can withdraw your consent at any time where we are relying on consent as our lawful basis. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

7.4 If you withdraw consent, we may not be able to provide certain services to you. We will advise you if this is the case when you withdraw your consent.

8. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

8.1 We take the security of your personal information very seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction, or damage.

8.2 Technical Security Measures:

Data Encryption: • All data transmitted between you and our systems is encrypted using SSL/TLS technology • Sensitive data stored on our systems is encrypted • Backup data is encrypted

Access Controls: • Password-protected systems and databases • Multi-factor authentication for access to sensitive systems • User access is restricted based on job role and necessity (principle of least privilege) • Regular password changes are enforced • Inactive user accounts are disabled

Network Security: • Firewalls protect our network perimeter • Intrusion detection and prevention systems • Regular security patches and software updates • Anti-virus and anti-malware protection • Secure Wi-Fi networks with strong encryption

System Security: • Regular security audits and vulnerability assessments • Penetration testing of critical systems • Secure configuration of all systems • Security monitoring and logging • Regular backup of data to secure locations • Disaster recovery and business continuity plans

Payment Security: • We do not store full payment card details on our systems • Card payments are processed through PCI-DSS compliant payment service providers • Tokenization is used for stored card references • Strong customer authentication (3D Secure) for online payments

8.3 Organisational Security Measures:

Staff Training and Awareness: • All staff receive data protection and security training • Regular refresher training and updates • Security awareness programmes • Clear acceptable use policies

Access Management: • Only authorised personnel have access to personal data • Access is logged and monitored • Regular reviews of user access rights • Immediate removal of access for leavers

Policies and Procedures: • Data Protection Policy • Information Security Policy • Acceptable Use Policy • Incident Response Plan • Data Breach Notification Procedure • Clean desk and clear screen policies

Confidentiality: • All staff sign confidentiality agreements • Non-disclosure agreements with third parties • Secure disposal of paper records (shredding) • Secure deletion of electronic data

Physical Security: • Secure office premises with access control • Locked filing cabinets for paper records • CCTV monitoring • Visitor management procedures • Secure destruction of confidential waste

Third Party Management: • Due diligence on third-party service providers • Data processing agreements with all processors • Regular audits of third-party security • Contractual security requirements

8.4 Data Breach Response

Despite our security measures, no system is completely secure. In the unlikely event of a data breach: • We will investigate and contain the breach immediately • We will assess the risk to individuals affected • We will notify the Information Commissioner’s Office (ICO) within 72 hours if required • We will notify affected individuals without undue delay if the breach poses a high risk to their rights and freedoms • We will take steps to prevent recurrence

8.5 Your Responsibilities

You can help keep your information secure by: • Keeping your login credentials confidential (if you have an online account) • Not sharing your account with others • Using strong, unique passwords • Logging out after using shared computers • Keeping your contact details up to date • Reporting any suspected security issues to us immediately

9. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

9.1 We will only share your personal data with third parties when it is necessary for the services you have requested, when we have a legal obligation to do so, or when we have another lawful basis.

9.2 We share your personal information with the following categories of recipients:

Finance Providers and Credit Reference Agencies: • Koze Group Ltd (our principal for finance services) • Finance lenders on our panel (including Novuna Personal Finance and others) • Credit reference agencies (Experian, Equifax, TransUnion) to assess creditworthiness • Fraud prevention agencies to prevent and detect fraud and financial crime

When you apply for finance, we will share your personal and financial information with finance providers and credit reference agencies. They will use this information to: • Assess your credit application • Verify your identity • Check your credit history • Make lending decisions • Prevent fraud • Trace debtors • Manage your account (if credit is approved)

The credit reference agencies will record information about your application and this may be visible to other organisations when you apply for credit in the future. If you are approved for finance and fail to make payments, this will be recorded and may affect your ability to obtain credit in the future.

Manufacturers and Suppliers: • Boiler and heating equipment manufacturers (such as Worcester Bosch, Ideal, Vaillant) to:

Register product warranties
Obtain technical support
Order parts and equipment
Verify serial numbers and installation details • Parts suppliers to fulfil orders for your installation or repair

Regulatory and Law Enforcement Bodies: • Gas Safe Register (for gas safety compliance and investigations) • Financial Conduct Authority (FCA) for finance-related compliance • HM Revenue & Customs (HMRC) for tax compliance • Local Authority Building Control (where installations require notification) • Health and Safety Executive (in the event of safety incidents) • Police and law enforcement agencies (when required by law or court order) • Trading Standards (in response to complaints or investigations) • Information Commissioner’s Office (ICO) (in response to data protection inquiries)

Professional Advisers and Service Providers: • Solicitors and legal advisers (for legal advice and representation) • Accountants and auditors (for accounting, tax, and audit purposes) • Compliance consultants (for regulatory compliance advice) • IT service providers and software suppliers who provide:

Customer relationship management (CRM) systems
Booking and scheduling software
Accounting and invoicing systems
Email and communication platforms
Website hosting and maintenance
Data backup and storage services
Payment processing services
Security and anti-fraud services

Insurance Companies: • Our insurers and insurance brokers (in the event of claims or for insurance purposes) • Your insurance company (if you request us to liaise with them regarding a claim)

Debt Collection Agencies: • If you fail to pay amounts owed, we may share your information with debt collection agencies to recover the debt

Business Transfers: • In the event of a merger, acquisition, or sale of our business, we may share your information with:

Prospective buyers or investors
Their professional advisers
The acquiring organisation

The acquiring organisation will be required to use your information in accordance with this Privacy Policy and data protection law.

Subcontractors and Partners: • Subcontractors who assist us in providing services (such as specialist engineers or tradespeople) • Business partners who provide complementary services

9.3 Data Processing Agreements

We ensure that all third parties with whom we share your data: • Are contractually obliged to keep your data secure and confidential • Only process your data on our instructions • Comply with UK GDPR and data protection law • Have appropriate security measures in place • Delete or return your data when no longer needed

9.4 International Transfers

We do not routinely transfer your personal data outside the United Kingdom. If we need to do so for any reason, we will: • Ensure that the recipient country has adequate data protection laws, or • Put in place appropriate safeguards (such as Standard Contractual Clauses), and • Inform you of the transfer

9.5 We will never: • Sell your personal data to third parties for marketing purposes • Share your data with third parties for their own marketing without your explicit consent • Disclose your data unless we have a lawful basis to do so

10. HOW LONG DO WE STORE YOUR PERSONAL INFORMATION?

10.1 We will only retain your personal information for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting, regulatory, or reporting requirements.

10.2 Our standard retention periods are:

Service Records and Customer Data: • Personal details, service history, and correspondence: 6 years from the date you cease to be our customer • This allows us to:

Respond to complaints and legal claims (which can be brought up to 6 years after the event)
Comply with tax and accounting obligations (6 years)
Maintain historical records for warranty purposes

Gas Safety Records: • Gas safety certificates (CP12): Minimum 2 years (legal requirement under Gas Safety Regulations) • We typically retain these for 6 years for our own record-keeping purposes

Financial Records: • Invoices, receipts, and payment records: 6 years (HMRC requirement) • Finance agreements and credit checks: 6 years from completion or termination of agreement • VAT records: 6 years (HMRC requirement)

Marketing Data: • If you have consented to marketing: Until you withdraw consent or unsubscribe • We will periodically review marketing lists and remove inactive contacts • We will send a re-engagement email before deleting data of inactive contacts

Complaint Records: • Records of complaints and resolutions: 6 years from resolution

CCTV and Telephone Recordings: • CCTV footage: 30 days (unless required for a specific investigation) • Telephone call recordings: 6 years (for quality, training, and dispute resolution)

Website Analytics and Cookies: • Website usage data: Up to 24 months • Cookie data: As specified in our Cookie Policy

Recruitment Records: • Unsuccessful applicants: 12 months after the recruitment process ends • Successful applicants: Throughout employment and 6 years after employment ends

10.3 Exceptions to Standard Retention Periods

We may retain personal data for longer than the periods stated above if: • We are required to do so by law or regulation • It is necessary for the establishment, exercise, or defence of legal claims • You have requested that we retain your data • There is an ongoing investigation or legal proceeding • We have another lawful basis for retention

10.4 When personal data is no longer required, we will: • Securely delete electronic records • Securely destroy paper records (shredding) • Anonymise data where appropriate (removing all identifying information)

10.5 Some information may be retained in anonymised form for statistical and analytical purposes. Anonymised data cannot be used to identify you and is not subject to data protection law.

11. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION?

11.1 Under UK GDPR, you have the following rights in relation to your personal data:

RIGHT 1: The Right to Be Informed

You have the right to be informed about how we collect and use your personal data.

We provide this information through: • This Privacy Policy • Privacy notices at the point of data collection • Fair processing notices • Verbal explanations during telephone calls

RIGHT 2: The Right of Access (Subject Access Request)

You have the right to request a copy of the personal information we hold about you.

What we will provide: • Confirmation that we are processing your personal data • A copy of your personal data in a commonly used electronic format (or paper if you prefer) • Information about how we use your data • Information about who we share your data with • Information about how long we will keep your data • Information about your other rights

How to make a request: • In writing to: Henleaze Business Centre, Harbury Road, Bristol, BS9 4PN • By email to: helpdesk@homeassist365.co.uk • By telephone: 0117 9474040

Please provide: • Your full name • Your address • Details of the information you are requesting (to help us locate it) • Proof of identity (to prevent unauthorised disclosure)

Response time: • We will respond within one month of receiving your request • We may extend this by up to two months for complex requests, but we will inform you if this is the case

Cost: • Free of charge for the first request • We may charge a reasonable fee for additional copies or manifestly unfounded/excessive requests

RIGHT 3: The Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

What you can do: • Request that we correct inaccurate information • Request that we complete incomplete information

How to make a request: • Contact us using the details in section 11.1 (Right 2) above • Specify what information is incorrect and what it should be

Response time: • We will respond within one month (can be extended by two months for complex requests) • We will notify you when the correction has been made • We will inform third parties to whom we have disclosed the data (where appropriate)

RIGHT 4: The Right to Erasure (“Right to be Forgotten”)

You have the right to request that we delete your personal data in certain circumstances.

When this right applies: • The data is no longer necessary for the purpose it was collected • You withdraw consent (and we have no other lawful basis for processing) • You object to processing and we have no overriding legitimate grounds • The data has been unlawfully processed • We are required by law to delete the data • The data was collected from a child for online services

When this right does not apply: • We need the data to comply with a legal obligation (e.g., gas safety records, tax records) • We need the data to establish, exercise, or defend legal claims • We have another lawful basis that overrides your right to erasure

How to make a request: • Contact us using the details in section 11.1 (Right 2) above • Explain why you believe your data should be deleted

Response time: • We will respond within one month • If we cannot delete your data, we will explain why

RIGHT 5: The Right to Restrict Processing

You have the right to request that we limit how we use your personal data.

When this right applies: • You contest the accuracy of the data (restriction applies while we verify accuracy) • Processing is unlawful, but you do not want the data deleted • We no longer need the data, but you need it to establish, exercise, or defend legal claims • You have objected to processing (restriction applies while we verify whether our grounds override yours)

What this means: • We will store the data but not use it • We may use it only with your consent or for legal claims or to protect another person’s rights

How to make a request: • Contact us using the details in section 11.1 (Right 2) above

Response time: • We will respond within one month

RIGHT 6: The Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transfer it to another data controller.

When this right applies: • The processing is based on consent or contract • The processing is carried out by automated means

What we will provide: • Your data in a format such as CSV, Excel, or JSON • The data will be provided securely

How to make a request: • Contact us using the details in section 11.1 (Right 2) above • Specify what data you require and in what format (if you have a preference)

Response time: • We will respond within one month • Free of charge

RIGHT 7: The Right to Object

You have the right to object to our processing of your personal data in certain circumstances.

When you can object:

Marketing: • You have an absolute right to object to direct marketing at any time • This includes profiling for marketing purposes • We will stop processing your data for marketing as soon as we receive your objection

To object to marketing: • Click “unsubscribe” in any marketing email • Reply “STOP” to marketing text messages • Contact us using the details in section 11.1 (Right 2) above • Inform us verbally during a telephone call

Processing based on Legitimate Interests: • You can object to processing based on our legitimate interests • We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or we need the data for legal claims

Processing for Research/Statistics: • You can object to processing for scientific/historical research or statistical purposes • We will stop processing unless it is necessary for a public interest task

How to make an objection: • Contact us using the details in section 11.1 (Right 2) above • Explain the grounds for your objection

Response time: • We will stop marketing immediately • For other objections, we will respond within one month

RIGHT 8: Rights Related to Automated Decision-Making and Profiling

You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you.

Our position: • We do not use automated decision-making or profiling to make decisions about you • All decisions are made by people, not algorithms • Credit decisions are made by finance providers based on their assessment criteria, but these involve human review

If we were to introduce automated decision-making in future, we would: • Inform you clearly • Obtain your explicit consent (where required) • Provide information about the logic involved • Give you the right to human intervention • Allow you to challenge the decision

RIGHT 9: The Right to Withdraw Consent

Where we are processing your data based on consent, you have the right to withdraw that consent at any time.

How to withdraw consent: • Contact us using the details in section 11.1 (Right 2) above • Specify which processing activities you no longer consent to

Effect of withdrawal: • We will stop processing your data for that purpose • This does not affect the lawfulness of processing before you withdrew consent • If we have no other lawful basis for processing, we will delete your data (subject to legal retention requirements) • We may not be able to provide certain services if you withdraw consent

11.2 How to Exercise Your Rights

To exercise any of the rights above, please contact us:

By Post: Data Protection Officer Home Assist 365 Ltd Henleaze Business Centre Harbury Road Bristol BS9 4PN

By Email: helpdesk@homeassist365.co.uk

By Telephone: 0117 9474040

11.3 Proof of Identity

To protect your privacy and prevent unauthorised disclosure of your personal data, we may ask you to provide proof of your identity before we respond to any request. Acceptable forms of ID include: • Passport • Driving license • Utility bill (as proof of address)

11.4 Response Times

We will respond to all requests within one month of receiving them. In complex cases, or if we receive multiple requests from you, we may extend this period by up to two months, but we will inform you within the first month if this is the case.

11.5 Fees

We will not charge a fee for most requests. However, we may charge a reasonable fee if: • Your request is manifestly unfounded or excessive • You request multiple copies of the same information

We will inform you of any fees before processing your request.

11.6 Refusal

We may refuse to comply with your request if: • We are not satisfied of your identity • The request is manifestly unfounded or excessive • We have a legal obligation that overrides your right • Compliance would adversely affect the rights and freedoms of others

If we refuse your request, we will explain why and inform you of your right to complain to the ICO.

12. HOW TO MAKE A COMPLAINT

12.1 Complaint to Us

If you are unhappy with how we have handled your personal information, or if you believe we have breached data protection law, please contact our Data Protection Officer:

Shaun Downton Email: helpdesk@homeassist365.co.uk Telephone: 0117 9474040 Address: Henleaze Business Centre, Harbury Road, Bristol, BS9 4PN

We will: • Acknowledge your complaint within 2 working days • Investigate the matter thoroughly • Respond with our findings within 10 working days (or inform you if more time is needed) • Take appropriate action to address your concerns

12.2 Complaint to the ICO

You have the right to lodge a complaint directly with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

The ICO can be contacted:

Website: https://ico.org.uk/make-a-complaint/ Telephone: 0303 123 1113 Post: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

12.3 When to Complain to the ICO

You can complain to the ICO at any time, but we would appreciate the opportunity to resolve your concerns first. However, if you are not satisfied with our response, or if you prefer, you can complain directly to the ICO.

13. COOKIES AND WEBSITE TRACKING

13.1 Our website uses cookies and similar technologies to improve your experience and analyse how our website is used.

13.2 What are cookies?

Cookies are small text files that are placed on your device (computer, smartphone, tablet) when you visit a website. They help the website recognise your device and remember information about your visit.

13.3 Types of cookies we use:

Essential Cookies: • Required for the website to function properly • Enable you to navigate the website and use its features • Cannot be disabled without severely affecting website functionality • Example: session cookies that remember your preferences during your visit

Analytics Cookies: • Help us understand how visitors use our website • Collect information about which pages are visited, how long visitors stay, and where they come from • All information is anonymised and aggregated • We use Google Analytics or similar services • You can opt out of these cookies

Marketing/Advertising Cookies: • Used to show you relevant advertisements • Track whether you have visited our website from an advertisement • May be set by third-party advertising networks • You can opt out of these cookies

Functional Cookies: • Remember your preferences and settings • Provide enhanced functionality and personalisation • Example: remembering your location or language preference

13.4 Managing Cookies

You can control and delete cookies through your browser settings. Please note that disabling cookies may affect your ability to use certain features of our website.

How to manage cookies in common browsers: • Chrome: Settings > Privacy and Security > Cookies • Firefox: Settings > Privacy & Security > Cookies and Site Data • Safari: Preferences > Privacy > Cookies • Edge: Settings > Cookies and site permissions

For more information about cookies, visit: www.allaboutcookies.org

13.5 Our Cookie Policy

For more detailed information about the cookies we use and how we use them, please see our full Cookie Policy available on our website.

13.6 Other Tracking Technologies

We may also use: • Web beacons (small graphic images) in emails to track whether emails are opened • Analytics tools to track website usage and performance • Social media pixels (e.g., Facebook Pixel) to measure the effectiveness of our advertising

You can opt out of tracking by: • Adjusting your browser settings • Using browser extensions that block tracking • Opting out of personalised advertising through the Digital Advertising Alliance

14. LINKS TO OTHER WEBSITES

14.1 Our website and communications may contain links to third-party websites, including: • Manufacturer websites (Worcester Bosch, Ideal, Vaillant, etc.) • Finance provider websites • Review platforms (Trustpilot, Google Reviews, etc.) • Social media platforms • Regulatory bodies (Gas Safe Register, FCA, etc.) • Supplier and partner websites

14.2 This Privacy Policy only applies to our website and our processing of your personal data. We are not responsible for the privacy practices of third-party websites.

14.3 When you click on a link to a third-party website, you will be subject to that website’s privacy policy and terms of use. We recommend that you read their privacy policy before providing any personal information.

14.4 We do not endorse or take responsibility for the content, privacy practices, or security of third-party websites, even if we link to them.

15. CHILDREN’S PRIVACY

15.1 Our services are not intended for children under the age of 18.

15.2 We do not knowingly collect personal data from children under 18 years of age.

15.3 If you are under 18, please do not provide any personal information to us without the consent of your parent or guardian.

15.4 If we become aware that we have collected personal data from a child under 18 without parental consent, we will take steps to delete that information as soon as possible.

15.5 If you are a parent or guardian and believe we have collected information from your child, please contact us immediately using the details in section 2.2.

16. CHANGES TO THIS PRIVACY POLICY

16.1 We may update this Privacy Policy from time to time to reflect: • Changes in law or regulation • Changes to our business practices • New technologies or services we offer • Feedback from regulators or customers

16.2 When we make changes, we will: • Update the “Last Updated” date at the top of this policy • Notify you of significant changes by:

Email (if we have your email address)
Prominent notice on our website
SMS (for significant changes affecting your rights)

16.3 We will give you reasonable notice of any changes that require your consent or significantly affect your rights.

16.4 We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.

16.5 By continuing to use our services after we have notified you of changes, you are deemed to have accepted the updated Privacy Policy.

16.6 Previous versions of this Privacy Policy are available on request.

17. MARKETING COMMUNICATIONS

17.1 We may send you marketing communications about our services and special offers if: • You have given us consent to do so, or • You are an existing customer and we are marketing similar services, and you have not opted out

17.2 Types of marketing we may send: • Email newsletters • SMS text messages (with your consent) • Postal mailings (with your consent) • Telephone calls (with your consent)

17.3 Marketing content may include: • Special offers and promotions • New services and products • Service reminders (e.g., “Your annual boiler service is due”) • Seasonal tips and advice • Customer surveys and feedback requests

17.4 How to opt out of marketing:

Email: • Click the “unsubscribe” link at the bottom of any marketing email • This will take effect immediately

SMS: • Reply “STOP” to any marketing text message • This will take effect immediately

Telephone: • Inform us during any marketing call that you wish to opt out • This will take effect immediately

All Channels: • Email us at: helpdesk@homeassist365.co.uk • Call us on: 0117 9474040 • Write to us at: Henleaze Business Centre, Harbury Road, Bristol, BS9 4PN

17.5 Effect of opting out: • You will stop receiving marketing communications • You will continue to receive service-related communications (appointment confirmations, invoices, safety notices, etc.) • We will retain your contact details on our suppression list to ensure we do not send you marketing in future

17.6 Service Communications (Non-Marketing):

Even if you opt out of marketing, we will still send you important service communications, including: • Appointment confirmations and reminders • Invoices and payment receipts • Gas safety certificates and other documentation • Important service updates or safety notices • Responses to your enquiries • Warranty and guarantee information

These communications are necessary for the services we provide and cannot be opted out of while you remain our customer.

18. AUTOMATED DECISION-MAKING AND PROFILING

18.1 Automated decision-making means making a decision about you using automated processes (technology) without human involvement.

18.2 Profiling means automated processing of your personal data to evaluate certain aspects about you, such as your preferences, interests, or creditworthiness.

18.3 Our Use of Automated Decision-Making and Profiling:

We do not use automated decision-making or profiling to make decisions that have legal effects or similarly significantly affect you.

All significant decisions are made by people, not algorithms. For example: • Quotations and pricing are determined by our engineers based on site assessment • Service recommendations are made by qualified engineers • Complaints are handled by our customer service team • All business decisions involve human review

18.4 Third-Party Automated Decision-Making:

When you apply for finance, the finance provider may use automated systems to: • Assess your credit application • Check your credit score • Make lending decisions

However, these decisions are made by the finance provider, not by us, and are subject to the finance provider’s privacy policy. Most finance providers include human review in their decision-making process.

If a finance application is declined based on automated decision-making, you have the right to: • Request human intervention • Obtain an explanation of the decision • Challenge the decision

Please contact the finance provider directly for more information about their decision-making processes.

18.5 Future Changes:

If we introduce automated decision-making or profiling in future, we will: • Update this Privacy Policy • Notify you clearly • Obtain your explicit consent where required by law • Provide meaningful information about the logic involved • Give you the right to obtain human intervention • Allow you to express your point of view • Enable you to challenge the decision

19. INTERNATIONAL TRANSFERS

19.1 Your personal data is primarily stored and processed in the United Kingdom.

19.2 We do not routinely transfer your personal data to countries outside the United Kingdom. However, your data may be transferred internationally in limited circumstances:

Cloud Storage: • Some of our IT service providers may store data on servers located outside the UK • We ensure appropriate safeguards are in place for such transfers

Finance Applications: • Credit reference agencies may transfer data internationally as part of their global operations • Such transfers are subject to appropriate safeguards

Third-Party Services: • Some of our software providers (e.g., CRM, email platforms) may process data outside the UK • We ensure they comply with UK GDPR requirements

19.3 Safeguards for International Transfers:

When we transfer your data internationally, we ensure it is protected by using one or more of the following safeguards:

Adequacy Decisions: • Transfer to countries that the UK government has determined provide adequate data protection

Standard Contractual Clauses: • Use of Standard Contractual Clauses (SCCs) approved by the UK government • These are legal contracts that require the recipient to protect your data

Binding Corporate Rules: • For transfers within multinational organisations that have approved internal data protection policies

Other Approved Mechanisms: • Certification schemes • Codes of conduct

19.4 Further Information:

If you would like more information about where your data is processed and the safeguards in place, please contact our Data Protection Officer using the details in section 2.2.

20. DATA SOURCES

20.1 We collect most of your personal data directly from you. However, we may also obtain information from other sources:

Credit Reference Agencies: • When you apply for finance, we obtain credit information from agencies such as:

Experian
Equifax
TransUnion • They provide information about your credit history and creditworthiness

Fraud Prevention Agencies: • We may check information with fraud prevention agencies to verify your identity and prevent fraud

Publicly Available Sources: • Companies House (for business customers) • Land Registry (for property ownership verification) • Electoral Register (for identity verification) • Online directories and databases

Third Parties Who Refer You: • Estate agents, letting agents, or landlords (if they refer you to us) • Insurance companies (if you are making a claim) • Other tradespeople or contractors

Manufacturers: • Boiler and equipment manufacturers may share warranty information with us

Previous Service Providers: • If you transfer from another heating company to us, we may obtain service history (with your consent)

20.2 When we obtain data from third-party sources, we will: • Inform you at the point of collection (where possible) • Only use it for the purposes for which it was obtained • Ensure it is accurate and up-to-date • Protect it in accordance with this Privacy Policy

21. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Company Name: Home Assist 365 Ltd

Data Protection Officer: Shaun Downton

Email: helpdesk@homeassist365.co.uk

Telephone: 0117 9474040

Address: Home Assist 365 Ltd Henleaze Business Centre Harbury Road Bristol BS9 4PN

Company Registration Number: 11955704 Gas Safe Registration Number: 632778 FCA Firm Reference Number: 971539

We aim to respond to all enquiries within 2 working days.

22. REGULATORY INFORMATION

22.1 Data Protection Registration

We are registered with the Information Commissioner’s Office (ICO) as a data controller.

Our ICO registration can be verified at: https://ico.org.uk/ESDWebPages/Search

22.2 Financial Services Regulation

Home Assist 365 Ltd (FRN: 971539) are an appointed representative of Koze Group Ltd, a credit broker not a lender. Koze Group Ltd are authorised and regulated by the Financial Conduct Authority (FRN 811281) registered in England (08357963).

You can verify our FCA registration at: https://register.fca.org.uk/

22.3 Gas Safe Registration

We are registered with Gas Safe Register to carry out gas work.

Our Gas Safe registration number is: 632778

You can verify our registration at: https://www.gassaferegister.co.uk/

23. GLOSSARY

This glossary explains some of the technical terms used in this Privacy Policy:

Anonymisation: The process of removing all identifying information from data so that individuals cannot be identified.

Consent: Freely given, specific, informed, and unambiguous agreement to the processing of personal data.

Data Controller: The organisation that determines the purposes and means of processing personal data.

Data Processor: An organisation that processes personal data on behalf of a data controller.

Data Subject: An individual whose personal data is being processed.

Personal Data: Information relating to an identified or identifiable individual.

Processing: Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

Profiling: Automated processing to evaluate certain personal aspects about an individual.

Special Category Data: Sensitive personal data such as health information, racial or ethnic origin, religious beliefs, etc.

Third Party: An organisation or individual other than the data subject, controller, or processor.

UK GDPR: The UK General Data Protection Regulation, the UK’s data protection law based on the EU GDPR.

24. POLICY INFORMATION

Policy Title: Privacy Policy

Policy Owner: Data Protection Officer – Shaun Downton

Approved By: Board of Directors