Last updated: 4 August 2026
1. Who we are
heatpumpsaver.co.uk is operated by Heat Pump Saver Ltd ("we", "us", "our"), a UK company. For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller for the personal data described in this policy.
- Trading name: Heat Pump Saver Ltd
- Contact email: hello@heatpumpsaver.co.uk
Any question about this policy, or about your data specifically, should go to hello@heatpumpsaver.co.uk. We do not currently have a dedicated Data Protection Officer — enquiries are handled directly by the team at that address.
2. What personal data we collect
We collect three categories of personal data.
a) Data you give us directly
When you use the enquiry form on our contact page or a similar form elsewhere on the site to request installer information, we collect:
- Your name
- Your email address
- Your postcode, if you choose to give it (used to find installers covering your area)
- The reason for your enquiry (e.g. homeowner question, installer enquiry, correction, press)
- Any free-text message you write
- Whether you opted in to the newsletter (this is a separate, unticked-by-default checkbox)
b) Data collected automatically when you submit a form
- Your IP address, taken from the connecting request
- Your browser's user-agent string (browser and device type)
- The page you submitted the form from, and the page that referred you to us, where available
- The date and time of submission
c) Data collected through analytics cookies
We use Google Analytics 4 (GA4) to understand, in aggregate, how visitors use the site — which pages are read, how people arrive, and roughly how long a visit lasts. GA4 sets cookies and collects a pseudonymous client identifier, approximate location derived from your IP address, device and browser type, and on-site interactions. See Cookies below for more detail, including a known gap we are closing.
We do not collect financial information, government ID numbers, health data, or any "special category" data as defined by UK GDPR, and we ask that you do not include such information in the free-text message field.
3. Why we process your data, and our lawful basis
UK GDPR requires a lawful basis for every purpose we process data for. Ours are:
| Purpose | Lawful basis |
|---|---|
| Responding to a general enquiry, correction report, or press question you send us | Legitimate interests (Art. 6(1)(f)) — we need to process your message to reply to it, and a functioning contact channel is a reasonable, low-impact interest that does not override your rights. |
| Handling an installer-matching enquiry, including sharing it with a matched MCS installer | Article 6(1)(b), necessary to take steps at your request before a contract — when you ask to be connected with an installer, sharing the minimum data needed to make that introduction is the service itself. Where that basis does not cleanly apply (for example, general homeowner questions with no matching requested), we rely instead on legitimate interests in operating the enquiry and matching service you asked to use. |
| Sending you the newsletter | Consent (Art. 6(1)(a)) — only if you tick the newsletter checkbox. You can withdraw this at any time. |
| Website analytics (GA4) | Consent (Art. 6(1)(a)) for non-essential analytics cookies. See Cookies for the current state of consent collection on this site. |
| Keeping a fallback record of your enquiry if our database write fails | Legitimate interests (Art. 6(1)(f)) — so that your enquiry is not silently lost if a technical fault occurs. |
| Preventing abuse, fraud, or misuse of our forms, and meeting legal obligations | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) where applicable. |
4. Who we share your data with
We do not sell personal data. We share it only in the following circumstances:
- Matched MCS-certified installers. When you submit an enquiry asking to be connected with an installer, we share the details needed to make that introduction — typically your name, email, postcode, and the substance of your enquiry — with the installer(s) matched to your postcode area. Installers that receive leads through this site pay us to do so (see how we make money); once an installer has your details, they become a separate data controller for their own subsequent use of them, and their own privacy notice applies to what they do next. This is the core of the matching service, so if you would rather not be introduced to an installer, do not submit an installer-matching enquiry, or tell us at any point and we will not pass your details on.
- Service providers who process data on our behalf (data processors), including: our hosting and database provider, which stores enquiry submissions; our transactional email infrastructure, which delivers the notification of a new enquiry to our team's inbox; and Google, which processes analytics data under Google's own terms. These providers only process data under our instructions and cannot use it for their own purposes.
- Legal and safety exceptions. We may disclose data if required by law, to protect our legal rights, or to protect the safety of any person.
- We do not share your data with data brokers, advertisers for ad-targeting purposes, or any party outside the categories above.
5. Where your data is processed
This site is hosted on Cloudflare Pages, with enquiry data stored in a Cloudflare D1 database. Cloudflare operates a global network, and Google (which provides GA4) is a US-headquartered company — both may process data outside the UK. Where that happens, it is covered by contractual safeguards these providers offer their customers for international transfers, such as the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more detail on the specific safeguard used for any transfer by emailing us.
6. How long we keep your data
We keep personal data only for as long as we need it for the purpose it was collected, or as required by law.
- Enquiry and lead data (name, email, postcode, message) is retained for 24 months from the date of your last contact with us, after which it is deleted or anonymised. You can ask us to shorten this and delete your data sooner at any time — see your rights below.
- Newsletter opt-ins are kept until you unsubscribe or ask us to remove you.
- Analytics data is retained according to Google's standard retention settings for this GA4 property; we have not overridden Google's default.
7. Cookies
This site uses two kinds of cookie:
- Strictly necessary cookies used to keep the site functioning securely (for example, Cloudflare's own security cookies). These do not require consent under the Privacy and Electronic Communications Regulations (PECR) because the site cannot work properly without them.
- Analytics cookies set by Google Analytics 4 (typically named
_ga,_ga_*). These are non-essential and, under PECR and UK GDPR, require your consent before being set.
Known gap: at the time of writing, this site does not yet display a cookie consent banner gating GA4, so analytics cookies may currently be set on your first visit without a prior consent prompt. We are aware of this and are working to add one. Until it is in place, you can prevent analytics cookies by blocking third-party cookies in your browser settings, using a tracker-blocking browser extension, or the Google Analytics Opt-out Browser Add-on . We would rather tell you this plainly than imply a control exists that does not yet exist on this site.
8. Your rights
Under UK GDPR, you have the right to:
- Access — ask us for a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, subject to any legal reason we may need to keep it.
- Restriction — ask us to limit how we use your data while a query is resolved.
- Portability — ask for your data in a portable, machine-readable format, where technically feasible.
- Objection — object to processing based on legitimate interests, including for direct marketing.
- Withdraw consent — where we rely on consent (newsletter, analytics), withdraw it at any time, without affecting processing carried out before withdrawal.
To exercise any of these rights, email hello@heatpumpsaver.co.uk. We will respond within one calendar month, as required by law.
If you are unhappy with how we have handled your data, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
9. Automated decision-making
We use straightforward postcode-based filtering to show you relevant local installers. This is basic matching, not profiling that produces a legal or similarly significant effect on you, and we do not use it to make automated decisions about you without human involvement.
10. Children
This site is aimed at UK homeowners making decisions about heating their property. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
11. Changes to this policy
We may update this policy as the site or the law changes. Material changes will be reflected by updating the "last updated" date above. We encourage you to review this page periodically.
12. Contact
Questions about this policy or your data: hello@heatpumpsaver.co.uk. See also our terms of use, how we make money, and editorial policy.