1. Who we are
Jack Mundinano trading as Dr Heat Pump is the data controller for the personal information described in this notice. This notice covers this website, service and breakdown requests, request updates, and contact by email, telephone or WhatsApp.
For privacy questions or to exercise a data-protection right, email hello@drhp.co.uk or call 01242 350563.
2. Information we collect
Depending on how you contact us and what help you request, we may collect:
- your name, email address, telephone number and preferred contact details;
- the service property address, postcode and access information;
- details about the affected service, symptoms, fault codes, dates, equipment make and model, warranty or maintenance query;
- messages, request updates and records of our communications with you;
- optional JPEG or PNG photographs you choose to provide, including their filenames; and
- limited technical and security information needed to operate the website, prevent abuse and keep request access secure.
Please do not include unrelated or unnecessarily sensitive personal information in a request or photograph. Accepted photographs are checked and reprocessed to remove embedded source metadata before private storage.
3. How and why we use it
| Purpose | Lawful basis |
|---|---|
| Respond to an enquiry, assess a service or breakdown request, prepare an estimate, arrange a visit and provide the requested work. | Contract, including steps you ask us to take before entering into a contract. |
| Manage service history, warranties, complaints, payments, accounting and legal claims. | Contract; legal obligation where record keeping is required; and our legitimate interests in operating and protecting the business. |
| Protect request access, prevent misuse, investigate faults and maintain the security and reliability of the service. | Our legitimate interests in network and information security, fraud prevention and reliable service operation. |
| Respond to legal, regulatory, insurance or law-enforcement requirements. | Legal obligation or legitimate interests, depending on the request. |
The privacy checkbox on a request form confirms that you have read this notice. It is not consent for marketing, and we do not add service-request details to a marketing list.
4. Existing customer and equipment records
We may compare the details in a request with customer, property, equipment or previous service records we already hold so that the request can be handled accurately and duplicate records can be avoided. Staff review the request and decide what happens next.
We do not use solely automated decision-making that produces legal or similarly significant effects.
5. Who we share information with
We disclose only what is reasonably necessary. Recipients may include:
- website, business-system, data-hosting, cybersecurity and email providers acting for us;
- engineers, subcontractors, manufacturers, suppliers or warranty providers where needed to assess or complete your request;
- accountants, insurers, legal advisers and other professional advisers; and
- courts, regulators, emergency services or public authorities where disclosure is required or permitted by law.
If you choose to contact us through WhatsApp, Meta's own privacy terms also apply to that service. We do not sell personal information.
6. International processing
Some technology providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, we use an applicable UK adequacy regulation or approved contractual safeguards. Contact us if you would like more information about the safeguards relevant to your data.
7. How long we keep information
- Requests that do not lead to work: request details and correspondence are normally retained for no more than 12 months after the request is closed.
- Requests that lead to work: relevant customer, contract, service, warranty, payment and correspondence records may be retained for up to seven years after the end of the relevant service or accounting period.
- Request photographs: normally retained for no more than 12 months from submission. If a photograph becomes necessary evidence for completed work, a warranty, complaint, insurance matter or legal claim, it may be retained with that record for up to seven years.
- Secure access: one-use links and browser sessions expire automatically within hours. Security controls keep only limited information for the period needed to prevent abuse and investigate incidents.
- Backups: deleted or anonymised information may remain in protected backups for up to 30 days before those backups expire.
We may keep a record longer where a dispute, legal hold or statutory duty requires it. We review long-running records and delete or anonymise personal information when it is no longer needed.
8. Security and request access
We use access controls, encrypted transport, private file storage, malware checks and bounded one-use links to protect online requests. A secure request link gives access only to the individual request it was issued for. Do not forward that link; end the session when using a shared device.
No internet service can be guaranteed completely secure. If you think a request link or your information has been misused, contact us promptly.
9. Cookies
This website does not currently use advertising or analytics cookies. The secure request page uses a strictly necessary, short-lived cookie so that you can view and update one request. It is not used to track you across websites.
10. Your rights
Depending on the circumstances and lawful basis, you may have rights to ask for access to your personal information, correction, erasure, restriction, data portability, or to object to how it is used. Some rights are limited where we must keep information to meet a legal obligation or establish, exercise or defend legal claims.
You have the right to object to processing based on our legitimate interests. Tell us what you object to and why; we will stop unless we have compelling legitimate grounds to continue or the information is needed for legal claims.
Contact hello@drhp.co.uk to make a request. We may need to confirm your identity before disclosing or changing information.
11. Complaints
Please contact us first so we can try to resolve your concern. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
12. Changes to this notice
We review this notice when our services, suppliers or legal requirements change. The version date above identifies the notice presented when an online request is submitted.