SMB Boiler Services privacy policy

• Customer name
• Customer address (or address of site where works are to be carried out)
• Customer telephone number

• Please note if you have requested to be emailed we may also have a record of your email address

Article 6 of the GDPR explains data may only be processed under one of six lawful basis, the basis in which we process your information falls under the section below:

‘(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.’

We store data electronically within a locked application, which requires two step verification to gain access. This means your data is secure and can only be accessed by SMB Boiler Services. Data can be accessed by us through a smart device and remotely. Invoices and service reports are stored in a locked box to which only we have access, these are then destroyed within a 3 -7 year period in line with HMRC requirements for self employment. Contact information in the form of telephone numbers and email addresses are stored on the work mobile telephone which has password access and in the event of loss or theft can be deactivated at request by the mobile telephone provider. This will prevent access to the device and any data on the device.

If we do suspect a data breach we will always act quickly to contain this and make all data secure again. In addition to this we will contact anyone affected and work with them to ensure minimal harm is caused. Where we believe a data breach may risk peoples rights and freedoms this will be reported to the ICO. If you feel concerned that your data has been breached and is having a detrimental impact on you then you can also contact the ICO yourself via their website and raise this concern.

If you have any questions about how we process data that are not made clear in this policy or you would like to access data we hold about you, please get in contact with us. This service is free of charge and all data will be presented within 30 days of the request as per GDPR requirements. If you would like all the data we hold about you to be destroyed please let us know so that we can arrange this for you. In the event that you no longer require our services we will destroy all personal information we hold for you. This policy was published in May 2018 and will be reviewed annually and at the point where any relevant new requirements are set out by the GDPR.