Privacy notice

How HEY collects, uses and protects your personal data. Version 1.1 · Effective 27 October 2026 · Published at www.heyhomes.co.uk/privacy.

1. Who we are

This Privacy Notice explains how Hey Homes Group Ltd (“HEY”, “we”, “us”, “our”) collects and uses personal data about you when you use our website www.heyhomes.co.uk, book a visit, join a HomeSaver service and maintenance plan, call or email us. It is written to meet our duties under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

Controller. Hey Homes Group Ltd (company number 14649881), registered office Sunrise House, Hulley Road, Macclesfield, England, SK10 2LP, is the controller of your personal data. We trade as HEY.

Contact us about your data

Email	info@heyhomes.co.uk
Phone	[01625 XXX XXX] (8:00am to 5:00pm, Monday to Friday (excluding bank holidays))
Post	Data Protection, Hey Homes Group Ltd, Sunrise House, Hulley Road, Macclesfield, England, SK10 2LP

We have not appointed a Data Protection Officer because we are not required to, but the person responsible for data protection at HEY can be reached using the details above.

Our website and services are not intended for children and we do not knowingly collect personal data about children, except where a child’s details are incidentally recorded as an occupant (for example, a note that a vulnerable person lives at the property).

2. The personal data we collect

Type of data	What it includes
Identity	Name, title, and (for landlords) whether you are the owner or landlord of the property.
Contact	Postal address, address of the property we visit, email address and phone numbers; tenant or site contact details given to us by a landlord.
Property and appliance	Property type, boiler make, model, fuel and age, appliance location, access notes, service history, safety certificates (including landlord gas safety records and oil CD/11 and CD/12 records), engineer notes, photos of the installation, and parts fitted.
Plan and transaction	HomeSaver plan, fuel and tier, Plan Start Date, renewal dates, prices, invoices, payments and arrears, and refunds.
Financial	Tokenised debit or credit card details for recurring HomeSaver monthly payments, online Invoice Portal payments, Apple Pay / Google Pay and phone payments (processed by Stripe; we never store full card numbers), and card details for on-site engineer card reader payments (processed by SumUp).
Communications	Emails, letters, messages, website form submissions, notes of calls and call recordings, complaints and feedback.
Vulnerability and accessibility	Information you choose to give us so we can help you safely, for example that you are elderly, have a disability or medical condition, or need a priority visit or a different way of contacting you. This can include health information (special category data).
Technical and usage	IP address, browser and device type, pages viewed and how you use our website, collected through cookies only where you allow it (see our Cookie Policy).
Marketing preferences	Whether you have agreed to, or opted out of, marketing from us.

3. Where we get your personal data

• From you, when you book online, call, email, sign up to a plan, or speak to our engineers.
• From landlords and letting contacts, who give us tenant contact details so we can arrange access.
• From our engineers and systems, who record service and safety information when they visit.
• From Stripe and SumUp, who tell us whether recurring monthly card payments, online Invoice Portal payments, and on-site card reader payments succeed or fail.
• From prior domestic heating service and safety records (see section 5).
• From your device, through cookies and similar technologies where you consent (see our Cookie Policy).

4. How we use your personal data and our lawful bases

We only use your personal data where the law allows it. The lawful bases we rely on are: contract (to take steps before, and to perform, a contract with you); legal obligation (for example gas safety, tax and accounting laws); legitimate interests (where we have a genuine business reason that is not overridden by your rights and interests: you can object, see section 10); and consent (for example for analytics cookies and some marketing: you can withdraw it at any time).

Purpose	Types of data	Lawful basis
Taking bookings, arranging and carrying out visits, quotes and repairs	Identity, Contact, Property and appliance, Communications	Contract; legitimate interests where the booking is made by a landlord for a tenant (to arrange access)
Setting up and running your HomeSaver plan, including the Inspection, annual service, repair visits, renewal reminders and missed-payment notices	Identity, Contact, Property and appliance, Plan and transaction, Financial	Contract
Taking recurring monthly card payments, one-off payments and refunds, and recovering money owed	Identity, Contact, Plan and transaction, Financial	Contract; legitimate interests (to recover debts)
Gas and oil safety: keeping service and safety records, issuing landlord gas safety records, reporting unsafe situations as required by gas safety rules	Identity, Contact, Property and appliance	Legal obligation; legitimate interests (to keep safety records and show we work safely)
Recording and monitoring calls for training, quality, safety and to resolve disputes	Identity, Contact, Communications	Legitimate interests (to keep accurate records and improve our service)
Handling complaints, queries and legal proceedings	Identity, Contact, Communications, Plan and transaction	Contract; legal obligation; legitimate interests (to resolve complaints and defend our legal position)
Recording vulnerability or accessibility needs so we can help you safely	Vulnerability and accessibility (may include health data)	Legitimate interests; and for health data, your explicit consent, or where it is needed to protect someone’s vital interests
Annual boiler servicing and safety reminders where we hold prior appliance service records (see section 5)	Identity, Contact, Property and appliance	Legitimate interests (continuity of boiler servicing and safety)
Keeping our accounts and meeting tax law	Identity, Plan and transaction, Financial	Legal obligation
Running and protecting our website and systems	Technical and usage	Legitimate interests (security, fraud prevention, keeping our systems working)
Website analytics	Technical and usage	Consent (through our cookie banner)
Marketing our services by email or text	Identity, Contact, Marketing preferences	Consent; or, for our own customers, legitimate interests and the PECR ‘soft opt-in’ for similar services, with an opt-out in every message
Marketing by post	Identity, Contact, Marketing preferences	Legitimate interests (you can opt out at any time)

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Prior appliance servicing and safety records

Where we hold prior domestic heating service and safety records for your boiler — including your name, contact details, property and appliance details, service history and safety records — we use them so that households in our area can continue to receive boiler servicing and safety reminders (for example when your annual service or landlord gas safety check is due) and so we have your appliance’s service and safety history if we visit.

We rely on legitimate interests for this. Annual servicing helps keep gas, LPG and oil boilers safe, and landlords have legal duties to have gas safety checks carried out every year. We have weighed these interests against your rights: we only use the data you would expect a heating engineer to hold, we keep it secure, and we tell you about it in our first message to you.

• Your right to object and opt out. You can ask us to stop using your details for reminders, or to delete them, at any time, by replying to any of our messages, emailing info@heyhomes.co.uk or calling [01625 XXX XXX]. We will stop straight away and won’t contact you again unless you ask us to.
• Marketing. We will only send marketing emails or texts where the law allows it (for example where you have given consent that applies to us, or once you become our customer), and every message lets you opt out.
• Plans with other providers. Service or maintenance plans held with any other provider do not automatically move across to HEY. We will not take any payments from you unless you sign up with us.
• Retention. If you haven’t used our services within 24 months of your last recorded service, we delete your record, except where we must keep safety records for longer (see section 9).

6. Who we share your personal data with

We share your data only where we need to, and we do not sell it. Our service providers (processors and their sub-processors) may only use your data on our instructions, under a written contract, and must keep it secure.

Provider	What they do for us	Where data may be processed
Commusoft	Job management and customer records (CRM): bookings, engineer scheduling, job sheets, certificates, service reminders and customer emails	Mainly UK / European Economic Area (EEA); see section 7
Stripe (Stripe Payments UK Ltd)	Processing recurring HomeSaver monthly debit/credit card payments, online Invoice Portal payments, Apple Pay / Google Pay, MOTO phone card payments, and Stripe Tap to Pay in Commusoft. Stripe is authorised by the FCA and certified to PCI DSS Level 1, and is an independent controller for some data (see stripe.com/gb/privacy)	UK / EEA and United States; see section 7
SumUp	Taking on-site card reader payments (including Day-1 promotional service fees and one-off work)	Mainly UK / EEA; see section 7
Aircall	Our cloud phone system, including call recording, voicemail and texts	UK, European Economic Area (EEA) and United States; see section 7
Microsoft 365	Email, documents and file storage	UK / EEA, with some support access from other countries; see section 7
Xero and Hubdoc (Xero)	Accounting, invoicing and storing receipts and bills	United States, Australia, New Zealand and other countries; see section 7
Website hosting and Google Analytics	Running our website and, only with your consent, measuring how it is used	UK / EEA and United States; see section 7 and our Cookie Policy

We may also share your data with:

• boiler and parts manufacturers and merchants, for example to register or make use of a manufacturer’s warranty you ask us to register, or to order parts for your appliance;
• Gas Safe Register, OFTEC and the Health and Safety Executive, and the gas emergency service, where we must report or record safety information;
• professional advisers, auditors and our own insurers (in relation to our business, not your plan), where reasonably needed to run our business;
• debt recovery agents, if you owe us money and haven’t responded to our reminders;
• the police, HMRC, regulators, courts and other authorities, where the law requires it; and
• a buyer or successor, if we sell or reorganise all or part of our business, under the same protections as this notice.

7. International transfers

Some of our providers, such as Aircall, Microsoft and Xero, may store or access personal data outside the UK. When that happens we make sure your data is protected by one of the safeguards in UK data protection law:

• UK adequacy regulations, which apply to the EEA and certain other countries, and to US organisations certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge); or
• the ICO’s International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

For Aircall, transfers to the EEA rely on the UK’s adequacy regulations for the EEA; for any transfer to the United States we rely on the UK-US data bridge where the recipient is certified for it, and otherwise on the IDTA or the UK Addendum to the EU Standard Contractual Clauses included in Aircall’s Data Processing Addendum. You can ask us for more information about these safeguards using the details in section 1.

8. Call recording and card payments

We record calls to and from our phone system (Aircall) for training, quality, safety and to resolve disputes. We tell you at the start of the call that calls are recorded.

We protect your card details (PCI DSS). If you pay by card over the phone, call recording is paused while you give your card details, or you enter them using your phone keypad with DTMF masking, so that card numbers are not recorded, heard or stored in our call recordings. Card payments are processed by Stripe and SumUp, both of which are certified to the Payment Card Industry Data Security Standard (PCI DSS). We never store your full card number or security code.

9. How long we keep your personal data

Record	How long we keep it
Customer, job, service and safety records (including landlord gas safety records and oil records)	6 years after our last visit or the end of your plan, so we can show the work was done safely and deal with any legal proceedings
HomeSaver plan records, invoices, payment and accounting records	6 years after the end of the financial year they relate to (tax and company law)
Stored card payment tokens and payment references held via Commusoft and Stripe	For the life of your HomeSaver contract, then with the plan records above
Call recordings	90 days, unless a recording is needed for a complaint, dispute or safety investigation, in which case until that is resolved
Complaint records	6 years after the complaint is closed
Website enquiries and quotes that don’t lead to work	12 months
Prior appliance service records not used by us	Deleted 24 months after your last recorded service, unless you become our customer or we must keep safety records
Marketing preferences and opt-out (suppression) list	Until you change them; we keep a minimal suppression record so we don’t contact you again
Cookies	As set out in our Cookie Policy

When we no longer need your data, we securely delete or anonymise it.

10. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your data (this notice);
• access your personal data and get a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased in some circumstances;
• restrict how we use your data in some circumstances;
• object to our use of your data where we rely on legitimate interests (including annual boiler servicing and safety reminders), and object at any time to direct marketing;
• data portability: receive data you gave us in a commonly used, machine-readable format, where we rely on contract or consent;
• withdraw consent at any time where we rely on consent (this doesn’t affect anything we did before you withdrew it); and
• not be subject to decisions based solely on automated processing that significantly affect you.

To use any of these rights, contact us at info@heyhomes.co.uk, on [01625 XXX XXX] or by post. You don’t usually have to pay a fee. We may need to confirm your identity. We respond within one month, which we can extend by up to two further months for complex or numerous requests (we will tell you if so). To stop marketing, you can also use the unsubscribe link or reply STOP in any marketing message.

11. Keeping your data secure

We use appropriate technical and organisational measures to protect your data, including access controls, multi-factor authentication on our business systems where available, encryption in transit, limiting access to staff who need it, PCI DSS card-payment controls, and contracts with all our processors. If there is a personal data breach that is likely to result in a high risk to you, we will tell you and, where required, the ICO.

12. Complaints

If you have a concern about how we use your personal data, please contact us first at info@heyhomes.co.uk so we can try to put it right. We acknowledge data protection complaints within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Links to other websites

Our website and emails may link to other websites (for example Stripe, SumUp, Gas Safe Register or OFTEC). We are not responsible for their privacy practices: please read their privacy notices.

14. Changes to this notice

We keep this notice under review. If we make important changes, we will tell you by email or on our website before they take effect. Please tell us if your personal data changes, for example a new address or email address.

Last updated: 25 October 2026.