Privacy Policy
How we look after your personal information · Version 1.3 · in force from 6 November 2026
This policy explains what personal information CMG Heating and Plumbing collects about you, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to our website, our online booking system, phone, email and text contact with us, and to the work we carry out at your property.
We have tried to write it in plain English. If anything is unclear, ask us and we will explain it.
1. Who we are
CMG Heating and Plumbing is the trading name of Chris Greenhalgh, a sole trader. We are the data controller for the personal information described in this policy, which means we decide how and why it is used.
| Data controller | Chris Greenhalgh, trading as CMG Heating and Plumbing |
| Address | 39 Wisbeck Road, Bolton BL2 2TA |
| chris@cmghp.co.uk | |
| Telephone | 01204 961827 |
| ICO registration reference | ZC217946 — verify at ico.org.uk |
There is no legal requirement for a business of our size to appoint a Data Protection Officer, and we have not appointed one. Any question about your data should go to Chris Greenhalgh at the details above.
2. What information we collect
Information you give us
- your name, and the name of anyone else we should deal with about the job;
- the address of the property, and your billing address if it is different;
- your telephone number and email address;
- details of the problem, the appliance or the work you want done;
- access arrangements — for example where a key is held, or when someone will be home;
- where relevant, landlord, tenant or letting agent details;
- payment details and payment references. We do not see or store your full card number — card payments are handled by our payment provider.
Information we create
- job notes, diagnostic findings, meter and appliance readings;
- photographs of the work (see section 7);
- gas safety records, commissioning checklists, certificates and invoices;
- records of our correspondence with you, including complaints.
Information collected automatically
- when you visit our website: your IP address, browser and device type, the pages you looked at and when. This comes from our hosting provider’s server logs and from any analytics we use;
- cookies and similar technologies — see section 8.
Information from other people
- from letting or managing agents, landlords or tenants, where they arrange work at a property;
- from insurers or warranty providers where a job is being handled under a claim or policy;
- from manufacturers, where we register an appliance guarantee on your behalf.
Calls to and from us
- recordings of incoming and outgoing telephone calls, and of any voicemail you leave. Our greeting tells you that calls may be recorded before the call is connected;
- details taken by the AI assistant that answers our telephone, and a written summary or transcript of the call, which are added to the job record. It tells you it is an AI assistant if you ask, and it never claims to be Chris.
3. Why we use it, and our legal basis
Data protection law requires us to have a legal basis for everything we do with your information. Ours are set out below.
| What we do | Information used | Our legal basis |
|---|---|---|
| Answer your enquiry and give you a quote or estimate | Contact details, property address, details of the job | Steps taken at your request before entering a contract |
| Book, plan and carry out the work | All contact, property, access and job details | Performance of our contract with you |
| Take deposits and payment, and chase unpaid invoices | Name, billing address, payment references | Performance of our contract with you |
| Issue gas safety records and notify Building Control of notifiable work | Name, property address, appliance details | Compliance with a legal obligation (Gas Safety (Installation and Use) Regulations 1998; Building Regulations) |
| Register appliance guarantees with manufacturers | Name, property address, appliance details | Performance of our contract with you |
| Keep accounting and tax records | Invoices, payment records | Compliance with a legal obligation (HMRC record-keeping) |
| Send service and safety-check reminders for work we have done | Name, contact details, appliance details | Our legitimate interests in keeping your system safe and maintained. You can opt out at any time |
| Send marketing emails or messages about our services | Name, email address | Your consent, or the “soft opt-in” where you are an existing customer. You can unsubscribe at any time |
| Handle complaints, and establish, defend or bring legal claims | Whatever is relevant to the matter | Our legitimate interests in defending our position, and compliance with legal obligations |
| Use photographs of work on our website and social media | Photographs of the installation | Our legitimate interests in showing our work — and your consent where the image could identify you, your property or the inside of your home |
| Record calls, and use an AI assistant to answer the telephone, take details and book appointments | Call and voicemail recordings, transcripts and the details given on the call | Our legitimate interests in answering the telephone while we are on site, in an accurate record of what was agreed, and in training and quality |
| Keep our website secure and understand how it is used | Technical and usage data | Our legitimate interests in a secure, working website; your consent for any non-essential cookies |
Special category information
We do not normally need information about your health or personal circumstances. Occasionally a customer tells us something so that we can adapt how we work — for example that someone in the household cannot be left without heating, or that a particular room needs to be approached in a certain way.
Where you tell us something of that kind, we record only what we actually need to do the job safely and considerately, we use it only for that purpose, and we delete it when it is no longer needed. Our legal basis is your explicit consent, or the protection of someone’s vital interests where the situation is urgent.
4. Who we share it with
We share your information only where we need to. We never sell your personal information, and we never share it for anyone else’s marketing.
| Who | Why |
|---|---|
| ServiceM8 — our job management and online booking system | Storing job records, scheduling, quotes, invoices and online bookings |
| Stripe — our payment provider | Taking card payments and deposits securely |
| Our bank | Receiving payment |
| Peers and Associates, Bury — our accountants | Preparing accounts and tax returns |
| Xero — our accounting system | Raising and recording invoices and payments, and keeping our accounting records |
| WellyBox — our receipt collection tool | Collecting purchase receipts and supplier invoices from our email into our accounting records |
| Zapier — our automation tool | Passing information between the systems above so it does not have to be re-typed |
| The Gas Safe Register | Notifying Building Control of notifiable gas work, and issuing your compliance certificate |
| Appliance manufacturers | Registering your guarantee |
| Your water supplier | Where water fittings work is notifiable to them |
| Merchants and suppliers | Ordering and delivering parts and appliances to your property |
| Our website host Hostinger, and Google Workspace for our email and file storage | Running the website and our email |
| Our insurers | Handling an insurance claim |
| A solicitor or debt recovery agent — only if one is ever needed | Recovering an unpaid invoice or dealing with a legal dispute. We do not have a solicitor on retainer, and this has not arisen |
| Approved subcontractors | Where part of your job is carried out by a subcontractor, they receive only what they need to do it |
| Regulators, HMRC, the police or a court | Where we are legally required to provide it |
5. Sending information outside the UK
Some of the providers we use are based outside the United Kingdom, or store data outside it. Where that happens, we make sure the transfer is covered by a legal safeguard recognised under UK data protection law — either the country has been formally recognised by the UK government as providing adequate protection, or the transfer is covered by the UK’s International Data Transfer Agreement or the UK Addendum to the standard contractual clauses.
You can ask us for details of the safeguards that apply to any particular provider.
6. How long we keep it
| Record | How long we keep it |
|---|---|
| Enquiries and quotes that did not lead to a job | 12 months |
| Job records, invoices and accounting records | 6 years after the end of the relevant tax year |
| Gas safety records | At least 2 years |
| Installation records, certificates and guarantee paperwork | For the length of the guarantee, then 6 years |
| Complaint records | 6 years from resolution |
| Photographs of work used on our website | Until we remove them, or until you ask us to |
| Marketing contact details | Until you unsubscribe or ask us to stop |
| Call and voicemail recordings, and call transcripts | 12 months |
| Website server logs | Held by our hosting provider for a short period and used only for security and troubleshooting |
The six-year periods reflect HMRC record-keeping requirements and the general limitation period for bringing a claim in England and Wales. When a retention period ends, we delete the information or anonymise it so it can no longer identify you.
7. Photographs of our work
We photograph our work for our own records, to support guarantee claims, and to show what we do on our website, social media and Google Business Profile.
We do not publish photographs that identify you or your address, and we do not publish images of the inside of your home without asking you first. Tell us at any time if you would rather we did not photograph your job, and we will not. If something is already published and you would like it removed, tell us and we will take it down.
8. Cookies
A cookie is a small file a website stores in your browser. Some are needed for the site to work. Others are optional, and we only set those if you say yes.
Your choice. When you first visit, a banner asks what you are happy with. Accept all and Reject all sit side by side and are just as easy to press as each other. Nothing optional is set until you choose, and saying no does not stop you using any part of the site or booking online.
You can change your mind at any time with the Cookie settings link at the bottom of every page. We remember your choice for 12 months, then ask again.
Analytics cookies (optional). Google Analytics 4 is only switched on if you allow analytics cookies. It is set up for statistics only: Google Signals, advertising personalisation and data sharing with other Google products are all switched off.
Marketing cookies (optional). These are only set if you allow marketing cookies. They tell us whether an advert led to a visit or a booking.
Cookies that need no choice. Cloudflare Web Analytics also counts page views. It sets no cookie and stores nothing on your device, so it is not part of the choice above.
Online booking takes place on our booking provider ServiceM8, at book.servicem8.com. That is a separate website with its own cookies, which are needed for the booking and payment to work.
You can also block or clear cookies in your browser settings at any time.
| Cookie | Purpose | How long it lasts |
|---|---|---|
| cmg_consent | Strictly necessary. Remembers your cookie choice so we do not ask on every page. | 12 months |
| wp-settings-1 and wp-settings-time-1 | Strictly necessary. Remembers screen preferences for anyone signed in to manage the website. These are never set for ordinary visitors. | 1 year |
| cmg_ga_optout | Strictly necessary. Only set if you used the earlier Google Analytics opt-out link. Keeps Analytics off for you. | 2 years |
| _ga | Analytics, only if you allow it. Google Analytics. Tells one visitor from another, so repeat visits from the same browser are not counted twice. | 2 years |
| _ga_3PJ89V4Q4E | Analytics, only if you allow it. Google Analytics. Keeps the pages viewed in one visit together, so a visit is counted once. | 2 years |
| _fbp | Marketing, only if you allow it. Meta (Facebook and Instagram). Tells us whether an advert led to a visit or a booking. Not in use until we start advertising. | 3 months |
9. Your rights
You have the following rights over the information we hold about you:
- Access — ask for a copy of the information we hold about you.
- Correction — ask us to correct anything that is wrong or incomplete.
- Erasure — ask us to delete information, where there is no good reason for us to keep it. We may need to keep some records for legal or safety reasons, and we will explain if that applies.
- Restriction — ask us to pause using your information while a query about it is resolved.
- Portability — ask for the information you gave us in a machine-readable format, or ask us to send it to someone else.
- Objection — object to us using your information where we rely on legitimate interests. You can object to direct marketing at any time and we will always stop.
- Withdrawing consent — where we rely on your consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it.
To exercise any of these, email chris@cmghp.co.uk or write to us at the address in section 1. We will respond within one month. There is no charge. We may ask you to confirm your identity first, so that we do not give your information to the wrong person.
An AI assistant answers our telephone and can take your details and arrange an appointment. It does not make any decision about you with a legal or similarly significant effect, and what it arranges is checked by us. Apart from that, we do not make decisions about you using automated processing alone, and we do not carry out profiling.
10. Keeping your information secure
We take reasonable steps to keep your information safe: devices are password protected and encrypted, accounts use strong passwords and two-factor authentication where it is available, and access to job and customer records is limited to Chris Greenhalgh and, where a job requires it, an approved subcontractor.
If a data breach happens that is likely to put your rights at risk, we will tell you, and we will report it to the Information Commissioner’s Office within 72 hours as the law requires.
11. Complaints
If you are unhappy with how we have handled your information, please tell us first at chris@cmghp.co.uk — we would rather have the chance to put it right.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
12. Changes to this policy
We review this policy from time to time and will publish any updated version at cmghp.co.uk/privacy with a new version number and date. Where a change materially affects how we use your information, we will tell you directly.
Version 1.3 · 6 November 2026 · CMG Heating and Plumbing (section 8 updated: cookie choice banner added. Version 1.2 was 11 September 2026.)