Data Protection (UK GDPR) Policy

1. Purpose

This policy sets out how Powerhaus Electrical Solutions Limited collects, uses, stores, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). It applies to personal data relating to customers, employees, apprentices, and subcontractors.

2. Scope

This policy applies to all directors, employees, apprentices, and subcontractors of Powerhaus Electrical Solutions Limited, and to all personal data processed by the company in any format, whether electronic or paper-based.

3. Data Controller and Responsibility

Powerhaus Electrical Solutions Limited is the data controller for the personal data it processes. As a small business with fewer than 250 employees, the company is not required to appoint a Data Protection Officer; overall responsibility for data protection compliance rests with the directors, and day-to-day oversight is exercised by Christian Alexander, Director and Nominated Technical Person. Queries regarding this policy or the company's data handling should be directed to Info@powerhaus-electrical.co.uk.

4. Personal Data We Process

4.1 Customers

Names, addresses, email addresses, phone numbers, details of enquiries and work carried out, photographs of the property or installation, and technical details of the property (such as roof type, electrical supply, and meter information) provided in connection with a quotation or installation.

4.2 Employees and apprentices

Contact details, bank details for payroll, National Insurance numbers, qualifications, training and CPD records, and time and attendance records, held for employment, payroll, and competency purposes.

4.3 Subcontractors

Contact details, qualifications, insurance details, and due diligence records held in the Subcontractor Due Diligence Register (PES-SDR-001).

5. Lawful Bases for Processing

• Performance of a contract — processing necessary to provide quotations and carry out work the customer has requested, and to administer employment contracts.
• Legal obligation — retaining records for tax, employment, building regulations, warranty, and MCS certification purposes.
• Legitimate interests — responding to enquiries, maintaining business records, and administering subcontractor relationships.
• Consent — direct marketing to individuals, which is only carried out with express consent and with the ability to opt out at any time, in accordance with PECR.

6. Data Protection Principles

The company processes personal data in accordance with the principles of UK GDPR Article 5: lawfully, fairly, and transparently; for specified and legitimate purposes only; limited to what is necessary; kept accurate and up to date; retained no longer than necessary; and processed securely. The company maintains records sufficient to demonstrate this compliance (accountability).

7. Retention

• Enquiries that do not proceed to work: up to 12 months, after which the data is securely deleted (including website form submissions held by our hosting provider).
• Completed jobs: 6 years from completion, in line with legal, tax, warranty, and complaint-handling obligations.
• MCS certification records: for the period required by MCS scheme rules.
• Employment and payroll records: for the periods required by HMRC and employment law.

8. Third Parties and Data Processors

Personal data is shared only where necessary with: our website host (Netlify, which processes and stores website form submissions), Google Workspace (business email and document storage), Airtable (survey and inspection records), MCS and our certification body NAPIT (installation registration and audit), building control or local authorities (notifiable works), and approved subcontractors (minimum data necessary). All processors are required to handle data in accordance with UK GDPR. Where a provider stores data outside the UK or EEA, the transfer is protected by safeguards recognised under UK GDPR, such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses. Personal data is never sold or shared with third parties for their own marketing purposes.

9. Security

Personal data is stored in access-controlled cloud systems limited to authorised personnel, with company accounts protected by strong passwords and two-step verification where available. The company website is served over HTTPS and enquiry forms transmit data securely. Paper records containing personal data are kept securely and disposed of by shredding. Devices used to access company systems are kept secured and updated.

10. Data Subject Rights

Individuals have the right of access to their personal data, and the rights to rectification, erasure, restriction of processing, objection, and data portability. Requests may be made by any means and are actioned free of charge within one calendar month. Requests are logged, and identity is verified before disclosure. If an individual is dissatisfied with the company's handling of their data, they have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

11. Personal Data Breaches

Any actual or suspected personal data breach is reported immediately to a director. The company will contain the breach, assess the risk to individuals, and where the breach is likely to result in a risk to the rights and freedoms of individuals, report it to the ICO without undue delay and within 72 hours of becoming aware. Where the risk is high, affected individuals will also be informed. All breaches, whether reportable or not, are recorded together with remedial action taken.

12. Website Privacy Policy

A customer-facing privacy policy consistent with this document is published on the company website at powerhaus-electrical.co.uk and is referenced by all website enquiry forms. It is kept under review and updated whenever the company's processing activities change.

13. Training and Compliance

All personnel are made aware of this policy and their responsibilities under it. Data protection awareness forms part of induction and ongoing training recorded in the Training and CPD Log (PES-TL-001). Non-compliance with this policy is treated as a serious matter and may result in disciplinary action.

14. Review

This policy is reviewed annually as part of the Management Review process, or sooner if there is a change in legislation, ICO guidance, or the company's processing activities. The review is recorded in the Document Control Register (PES-DCR-001).