Privacy Policy

1. Introduction

Pipework HQ ("we", "our", or "us") is operated by **ADAIDigital Ltd**. We are committed to protecting the privacy of heating engineers, plumbers, and business users ("Tenants"), as well as their customers ("End-Users"). This Privacy Policy explains how we collect, store, process, and protect personal data in compliance with the **UK GDPR** and the **Data Protection Act 2018 (DPA 2018)**.

2. Data We Collect

For Tenants (Heating & Plumbing Professionals):

• **Account Information:** Name, email address, phone number, company name, company registration numbers, VAT registration details, Gas Safe / OFTEC accreditation IDs, and credentials.
• **Payment Details:** Payment cards and bank details processed securely via our payments partner, Stripe. We do not store raw card numbers on our servers.

For End-Users (Customers of our Tenants):

• **Customer & Property Records:** Name, physical property address, billing address, contact phone number, and email.
• **Compliance & Service History:** Boiler manufacturer, model, appliance location, safety test records, combustion analyzer readings (CO/CO₂ ratios), and service logs.

3. How We Use Your Data

We process personal data strictly under the following lawful bases:

• **Contractual Performance:** To manage user accounts, coordinate job diaries, issue sequential compliant invoices, and route Stripe Connect payments.
• **Legal Obligation:** To preserve tax archives and sequential billing registries in accordance with HMRC VAT notice 700/22 guidelines.
• **Consent:** To dispatch automated annual service reminders or outreach notices on behalf of our Tenants (which can be toggled off at any time).

4. Data Storage & Residency

All application data, customer databases, and files are hosted securely on Google Cloud and Firebase. In compliance with UK data protection regulations, all servers and data storage facilities are restricted exclusively to the **London region (europe-west2)**.

5. Cookies & Tracking

We use only essential session cookies required to authenticate accounts, persist user sessions, and maintain offline persistent local caches for mobile device support. We do not engage in cross-site behavioral tracking or profiling.

6. Your Rights

Under the UK GDPR, you have the right to access, rectify, or request erasure of your personal data, as well as the right to restrict processing and data portability. To exercise these rights, please contact our data team at **[email protected]**.