How we handle your data.

1. Who we are

Marshall Climate Control Ltd ("Marshall", "we", "us") is a Cheshire-based air-conditioning and heat-pump installation business based at Unit 4, Tabley Business Park, Knutsford WA16 0PD. We're the data controller for any personal data you share with us in the course of getting a quote, having a system fitted, or using our website.

You can reach the data controller by emailing [email protected] or calling 01565 555 0124. There's no separate Data Protection Officer — David Marshall handles data questions personally.

2. What we collect

We collect the smallest amount of data we can get away with. In practice that means:

• Your name, phone, email and postcode — when you fill in the contact form, send a desktop-survey enquiry, or call us. Without these we can't quote, schedule or invoice.
• Photos and measurements of the room — when you submit a desktop survey. We use these to size the system and decide which kit suits the space.
• The address of the install — once you've booked. This goes on our schedule, on the F-Gas commissioning record, and on the invoice.
• Payment details — for invoicing only. We don't store card numbers; payments go through our bank or Stripe, both of which are PCI-DSS compliant.
• Service-history records — once we're servicing your system. This includes refrigerant charge logs, fault records, and engineer visit notes. Some of this we're required by F-Gas regulations to keep.
• Anonymous browsing data via Google Analytics 4 — pages you visited, clicks on phone or email links, what device you used. Only if you accept analytics cookies.

We don't collect special-category data (health, religion, political views, etc.), and we don't use any kind of behavioural profiling.

3. Why we collect it

Each piece of data has a single, clear purpose:

• Contact details — to reply to your enquiry, send quotes, schedule visits, send invoices.
• Photos / measurements — to size the system and produce a no-obligation recommendation.
• Install address — operational. We need to know where to send the engineers.
• Service history — partly operational (we need to know what we last did), partly regulatory (the F-Gas register requires it).
• Analytics — to understand which pages help and which don't, so we can improve the site.

Our legal basis for processing under the UK GDPR is "performance of a contract" for everything install-related, "legal obligation" for the F-Gas register entries, and "consent" for analytics and marketing cookies.

4. How long we keep it

• Enquiries that don't lead to a quote: 12 months, then deleted.
• Quotes that didn't get accepted: 24 months, then deleted.
• Invoice and payment records: 7 years (HMRC requirement).
• F-Gas register entries: 5 years from the last entry (regulatory requirement).
• Service history: for as long as the system is on a service plan, plus 7 years afterwards (warranty support and tax records).
• Photos from desktop surveys: deleted within 90 days if you don't proceed; kept for the install file if you do.
• Analytics data: 14 months in Google Analytics, then automatically purged.

5. Who we share it with

We share data only when there's a clear operational reason:

• Our accountant (Eaton & Cole, Wilmslow) — for tax and VAT returns.
• Manufacturers (Daikin, Mitsubishi, Toshiba) — to register the warranty on your unit. They get your name, the install address and the unit serial number.
• The F-Gas register — for any system above the regulated refrigerant threshold. This is a regulatory requirement.
• Payment processors (our bank, Stripe) — for invoice payment.
• Google Analytics — only if you accept analytics cookies; only anonymised data.

We never sell your data. We never share with third-party advertising networks. We don't run any kind of email broadcast list.

6. Your rights

You can ask us, at any time, to:

• Tell you what data we hold about you (a "subject access request" — free, within a month).
• Correct anything that's wrong.
• Delete data we no longer need (subject to the regulatory minimums above).
• Stop using your data for any purpose where consent is the legal basis (analytics cookies, in practice).
• Get a copy of your data in a portable format.

Email [email protected] with the subject line "Data request" and we'll handle it within a calendar month, usually within a fortnight.

7. Cookies and analytics

We use three categories of cookie, as set out in the consent banner you see on first visit:

• Strictly necessary — required for the site to function. Things like remembering you've seen the cookie banner. Always on; you can't opt out without breaking the site.
• Analytics — Google Analytics 4. Helps us see which pages people use and where the friction is. Aggregated only; no individual tracking. Off by default.
• Marketing — currently unused. The toggle's there in case we ever run a paid campaign and need to measure it. Off by default.

Change your choices any time via the Cookie settings button at the bottom of every page.

8. Complaints

If you're unhappy with how we've handled your data:

1. Email [email protected] first — most issues clear up here. We respond within five working days.
2. If we can't resolve it, you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

For complaints about the technical work itself (rather than the data), see the complaints procedure in our terms of service — it routes through REFCOM, which we're an Elite member of.

9. Changes to this policy

We update this policy when something genuinely changes — a new tool we use, a new regulatory requirement. Trivial wording fixes don't count. When we update it, we'll change the "last reviewed" date at the top, and if the change affects you (e.g. a new third party we share data with) we'll email any active customers about it.