1. Introduction and Identity of the Data Controller
This Privacy Policy is issued by GASHP LTD, a company registered in England and Wales, with its registered address at 135 Hawthorne Way Shelley, HUDDERSFIELD, HD8 8QF, United Kingdom. References to "GASHP LTD", "we", "us" or "our" throughout this document refer to GASHP LTD acting as a data controller in respect of the personal data described herein.
GASHP LTD is committed to protecting the privacy and security of your personal information. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. It also explains your rights under applicable data protection legislation and how to exercise them.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018 and any other applicable UK data protection legislation. References to "data protection law" or "applicable legislation" in this policy refer collectively to those instruments.
If you have any questions about this policy or about how we handle your personal data, please contact us at general@gashp.garden or by writing to us at our registered address above.
2. Data We Collect About You
We may collect, use, store and transfer different kinds of personal data about you depending on how you interact with our website, services and communications. We have grouped these categories as follows:
2.1 Identity and Contact Data
This includes your first name, last name, job title, company name, email address, telephone number and postal address. We collect this information when you submit an enquiry through our website contact form, correspond with us by email or telephone, or enter into a contractual relationship with us for the provision of our software development or technology consulting services.
2.2 Technical Data
When you visit our website at gashp.garden, we may collect information about your browser type and version, the operating system and platform you are using, your internet protocol (IP) address, the uniform resource locator (URL) of the page that referred you to our site, the pages you visit on our site and the date and time of your visit. This data is collected through standard web server logging mechanisms and, where applicable, through cookies and similar technologies as described in our Cookie Policy.
2.3 Usage Data
We collect information about how you use our website, including the pages you view most frequently, how long you spend on particular sections and the links you click. This information helps us understand the effectiveness of our website content and improve the user experience. Usage data is typically collected in anonymised or aggregated form wherever possible.
2.4 Communications Data
We retain records of correspondence between you and GASHP LTD, including emails, enquiry form submissions and any written communications sent in connection with our services or your enquiry. This includes the content of those communications and the date and time they were received or sent.
2.5 Contract and Transaction Data
If you become a client of GASHP LTD, we will collect and process additional information necessary for the performance of our contractual obligations to you. This may include details of the services you have procured, relevant technical specifications, project management communications, billing and payment information and records of service delivery. The specific data collected in this context will be governed by the applicable service agreement or contract entered into between you and GASHP LTD.
2.6 Marketing and Communications Preferences
If you have opted in to receive marketing communications from us, we hold a record of that consent including the date, the channel through which consent was obtained and the scope of what was agreed. We do not send unsolicited marketing communications.
We do not intentionally collect any special categories of personal data (such as information about your health, race, religion, political opinions, sexual orientation or trade union membership) through the operation of our website or the provision of our standard software development and technology consulting services. If such data is provided to us as part of a specific client engagement (for example where we are engaged to develop healthcare software that processes sensitive patient data), such processing will be governed by a separate data processing agreement and will be subject to appropriate technical and organisational safeguards.
3. How We Collect Your Personal Data
We collect personal data through the following channels and mechanisms:
- Direct interactions: You may provide us with personal data by completing our website contact form, emailing us at general@gashp.garden, calling us on +44 7424 103366, attending a meeting with us (whether in person or via video conferencing), or entering into a contract with us for the provision of services.
- Automated technologies: As you browse our website, we may automatically collect technical data about your device, browsing behaviour and patterns. We collect this data through the use of cookies, server logs and similar tracking technologies, subject to the terms of our Cookie Policy and any consent you may have provided.
- Third parties: We may receive personal data about you from publicly available professional profiles such as LinkedIn, from referrals by existing clients or professional contacts, from publicly available business registers and directories, or from data enrichment services where we have a legitimate interest in verifying or supplementing contact information provided to us.
4. Legal Basis for Processing
We will only process your personal data where we have a legal basis to do so under UK GDPR. The legal bases we rely upon are as follows:
4.1 Performance of a Contract
Where you have entered into a contract with GASHP LTD for the provision of services, or where you have requested that we take steps prior to entering into such a contract (for example by submitting a project enquiry), we process the personal data necessary to fulfil those contractual obligations or to respond to your pre-contractual request. Without processing this data, we would be unable to provide you with the services requested or to respond to your enquiry.
4.2 Legitimate Interests
We may process certain categories of personal data where we have a legitimate interest in doing so and that interest is not overridden by your rights and interests as a data subject. Our legitimate interests include: operating and improving our website; maintaining records of our professional communications and business relationships; responding to and following up on business enquiries; conducting business development activities; ensuring the security of our systems and data; defending or pursuing legal claims; and providing references or testimonials where appropriate and with your knowledge.
Where we rely on legitimate interests as a legal basis, we have carried out a balancing test to assess the impact of our processing on your rights. If you would like more information about this balancing test in relation to any specific processing activity, please contact us using the details provided in this policy.
4.3 Compliance with Legal Obligations
We may process personal data where necessary to comply with a legal obligation to which we are subject, including obligations under UK tax law, Companies Act 2006 record-keeping requirements, anti-money laundering legislation, or any other applicable regulatory or legal requirement.
4.4 Consent
Where we rely on your consent to process personal data — for example for the purpose of sending you marketing communications or for placing non-essential cookies on your device — we will only process that data in accordance with the specific consent you have provided. You have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of any processing we carried out prior to the withdrawal.
5. How We Use Your Personal Data
We use the personal data we collect for the following purposes:
- To respond to and manage enquiries and requests you submit to us, including enquiries received through our website contact form.
- To provide, manage and deliver the software development, cloud computing, AI, cybersecurity and technology consulting services we have been engaged to provide.
- To maintain accurate records of our professional engagements, including contracts, project specifications, delivery documentation and communications.
- To issue invoices and process payments in connection with services provided.
- To communicate with you about your project or enquiry, including providing status updates, requesting information and coordinating delivery.
- To send you marketing communications about GASHP LTD services, case studies, insights and events where you have given us your consent to do so, or where we have a legitimate interest in doing so (for example where you are an existing client or a professional contact who has expressed an interest in our services).
- To improve and maintain our website, including analysing usage patterns, diagnosing technical errors and testing changes.
- To comply with applicable legal, regulatory and tax obligations.
- To protect the security of our systems, data and communications, including detecting and preventing fraudulent activity.
- To defend or pursue legal claims where necessary.
6. Disclosure of Your Personal Data
We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients where necessary and proportionate:
6.1 Service Providers and Sub-processors
We engage trusted third-party service providers who process personal data on our behalf as data processors. These include cloud hosting providers (such as Amazon Web Services operating within UK or EEA data centres), email and communication platforms, project management software providers, accounting and invoicing software providers and website analytics services. All such processors are required to process personal data only on our documented instructions and to implement appropriate technical and organisational security measures.
6.2 Professional Advisers
We may share personal data with our legal advisers, accountants, auditors and insurers where necessary for the provision of their professional services to us.
6.3 Regulatory and Law Enforcement Authorities
We may disclose personal data to HM Revenue and Customs, the Information Commissioner's Office, the police or other regulatory or law enforcement authorities where we are required or permitted to do so by applicable law.
6.4 Business Transfers
In the event that GASHP LTD undergoes a merger, acquisition, reorganisation or sale of all or substantially all of its assets, personal data held by us may be transferred to the acquiring entity. We will take reasonable steps to ensure that any such transfer is effected in accordance with applicable data protection law and that the receiving party provides equivalent privacy protections.
7. International Transfers of Personal Data
GASHP LTD is a UK-based company and primarily processes personal data within the United Kingdom. We do not routinely transfer personal data to countries outside the UK or the European Economic Area. In the limited circumstances where such a transfer is required — for example where a cloud service provider operates infrastructure in a non-adequate country — we will ensure that adequate safeguards are in place in accordance with the UK GDPR International Data Transfer Agreement (IDTA) framework, UK adequacy regulations, standard contractual clauses approved by the ICO or other lawful transfer mechanisms. If you would like further information about the safeguards we rely upon for any international transfer, please contact us.
8. Data Retention
We retain personal data for no longer than is necessary for the purposes for which it was collected, taking into account our legal obligations, the nature of our contractual relationships and the reasonable expectations of individuals whose data we hold.
Our general retention periods are as follows:
- Enquiry data (where no engagement follows): We retain records of website enquiries and correspondence for a period of 12 months from the date of the last communication. After this period, enquiry records are securely deleted unless there is a specific reason to retain them (such as a dispute or legal claim).
- Client engagement records: Records relating to completed client engagements, including contracts, project documentation, communications and delivery records, are retained for a period of 7 years from the conclusion of the engagement. This period reflects our obligations under UK tax law and the limitation period for contract claims under the Limitation Act 1980.
- Financial and accounting records: Invoicing, payment and accounting records are retained for a minimum of 6 years in accordance with HMRC requirements.
- Marketing data: Where personal data is processed on the basis of consent for marketing purposes, we retain that data until you withdraw your consent or until 24 months have elapsed since your last positive engagement with our communications.
- Website analytics data: Website usage and analytics data is retained in aggregated or anonymised form and is not subject to standard personal data retention limits once anonymisation is complete.
At the end of each applicable retention period, personal data is securely deleted, destroyed or irreversibly anonymised. We do not retain personal data beyond the stated periods unless required to do so by law or to defend or pursue a legal claim.
9. Data Security
GASHP LTD takes the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, use, alteration or disclosure. These measures include:
- Encryption of personal data in transit using Transport Layer Security (TLS) protocols.
- Encryption of personal data at rest where stored on digital systems.
- Access controls and role-based permissions restricting access to personal data to authorised personnel only.
- Regular security patching and vulnerability management for all systems that process personal data.
- Staff training on data protection obligations and secure data handling practices.
- Contractual obligations imposed on all third-party processors requiring them to maintain equivalent security standards.
No method of electronic transmission or storage is completely secure. Whilst we take all reasonable steps to protect personal data, we cannot guarantee the absolute security of any data transmitted to or stored by us. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach and will notify you directly where required by law.
10. Your Rights Under UK GDPR
Under UK data protection law, you have the following rights in relation to your personal data:
10.1 Right of Access
You have the right to request a copy of the personal data we hold about you (a Subject Access Request). We will respond to verified requests within one calendar month, free of charge, unless the request is manifestly unfounded or excessive.
10.2 Right to Rectification
You have the right to request that we correct any inaccurate personal data we hold about you or complete any incomplete data. We will action verified rectification requests promptly.
10.3 Right to Erasure
In certain circumstances, you have the right to request that we delete the personal data we hold about you. This right applies where the data is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, where you have objected to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed. This right does not apply where we are required to retain data to comply with a legal obligation or to establish, exercise or defend a legal claim.
10.4 Right to Restriction of Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances — for example while a dispute about the accuracy of your data is being resolved, or where you have objected to our processing on the basis of legitimate interests and we are considering whether our grounds override your rights.
10.5 Right to Data Portability
Where we process your personal data on the basis of consent or performance of a contract, and the processing is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have that data transmitted to another data controller where technically feasible.
10.6 Right to Object
You have the right to object to our processing of your personal data where we rely on legitimate interests as the legal basis for that processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims. You have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time.
10.7 Rights Related to Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or significantly affects you. GASHP LTD does not use fully automated decision-making processes in its operations.
To exercise any of these rights, please contact us at general@gashp.garden or by writing to GASHP LTD, 135 Hawthorne Way Shelley, HUDDERSFIELD, HD8 8QF, United Kingdom. We will acknowledge your request within 5 business days and respond in full within one calendar month. In some cases, we may ask you to verify your identity before we process your request.
11. Cookies
Our website uses cookies and similar tracking technologies to enhance your browsing experience and to help us understand how visitors use our site. For full details of the cookies we use, how we use them, the legal basis for their use and how you can manage your cookie preferences, please refer to our Cookie Policy.
12. Marketing Communications
We may from time to time send you marketing communications about GASHP LTD services, insights, case studies and events. We will only do so where you have given us your explicit consent or where we have an existing business relationship with you and are relying on our legitimate interests to do so, and where doing so is not overridden by your rights and expectations.
You can opt out of receiving marketing communications from us at any time by contacting us at general@gashp.garden with the subject line "Unsubscribe" or by responding to any marketing email we send with a request to be removed from our mailing list. We will process all opt-out requests promptly and will not send further marketing communications once an opt-out has been processed.
13. Third-Party Links
Our website may contain links to third-party websites, services or platforms. This Privacy Policy does not apply to any third-party websites and we are not responsible for the privacy practices of any third party. We encourage you to read the privacy policy of any third-party website or service you access through a link on our site before submitting any personal data to that third party.
14. Children's Privacy
Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe that a child under 18 has provided personal data to us without appropriate parental or guardian consent, please contact us immediately at general@gashp.garden and we will take steps to delete that information as soon as reasonably practicable.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable legislation or regulatory guidance. We will publish any updated version on our website at gashp.garden with the date of the most recent revision clearly indicated. If we make any material changes to how we process your personal data, we will take reasonable steps to notify you of those changes — for example by posting a prominent notice on our website or by contacting you directly where we hold your contact information.
Your continued use of our website or services after any changes to this Privacy Policy take effect will constitute your acknowledgement of the updated policy. We encourage you to review this policy periodically to stay informed about how we are protecting your information.
16. Right to Complain
If you have concerns about how we process your personal data, or if you are dissatisfied with our response to any request you have made under Section 10 of this policy, you have the right to make a complaint to the Information Commissioner's Office (ICO), which is the UK's supervisory authority for data protection matters.
The ICO can be contacted at the following address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk.
Before making a complaint to the ICO, we would encourage you to contact us in the first instance so that we have an opportunity to address your concerns directly. Our contact details are set out at the beginning of this policy.
17. Contact Us
If you have any questions, concerns or requests relating to this Privacy Policy or our data protection practices, please contact GASHP LTD using the following details:
Data Controller: GASHP LTD
Address: 135 Hawthorne Way Shelley, HUDDERSFIELD, HD8 8QF, United Kingdom
Email: general@gashp.garden
Telephone: +44 7424 103366
Website: gashp.garden
We aim to respond to all data protection-related enquiries within 5 business days.