Privacy Policy

Last Updated: 27/11/2025

1. Plain‑English summary (the short version)

When you submit an enquiry on Plumbing Surrey, we collect the basic contact details you type into our form so we can introduce you to one qualified plumber in Surrey. We share your enquiry only with that plumber, retain a limited record for a short period, and never sell or publish your information. You can ask us to stop, correct, or erase your data at any time. The sections below explain exactly what we collect, why, and how you can exercise your rights.

2. Who we are

ReachAI Ltd ("ReachAI", "we", "us", "our") operates the website Plumbing Surrey at http://www.plumbingsurrey.com.

Company number: 15123686
Registered office: 3 Paddock Close, Worcester Park, England, KT4 7LY
Email for privacy queries: [email protected]

We are the controller of the personal data you provide on this Site. Once your details are passed to a plumber, that plumber becomes an independent controller of any further communications.

We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR.

3. What personal data we collect

When you submit our enquiry form, we collect:

Service type you are interested in
Full name
Phone number
Email address

We also store (server-side) your IP address and the date/time of submission for security and audit purposes.

We do not intentionally collect any special-category data (such as health information) or data about children. This service is intended for UK residents aged 18 or over.

4. How we use your data and our lawful basis

Purpose

Lawful basis

Explanation

Forwarding your enquiry and contact details to one vetted Surrey plumber so they can contact you with a quote

Consent – Article 6(1)(a) UK GDPR

You provide your consent before submitting the form, granting us permission to share your details solely for this purpose.

Purpose:

Forwarding your enquiry and contact details to one vetted Surrey plumber so they can contact you with a quote

Lawful Basis:

Consent – Article 6(1)(a) UK GDPR

Explanation:

You provide your consent before submitting the form, granting us permission to share your details solely for this purpose.

Purpose:

Retaining a minimal record for fraud prevention, dispute handling, and internal audit

Lawful Basis:

Legitimate interests – Article 6(1)(f)

Explanation:

We maintain a limited record for a short, defined period to manage service quality and prevent abuse. We balance this interest against your rights by retaining the data only as long as necessary (see Section 7).

Retaining a minimal record for fraud prevention, dispute handling, and internal audit

Legitimate interests – Article 6(1)(f)

Server logs and essential cookies needed for site functionality and security

Legitimate interests – Article 6(1)(f)

It is in our interest — and yours — that the site functions correctly and securely.

Purpose:

Server logs and essential cookies needed for site functionality and security

Legal Basis:

Legitimate interests – Article 6(1)(f)

Explanation:

It is in our interest — and yours — that the site functions correctly and securely.

Measuring and improving website performance using Google Analytics

Consent – Article 6(1)(a)

Analytics cookies operate only if you give consent. They help us understand traffic and usage patterns.

Purpose:

Measuring and improving website performance using Google Analytics

Legal Basis:

Consent – Article 6(1)(a)

Explanation:

Analytics cookies operate only if you give consent. They help us understand traffic and usage patterns.

We do not use your data for our own marketing, profiling or automated decision‑making.

5. Who we share your data with

We share your information with:

One qualified Surrey plumber who meets our vetting criteria (proper certification, insurance, and customer feedback).
Processors who support our service infrastructure:
- GoHighLevel – CRM, website hosting, and form processing
- Cloudflare – security and performance

All processors act under our instructions and are bound by a written contract under Article 28 UK GDPR.

We will never sell your personal data nor disclose it to any other third party unless we are legally obliged to do so.

6. International transfers

Your data is stored and processed on GoHighLevel’s servers located in the United States. Transfers outside the UK/EEA are protected by:

the International Data Transfer Addendum (UK Addendum) to the EU Standard Contractual Clauses (SCCs); and
a completed Transfer Risk Assessment showing that the data receives an equivalent level of protection.

7. How long we keep your data

We keep:

the full lead details for 12 months after we pass them to the installer; and then
an anonymised record (postcode district + timestamp) for statistical reporting.

8. Cookies and similar technology

We use both essential and optional analytics cookies:

Cookie name

Purpose

Explanation

ps_session

Maintains session state while you complete the form

End of session

cf_clearance

Cloudflare bot-protection token

30 minutes

Cookie Name:

spb_session

Purpose:

Maintains session state while you complete the form

Duration:

End of session

Cookie Name:

cf_clearance

Purpose:

Cloudflare bot-protection token

Duration:

30 minutes

ga, gid, gat*

Google Analytics (optional; used only with your consent)

Up to 2 years

Cookie Name:

ga, gid, gat*

Purpose:

Google Analytics (optional; used only with your consent)

Duration:

Up to 2 years

You can accept or reject analytics cookies at any time via your browser settings or our on-site cookie banner.

9. How we protect your data

We use appropriate technical and organisational measures, including:

SSL/TLS encryption during transmission
AES-256 encryption at rest on production databases
Daily encrypted backups stored in AWS global infrastructure

10. Your rights

Under the UK GDPR you can:

Request a copy of the personal data we hold about you (right of access)
Ask us to correct inaccurate data (right to rectification)
Ask us to delete your data (right to erasure)
Object to or restrict our processing (rights to object & restriction)
Receive your data in a portable format (right to data portability)

To exercise any of these rights, email [email protected]. We will respond within one calendar month.

11. Automated decision‑making and profiling

We do not use your personal data for automated decision-making or profiling under Article 22 UK GDPR.

12. Complaints

If you are unhappy with how we handle your data, please contact us first.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk/make-a-complaint

13. Changes to this policy

We may update this notice from time to time to reflect changes in law or our practices. Updates will be signposted on the Site. The “Last updated” date above indicates when we last revised the policy.