Legal
Privacy Policy
This policy explains what personal information Combi Care Maintenance Ltd collects through this website, why, and what we do with it. We have written it to describe what actually happens rather than to cover every eventuality.
Who we are
Combi Care Maintenance Ltd is the data controller for the information described here. Our contact details are at the bottom of every page of this website.
What we collect, and when
If you use the quote calculator, we record your name, email address and phone number, whether you are a homeowner or a landlord, your postcode, the type and approximate age of your boiler, the kind of property, the cover level and billing option you chose, and anything you type into the optional message box.
We ask for your name and email address at this point for one reason: so that we can pass them to GoCardless when you go on to set up a Direct Debit. Without them you would have to type the same details a second time on their page. If you do not go on to set up cover, we keep the quote so we can follow it up, and delete it after twelve months.
If you complete a Direct Debit, GoCardless collects your name, email address, billing address and bank details on their own secure page. We never see your bank details. Once the mandate is set up we read your name and email address back from GoCardless so we can contact you about your cover, and we record the reference numbers for your customer record and mandate.
If you use the contact or callback form, we record your name, email address, phone number and your message.
If you simply browse, see the Website analytics section below.
Why we use it, and our lawful basis
- To answer your enquiry and set up your cover — necessary to take steps at your request before entering a contract, and afterwards to perform that contract.
- To keep records of the work we do — necessary for our legal obligations, including gas safety records.
- To understand how the website performs — our legitimate interests, using information that does not identify you.
We do not send marketing email unless you have asked us to, and we never sell your information.
Who we share it with
We share information only with the suppliers who make the service work, and only with what they need:
- GoCardless — to set up and manage your Direct Debit.
- Our hosting and email provider — who host this website and carry our email.
- Cloudflare — whose Turnstile check on our contact form tells us whether a submission came from a person or a bot. It receives your IP address and information about your browser, and is not used for advertising.
- Anthropic — when we generate marketing suggestions from our own traffic figures, we send only aggregate statistics such as total pageviews and which pages were popular. No personal information is ever included.
We may also disclose information where the law requires it. We do not sell or rent your information to anybody.
Website analytics
We measure how this website is used with our own analytics, running on our own server. We do not use Google Analytics or any other third-party analytics service, and analytics data about your visit is not sent to anyone else.
For each page viewed we record the address of the page, the website or search engine you arrived from if there was one, any campaign tags in the link you followed, whether you are on a desktop computer, mobile or tablet, the date and time, and whether the quote form was started or completed.
We also record a visitor reference, so that one person viewing five pages counts as one visitor rather than five. It is produced by combining your IP address, your browser’s user-agent string, the current date and a secret value held on our server, then passing them through a one-way cryptographic hash. The result cannot be turned back into your IP address, and because the date forms part of it, it changes every day — so it cannot recognise you on a later visit or build a picture of you over time.
To be explicit: we do not store your IP address; we do not record your location, city or country; we set no cookie for analytics; we do not attempt to identify you; and we do not use any of it for advertising.
If your browser sends a “Do Not Track” signal, our analytics does not run at all and nothing about your visit is recorded. Analytics records are automatically deleted after 24 months.
How long we keep things
- Quote enquiries that go nowhere — up to 12 months, then deleted.
- Customer and cover records — for the life of your cover and then 7 years, for accounting, insurance and gas safety purposes.
- Contact form messages — up to 24 months.
- Analytics — 24 months, deleted automatically.
Stopping spam
Almost every message this form receives is automated sales spam, so each submission is checked before it reaches us. We look at how quickly the form was filled in, whether the wording matches known spam patterns, and how many messages have arrived recently from the same browser. That last check uses the same daily-rotating one-way reference described under Website analytics — we do not store your IP address to do it.
If a message is flagged it is not deleted. It is set aside in a separate folder in our admin system, unread rather than gone, so that a genuine enquiry caught by mistake can still be found and answered. Flagged messages are kept for the same 24 months as any other, then deleted.
Keeping it secure
The website is served over HTTPS. Administrator passwords are stored only as bcrypt hashes, never as text, and repeated failed sign-in attempts are locked out. Card and bank details are handled entirely by GoCardless and never reach our systems.
Your rights
Under UK data protection law you can ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it or restrict how we use it, object to certain uses, and ask for it in a portable format. Email us and we will respond within one month.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.
Changes
If we change how the website handles personal information, we will update this policy.
Anti-bot check. Our contact form uses Cloudflare Turnstile, a challenge that distinguishes people from automated scripts. It is used instead of Google reCAPTCHA because it does not profile you or track you across other websites. When you use the form, Turnstile receives your IP address and information about your browser, and stores a short-lived token in your browser so it does not have to re-check you on the same visit. It is not used for advertising. Cloudflare’s own privacy notice explains what they do with it.