Privacy Policy
Last updated: 7 June 2026
1. Who we are
Carlton Fuller and Sons (trading as CAF Heating) is the data controller for the personal data described in this policy. Our registered address is 23 Pine Gardens, Horley, Surrey, RH6 7RA.
If you have any questions about how we handle your data, contact us at info@cafheating.co.uk or call 07956 876156.
2. What data we collect
We collect only what is necessary to carry out gas and heating engineering services:
- Name, address, and contact details (phone number and email)
- Property details relevant to the work requested
- Job history, quotes, invoices, and payment records
- Gas Safety Certificate records (where we issue or renew a certificate)
- Enquiry and correspondence records
- Website usage data collected via cookies (see Section 7)
We do not collect any special category data and we do not knowingly collect data from anyone under the age of 18.
3. How we use your data
We use your personal data to:
- Provide, schedule, and follow up on heating and gas engineering services
- Issue quotes, invoices, and Gas Safety Certificates
- Send service reminders (boiler servicing, annual certificate renewals)
- Respond to enquiries submitted via our website or by phone
- Meet legal obligations, including Gas Safe Register reporting requirements
- Improve our website and services through anonymised analytics
4. Our legal basis for processing
Contract performance - processing your data to quote, book, carry out, and invoice for services you have requested.
Legal obligation - retaining Gas Safety Certificate records as required by the Gas Safety (Installation and Use) Regulations 1998 and reporting to the Gas Safe Register where required.
Legitimate interests - sending service reminders for annual boiler servicing and certificate renewals. You may opt out of these at any time.
Consent - for any optional marketing communications. Consent can be withdrawn at any time by contacting us.
5. Who we share your data with
We do not sell your personal data. We may share it only with:
- Gas Safe Register - as required by law when issuing certificates or logging work.
- Software providers - our job management and invoicing software providers, who process data on our behalf under data processing agreements.
- Professional advisers - accountants or solicitors where required by law or to defend a legal claim.
All third parties are required to handle your data securely and in accordance with UK GDPR.
6. How long we keep your data
Gas Safety Certificates - 2 years minimum as required by the Gas Safety (Installation and Use) Regulations 1998. We retain our copies for 6 years to align with standard limitation periods.
Financial records (invoices, quotes) - 6 years, as required by HMRC.
Customer job records - 6 years from the date of the last job, to support warranty queries and legal claims.
Enquiries that did not lead to a job - deleted after 12 months.
7. Cookies and website analytics
Our website may use cookies or similar technologies to understand how visitors use the site. We use only strictly necessary cookies required for the site to function, and, where you have consented, analytics cookies to measure traffic and page performance. No advertising or third-party tracking cookies are used. You can adjust your browser settings to refuse cookies at any time.
8. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request erasure of your data (where we have no legal obligation to retain it)
- Restrict or object to how we process your data
- Receive your data in a portable format
- Withdraw consent where consent is the basis for processing
To exercise any of these rights, contact us at info@cafheating.co.uk. We will respond within one calendar month.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
9. Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Access to customer data within our systems is restricted to the engineers and administrators who need it to do their jobs.
10. Changes to this policy
We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to existing customers by email.