Privacy policy
How we collect, use and look after your personal information when you contact us, ask for a visit or a consultation, or use this website.
The short version
- We use your details to reply to you and to do the work you ask for.
- We only email you about your enquiry or your job. We don’t send marketing emails.
- Google Analytics only runs if you accept cookies.
- We never sell your information.
Last updated: [CONFIRM: date the site goes live]
Who we are
Hot Tub Repair Man is run by Jon Pennington as a sole trader. Jon is the ‘controller’ of your personal information. That means he decides how it’s used and is responsible for looking after it.
You can email us at htrm2022@gmail.com, or write to us at the address at the bottom of this page.
What we collect
When you use our contact form
Your name, phone number and email address, and your message. If you add them, we also get your hot tub’s make and model, how it’s installed, its address, and up to five photos.
When you ask for a visit or a consultation
What you fill in on the request form:
- the type of job, and for a consultation, whether you’d prefer a phone or video call
- your name, phone number and email address
- for a visit, the hot tub’s address and postcode, how it’s installed, and any notes about access
- for a consultation, your town and postcode
- your hot tub’s make and model, and your message
- up to three days and times that suit you
- any photos you add (up to five)
When you phone, email or message us on WhatsApp
Whatever you choose to tell us or send us, such as photos or videos of the problem.
When we do work for you
Details of the job and your hot tub, photos of the equipment we work on, and records of quotes, invoices and payments. We keep job records in Tradify, our job management system.
When you visit this website
Our hosting provider, Cloudflare, handles the technical information your browser sends with every visit, such as your IP address, browser type and the page you asked for. This is needed to show you the site and protect it from attacks. If you accept cookies, Google Analytics also collects information about how you use the site. See Cookies and analytics below.
When you use our online troubleshooter
You give us your first name and email address, tell us whether it’s a hot tub, swim spa or pool, and give the first half of your postcode (for example TR14), so we know whether we can visit you. Then you type your questions.
After the first answer, we email a summary of the chat to you and to us. It contains your name, email address, the type of equipment, your postcode district, your questions and the answers you were shown. The summary isn’t written by AI. It’s simply your questions and the answers you were shown.
We also keep a log of the questions people ask. It shows us what people need help with, so we can improve our help pages. Each entry holds the question, your email address, the type of equipment, your postcode district, whether we visit your area, what kind of answer it got and the date. We remove phone numbers and full postcodes from the question before it’s stored, and we don’t store your name in the log.
If you tick ‘Email me in a few days to check it’s sorted’, we send you one follow-up email about three days later. The box is never ticked for you. The email has a link to stop it, and you can also reply and tell us.
The answers are written automatically by Cloudflare’s AI service, using only our own help pages, so your questions are sent to it. We don’t use anything from the troubleshooter for marketing.
Spam checks on our forms
Our forms include a hidden field that only automated bots fill in, and a check that the form wasn’t sent within a few seconds of being opened. Our forms and the online troubleshooter also use Cloudflare Turnstile, which checks that a person, not a bot, is using them, based on technical information about your browser and device. Usually it works in the background, but now and then it may ask you to tick a box. It doesn’t set cookies on our website.
How we use it, and why we’re allowed to
UK data protection law says we need a lawful reason, called a ‘lawful basis’, for each way we use your information. These are ours:
| What we do | Lawful basis |
|---|---|
| Reply to your message or request, and arrange a visit or call | Steps you’ve asked us to take before a contract, and our legitimate interest in answering enquiries |
| Answer your questions in the online troubleshooter, and email a summary of the chat to you and to us | Steps you’ve asked us to take before a contract, and our legitimate interest in answering enquiries |
| Keep a log of troubleshooter questions, with your email address, to improve our help pages | Legitimate interests |
| Send the troubleshooter follow-up email, if you ticked the box | Your consent |
| Carry out the work, send invoices and take payment | Our contract with you |
| Keep accounts and tax records | Legal obligation |
| Contact you later about a job we did, for example about our guarantee | Legitimate interests |
| Measure how the website is used, with Google Analytics | Your consent, given in the cookie banner |
| Photograph the equipment we work on, and sometimes use photos of the hot tub on our website or social media | Legitimate interests |
| Keep our website and forms secure and free of spam | Legitimate interests |
We don’t make automated decisions about you, and we don’t build profiles of you.
Photos and videos
If you send us photos or videos, we use them to understand the problem and prepare for the job, for example so we can bring the right parts.
We photograph the equipment we work on for our records, and sometimes use photos of the hot tub on our website or social media. We don’t show people, house numbers or anything that identifies you; if you’d rather we didn’t use a photo, tell us and we’ll remove it.
Emails we send you
We only email you about your enquiry, your request or the work you’ve asked us to do. We don’t send marketing emails, such as servicing reminders, and we don’t keep an email list.
The troubleshooter follow-up email is the only exception, and only if you ask for it. If you tick ‘Email me in a few days to check it’s sorted’, we send you one email about your question about three days later. The box is never ticked for you, and the email has a link to stop it.
Who we share it with
We never sell or rent your information. We only share it with companies that help us run the business, and only what they need to do that:
- Cloudflare hosts this website and runs our spam checks. It also runs the online troubleshooter, including the AI that writes its answers and the log of questions.
- Google provides Google Analytics, which only runs if you accept cookies.
- Microsoft 365 provides our email, so it handles messages to and from our email address.
- Brevo sends the emails our website sends, from htrm2022@gmail.com: it delivers the requests you send through our website forms to our inbox, and sends the troubleshooter chat summaries and follow-up emails. Form requests reach us by email only and aren’t stored anywhere else.
- Tradify, our job management system, holds bookings, job records and invoices.
- Stripe takes card payments, if you choose to pay by card online.
- Cal.com will run online booking for remote consultations once it’s switched on. It will hold your name, email address and the time you choose, and Stripe will take the payment.
- Our accountant sees our invoices, to prepare our accounts and tax returns.
- WhatsApp, if you choose to message us there. WhatsApp’s own privacy policy applies.
We may also share information when the law requires it, for example with HM Revenue and Customs.
Information stored outside the UK
Some of our providers, such as Cloudflare and Google, may handle information outside the UK, including in the United States. When they do, they use the protections UK law requires, such as the UK–US ‘data bridge’ or contracts approved for the purpose.
How long we keep it
| Information | How long |
|---|---|
| Enquiries and requests that don’t lead to a job | 12 months, then deleted |
| Troubleshooter chat summaries, and the log of troubleshooter questions with email addresses | 12 months, then deleted |
| Requests to stop troubleshooter emails | For as long as we run the troubleshooter, so we don’t email you again |
| Customer, job and invoice records | 6 years, because HMRC needs us to keep business records |
| Photos and videos | Kept with the job record. Photos sent with an enquiry that doesn’t lead to a job are deleted with the enquiry. |
| Google Analytics data | 14 months |
| Your cookie choice | 6 months, stored in your own browser |
Your rights
You have the right to:
- ask for a copy of the information we hold about you
- ask us to correct anything that’s wrong or incomplete
- ask us to delete your information
- ask us to limit how we use it
- object to how we use it
- ask for your information in a format you can take elsewhere
- withdraw your consent at any time, where we rely on it
Some of these rights depend on the circumstances. For example, we have to keep invoice records for tax even if you ask us to delete them.
To use any of these rights, email us. It’s free, and we’ll reply within one month. We may need to check who you are first.
Complaints
If you’re unhappy with how we’ve handled your information, please tell us first, so we can try to put it right.
You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint.
Keeping it safe
We keep your information on password-protected accounts and devices, and only the people who need it to do your job can see it. No one else sees customer details, apart from the providers listed under Who we share it with.
Cookies and analytics
Our website only uses Google Analytics if you choose ‘Accept cookies’ in the cookie banner. It shows us which pages are visited and which buttons people use. We don’t send your name, phone number, email address or message to Google Analytics.
Our cookie policy lists everything the website stores in your browser, and explains how to change your choice.
Other websites
Our website links to other websites, such as Google, WhatsApp, hot tub makers’ manuals and the Health and Safety Executive. Their own privacy policies apply.
Changes to this policy
If anything changes, we’ll update this page. The date at the top shows when it was last updated.