Privacy notice
What we hold about you, why we are allowed to, who else touches it, how long we keep it, and how to make us stop. Written against the actual database rather than from a template.
In short
- We hold what an installation needs: your name, your address, your email, and photographs of the parts of your home the system goes in.
- We do not sell it, we do not buy it, we do not profile you and there is no advertising on this site.
- The database and your photographs are held in London and do not leave the UK. Payments, email and hosting involve US providers.
- You can see it, correct it, take it elsewhere or have it deleted, and complaining to us about any of that is now a statutory right with a 30-day clock on our reply.
A summary, for orientation. The clauses below are the ones that bind us.
On this page
Who holds it
Duneair Ltd is the data controller for everything described here — we decide what is collected and why, and we are answerable for it.
- Company
- Duneair LtdRegistered in England and Wales, number 17411606
- Registered office
- 1 Duffield Road, Derby, England, DE1 3BB
- ICO registration
- ZC232015The public register of organisations paying the data protection fee, searchable at ico.org.uk.
- Data protection contact
- privacy@duneair.com
There is no data protection officer. We are not required to appoint one, and claiming a role nobody holds would be worse than saying so — privacy@duneair.com reaches the person who actually deals with this.
What we hold, why, and for how long
Everything below is what we actually store. Nothing is collected in case it turns out to be useful. Each row names the table it lives in, so this page can be checked against the database rather than taken on trust.
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Your order Name, email address, the address the system is being fitted at, its postcode, what you bought and what you paid. | To take the order, survey the property, fit the system, and prove what was agreed if either of us later needs to. | Contract | Six years after the end of the tax year the order falls in, which is the period HMRC requires business records to be kept for. |
| What happened to your order A dated trail of events — paid, scheduled, surveyed, installed, cancelled, refunded. | So that the history of a job is a record rather than a recollection. It is append-only by design: nobody can quietly rewrite it, including us. | Contract | With the order it belongs to. |
| Photographs of your property, and the documents about your system Photographs taken at the survey — walls, pipe routes, the outdoor unit position, the inside of the rooms concerned — the Room Study produced from them, and the paperwork the job produces: the heat load and MCS 020(a) sound calculations, the F-Gas commissioning certificate, your warranty registration, and photographs of the finished work. | To design the installation, agree the placement with you in writing before anything is drilled, evidence the condition of the property before and after, and be able to give you your own paperwork back years later when a warranty claim or a house sale needs it. | Contract | Seven years, matching the longest manufacturer warranty we sell, because a warranty claim turns on what was fitted and where. |
| Your AirCare subscription The subscription's status and price, and identifiers for the card mandate you gave at checkout. We never hold the card number — Stripe does. | To take the monthly payment you authorised, and to stop taking it when you cancel. | Contract | Six years after the subscription ends, for the same tax-record reason as the order. |
| Your service visits The date an engineer attended, who they were, what they measured, what they found and what they said needed doing. | Because it is the record that the annual service happened. A manufacturer warranty claim usually turns on being able to show it did, so this is evidence you may need years after the visit. | Contract | Seven years, with the photographs and for the same reason — it is warranty evidence, and the warranty outlives the plan. |
| Enquiries Name, email address, phone number if you give one, postcode, and whatever you write in the message. | To answer you. | Legitimate interests | Two years from the last message, unless it becomes an order — then it follows the order. |
| Quotes you asked us to email Email address, postcode, and the answers you gave the sizing questions. | To send you the price band you asked for, and to follow it up once. | Consent | Twelve months. |
| Newsletter signups Email address, and postcode if you gave one. | To send you the guides. | Consent | Until you unsubscribe, and then a record that you did for two years — so that a later import cannot add you back after you asked us to stop. |
| Installer applications Name, email, phone, company, the postcodes you cover, F-Gas and REFCOM registration numbers, certificate expiry dates and experience. | To assess whether we can offer you work, and to check that the certifications a legal install depends on are real and current. | Legitimate interests | Twelve months after we decide, unless we take you on. |
| Failed attempts to open an order page The order reference tried, the IP address it came from, and whether it worked. | To lock out anyone guessing at order references. An order page holds a home address and photographs of the inside of a house, so this is the control that protects them. | Legitimate interests | Ninety days. |
Where the bases come from
We do not buy personal data, we do not sell it, and we do not build profiles or make automated decisions about you. The sizing calculator is arithmetic on the answers you typed and decides nothing about you.
The photographs, specifically
This is the most intrusive thing we ask for, so it gets its own section rather than a row in a table.
To design an installation we need photographs of the rooms the units go in, the walls they fix to, and the route between them. They show the inside of your home. We know what that is worth, and they are treated accordingly.
- They sit in private storage. There is no public URL, and no browser can read the store directly
- They are reachable only through a link we generate for a specific person, which expires
- They are seen by the surveyor, the engineer doing your job, and us. Not by anyone else
- They are never used in marketing, on this site, or in a portfolio. If we ever wanted to, we would ask you first and take no for an answer
- They are kept for seven years, matching the longest manufacturer warranty we sell, because a warranty claim turns on what was fitted and where
You can ask us to delete them earlier and we will, unless there is a live warranty claim they are evidence in.
Who else touches it
These companies process data on our behalf, each under a contract that limits them to doing what we ask.
| Who | What they do | Where |
|---|---|---|
| Supabase | Hosts the database and the private storage the survey photographs sit in. | London (eu-west-2). Your data does not leave the UK here. |
| Stripe | Takes the payment and holds the card details. We never see a card number. | Stripe Payments Europe, in Ireland, with processing in the United States. |
| Resend | Sends the confirmation, the reminders and the receipts. | United States. |
| Vercel | Hosts the website, and keeps short-lived request logs that include IP addresses. | United States, with delivery from edge locations worldwide. |
| The address lookup | Turns your postcode into a list of addresses to choose from. It receives the postcode and nothing else — not your name, not your email. | United Kingdom. |
| The installer who does your job | Receives your name, address, phone number where given, and the Room Study, because somebody has to arrive at the right house with the right design. | United Kingdom. |
We also hand data over where the law requires it — a court order, a tax investigation, or a regulator with the power to demand it. We would tell you if that happened, unless we were prohibited from doing so.
When it leaves the UK
The database and the survey photographs are held in London and do not leave the country. Payments, email and website hosting involve transfers to the United States, because Stripe, Resend and Vercel process there.
Those transfers rely on the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK extension to the EU–US Data Privacy Framework where the provider is certified under it. Both are mechanisms the ICO recognises for sending personal data abroad.
How it is protected
Specifics rather than reassurance, because “we take security seriously” is not a control:
- Nothing reads the database from your browser. Every query runs on the server, and the key that can read anything never leaves it
- Every table has row-level security on with no policies, so the public key can do nothing at all
- Survey photographs sit in private storage, reachable only through an expiring link
- Your order page is protected by proving the email and postcode the order was placed with — not a password, so there is no password of yours for us to lose
- Repeated wrong guesses at an order reference lock that reference out. That is what the IP addresses we keep are for, and the only thing they are used for
- We never see or store your card number. Stripe holds it; we hold an identifier that is useless anywhere else
If there is ever a breach that puts you at risk, we will tell you, and we will tell the ICO within 72 hours as the law requires.
What you can make us do
These are your rights under the UK GDPR. Exercising them is free, and we answer within one month.
| Right | What it means in practice |
|---|---|
| See it | A copy of everything we hold about you, including the survey photographs. |
| Correct it | Tell us something is wrong and we fix it. Useful for an address that changed mid-job. |
| Delete it | We will, unless we must keep it — order records survive six years for HMRC. We will say plainly when that is the reason rather than refusing vaguely. |
| Restrict or object | Stop us using data we hold on legitimate interests, or freeze it while a dispute is sorted out. |
| Take it elsewhere | The data you gave us, in a machine-readable file. |
| Withdraw consent | Any time. Every newsletter carries an unsubscribe link, and your mail app's own unsubscribe button works too — we cannot send one without a link, because the code refuses to. For the quote email, which you asked us for, reply or write to privacy@duneair.com and we stop the follow-up. |
Email privacy@duneair.com. We may ask you to confirm the email address and postcode an order was placed with — the same check the order page makes. We are not going to hand somebody else's home address and house photographs to whoever asks for them.
Complaining about how we handle your data
This is now a statutory right
Use the form in the complaints document, or email us if you would rather. Both reach the same place and both start the same clock.
You do not have to come to us first. You can complain to the Information Commissioner's Office at any time — at ico.org.uk/make-a-complaint or on 0303 123 1113 — and doing so costs nothing and affects no other right you have.
Children
This is not a service for children and we do not knowingly collect data about them. Buying an installation requires being the property owner or having their written permission, which in practice means an adult.
Survey photographs sometimes show a family home. Please do not include people in them — we do not need them, and we will delete any that arrive.
Changes to this notice
The date at the top is when this last changed. If we change something that materially affects you — a new recipient, a new purpose, a longer retention period — we email anyone with a live order or subscription rather than quietly reposting the page.
Questions about any of it go to privacy@duneair.com.
What this document is written against
- UK GDPR, Articles 13 and 14Set the list of things this notice must tell you, at the moment data is collected.
- Data (Use and Access) Act 2025In force 19 June 2026. Adds the statutory complaints route in clause 8 and the recognised legitimate interests basis used in clause 2.
- Data Protection Act 2018The UK's implementing legislation, and the source of the ICO's enforcement powers.