Privacy Policy
Last updated: March 2026
George Lane Trading As Thames Boilers
1. Who We Are
Thames Boilers is the trading name of George Lane, a sole trader providing plumbing, heating, and gas services. For the purposes of data protection law, George Lane is the data controller, meaning we decide how and why your personal data is processed.
- Business Name: Thames Boilers
- Owner: George Lane
- Address: 14 Cowley Avenue, Greenhithe, Kent DA9 9PJ
- Email: hello@thamesboilers.co.uk
- Telephone: 01322 788418
- ICO Registration Number: ZB097839
This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Personal Data We Collect
We collect the following categories of personal data:
Information you give us
- Contact details: your name, address, email address, and telephone number
- Property details: the address where work is to be carried out
- Booking details: the service you have requested, preferred dates and times, and any description of the work needed
- Appliance details: boiler make, model, serial number, GC number, and other appliance information required for Gas Safe compliance and the issuing of gas safety certificates
- Payment details: payment card information is collected and processed securely by our payment providers (Stripe, Square, and GoCardless). We do not store your full card details on our systems.
Information collected automatically
- Website usage data: if you consent to analytics cookies, we collect information about how you use our website, including pages visited, time spent on pages, and your IP address
- Device information: browser type, operating system, and screen resolution (collected via cookies with your consent)
3. Why We Collect Your Data and Our Lawful Bases
Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out each purpose for which we use your data and the lawful basis we rely on.
| Purpose | Lawful Basis | Data Used |
|---|---|---|
| Processing your booking and providing the service you have requested | Contract – necessary to perform our contract with you | Name, address, email, phone, booking details |
| Processing payments for services | Contract – necessary to perform our contract with you | Name, payment details (processed by Stripe, Square, or GoCardless) |
| Sending you booking confirmations, appointment reminders, and service-related communications by email and SMS | Contract – necessary to perform our contract with you | Name, email, phone |
| Sending you SMS payment reminders | Legitimate interests – necessary to collect payment for services provided | Name, phone number, outstanding balance |
| Keeping business and tax records as required by HMRC | Legal obligation – required by law | Name, address, payment records, invoices |
| Maintaining Gas Safe compliance records and issuing gas safety certificates | Legal obligation – required by law | Name, property address, appliance details (make, model, serial number, GC number), details of gas work carried out |
| Managing bookings, job records, and invoicing via our field service management software (ServiceM8) | Contract – necessary to perform our contract with you | Name, address, email, phone, booking and job details, appliance details, invoices |
| Automating business processes such as booking confirmations, reminders, and record updates (via Make.com, n8n, and Cloudflare Workers) | Legitimate interests – efficient operation of our business | Name, email, phone, booking details |
| Using AI tools to assist with communications, job note summaries, and customer service (Anthropic, OpenAI, Google AI) | Legitimate interests – efficient operation of our business | Name, contact details, job and booking details as needed for the specific task |
| Responding to complaints and resolving disputes | Legitimate interests – necessary to protect our business and your interests | Name, contact details, correspondence |
| Sending you marketing communications about our services, offers, and updates by email, SMS, or post | Consent – only with your explicit opt-in (email and SMS). Legitimate interests for postal marketing, with the right to opt out at any time. | Name, email address, phone number, postal address |
| Website analytics (Google Analytics) to understand how our website is used | Consent – only if you accept analytics cookies | IP address, pages visited, device information |
| Showing you relevant advertisements on other websites (remarketing) | Consent – only if you accept marketing cookies | Cookie identifiers, browsing behaviour on our site |
Where we rely on your consent, you can withdraw it at any time by contacting us at hello@thamesboilers.co.uk, by using the unsubscribe link in any marketing email, or by replying STOP to any marketing SMS. If you wish to opt out of postal marketing, please contact us by email or telephone. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
4. Who We Share Your Data With
We do not sell your personal data to anyone. We share your data only with the following categories of third parties, and only where necessary:
- Payment processors: Stripe, Square, and GoCardless process your payments securely on our behalf. They are certified to PCI-DSS standards.
- Email providers: Mailchimp, Mailerlite, and/or Resend are used to send marketing emails (only if you have opted in) and transactional emails such as booking confirmations and appointment reminders.
- SMS providers: ServiceM8 and Twilio are used to send SMS appointment reminders, payment reminders, and marketing messages (with your consent).
- Website analytics: Google Analytics helps us understand how our website is used (only if you have accepted analytics cookies).
- Advertising platforms: Google Ads, Microsoft Advertising (Bing), Meta (Facebook/Instagram), and X (Twitter) may receive cookie data for remarketing purposes (only if you have accepted marketing cookies).
- Field service management: ServiceM8 is used to manage bookings, job records, customer details, and invoicing.
- Automation platforms: Make.com and n8n are used to automate business processes such as sending booking confirmations, updating records, and connecting our software systems.
- Cloud infrastructure: Cloudflare provides hosting for web workers and automation scripts that support our booking and communication systems.
- AI service providers: Anthropic (Claude), OpenAI, and Google AI may process your data for the purposes of automating communications, summarising job notes, or assisting with customer service. Data shared with these providers is limited to what is necessary for the specific task and is not used to train their AI models.
- Debt collection agencies: In the event of non-payment, we may share your name, address, and details of the outstanding amount with a third-party debt collection agency, as set out in our Terms and Conditions.
- HMRC and regulatory bodies: where required by law, for example for tax returns or Gas Safe Register compliance.
- Professional advisers: our accountant, solicitor, or insurer, where necessary for the operation of our business.
5. International Transfers
Some of our third-party service providers (including Stripe, Square, GoCardless, Mailchimp, Mailerlite, Resend, Twilio, Google, Meta, Microsoft, X, Cloudflare, Make.com, ServiceM8, Anthropic, and OpenAI) are based in the United States or Australia. Your data may be transferred to and processed outside the UK as a result. These transfers are protected by the UK's data adequacy arrangements, which the UK Government has confirmed provide an adequate level of protection for your personal data.
6. How Long We Keep Your Data
We do not keep your personal data for longer than necessary. The retention periods we apply are:
| Type of Data | Retention Period | Reason |
|---|---|---|
| Customer contact details and booking records | 6 years after last service | HMRC record-keeping requirements and potential legal claims |
| Invoices and payment records | 6 years | HMRC requirement for business records |
| Gas Safe compliance records (including appliance details and certificates) | 6 years | Regulatory requirement |
| Marketing email list (opted-in customers) | Until you unsubscribe | Deleted within 30 days of unsubscribe request |
| Complaint and dispute records | 6 years after resolution | Limitation period for legal claims |
| Website analytics data | 26 months | Google Analytics default retention period |
| Cookie consent records | 12 months | To evidence your consent choice, then re-consent requested |
7. Cookies
Cookies are small text files placed on your device when you visit our website. We use the following types of cookies:
Essential cookies
These are necessary for our website to function properly (for example, remembering items in your basket during booking). They do not require your consent and cannot be switched off.
Analytics cookies
We use Google Analytics to understand how visitors use our website. These cookies are only set if you give your consent through our cookie banner. They collect information such as which pages you visit and how long you spend on the site. This data is anonymised and used to improve our website.
Marketing cookies
If you consent, we may use cookies from Google Ads, Microsoft Advertising (Bing), Meta (Facebook/Instagram), and X (Twitter) to show you relevant advertisements on other websites based on your visit to our site. These cookies are only set if you give your consent through our cookie banner.
Managing your cookie preferences
When you first visit our website, you will see a cookie banner giving you the choice to accept or reject non-essential cookies. You can change your preferences at any time by clicking the cookie settings link in the footer of our website. You can also control cookies through your browser settings, but please be aware that disabling essential cookies may affect the functionality of our website.
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access: You can request a copy of the personal data we hold about you.
- Right to rectification: You can ask us to correct any personal data that is inaccurate or incomplete.
- Right to erasure: You can ask us to delete your personal data in certain circumstances (for example, if it is no longer needed for the purpose it was collected). This right does not apply where we are required to keep the data for legal or regulatory reasons.
- Right to restrict processing: You can ask us to limit how we use your data in certain circumstances, for example while we verify its accuracy.
- Right to data portability: You can ask us to provide your data in a structured, commonly used format so that you can transfer it to another provider.
- Right to object: You can object to us processing your data where we are relying on legitimate interests as our lawful basis. You can also object to direct marketing at any time.
- Right to withdraw consent: Where we rely on your consent to process your data (for example, marketing emails or cookies), you can withdraw that consent at any time.
How to exercise your rights
To exercise any of these rights, please contact us at hello@thamesboilers.co.uk or write to us at 14 Cowley Avenue, Greenhithe, Kent DA9 9PJ. Please include your name, address, and a description of what you are requesting so that we can identify you and respond appropriately.
We will respond to your request within 30 calendar days. In exceptional circumstances (for example, if your request is complex), we may extend this by a further two months, but we will let you know within the first 30 days if this is the case. There is no charge for making a request, unless it is manifestly unfounded or excessive.
9. Your Right to Complain
If you are unhappy with how we have handled your personal data, we would like the chance to put things right. Please contact us first at hello@thamesboilers.co.uk.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
10. Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or damage. Payment information is processed by PCI-DSS compliant payment providers (Stripe, Square, and GoCardless), and we do not store your full card details. Our website uses SSL encryption to protect data transmitted between your browser and our servers.
11. Children
Our services are not directed at children and we do not knowingly collect personal data from anyone under 18 years of age. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
12. Links to Other Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and recommend that you read their privacy policies before providing any personal data to them.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. Where changes are significant, we will make reasonable efforts to notify you directly (for example, by email).
14. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
- Email: hello@thamesboilers.co.uk
- Telephone: 01322 788418
- Post: George Lane Trading As Thames Boilers, 14 Cowley Avenue, Greenhithe, Kent DA9 9PJ