Privacy Policy
Last updated: 13 March 2026
Who we are and scope
This website is operated by Plumb-On Services Limited to provide information about plumbing services, collect contact/quote enquiries, and communicate with customers.
This policy explains what personal data is collected through this website, how it is used, where it is stored, and how long it is retained.
What we collect (from forms and admin operations)
We follow a data-minimisation approach: we primarily collect the information that you enter directly into our forms.
- Contact form: name, email, optional phone, optional address, and message.
- Quote form: name, email, phone, optional address, service type, optional service details, preferred date/time.
- Admin processing data: request status, notes, estimated price (quotes), and reply history appended to notes.
- Admin account data: name, email, hashed password, role, created/updated timestamps.
- Security data: reCAPTCHA verification token and associated fraud-prevention score/action outcome.
We do not intentionally collect sensitive special-category personal data through our forms. Please avoid submitting unnecessary sensitive information.
Exact processing flow (how your data moves)
- You submit a contact form, quote form, or admin setup form on the website.
- reCAPTCHA validation runs to reduce bot/spam submissions.
- If valid, the submitted form data is stored in our MySQL database.
- Confirmation/notification emails are sent using configured SMTP email services.
- Authorized admins view requests in the dashboard, then may update status, add notes, reply, archive, or delete.
- If admins send updates/replies, your email address is used for service communications about your request.
How your data is used
- To receive, assess, and manage contact and quote requests.
- To send automatic confirmation emails and admin notifications.
- To send manual replies and optional status update emails from admin dashboard.
- To protect forms and admin setup from spam/bot abuse via reCAPTCHA.
- To operate authentication sessions for admin users.
Lawful bases (UK GDPR)
We process personal data under legitimate interests (running the business and customer communications), pre-contract steps (providing quotes), contract performance (service delivery where applicable), and legal obligations (record keeping and compliance) where required.
Where and with whom data is shared
We share only necessary data with technical providers required to run the service, including website hosting, database infrastructure, email delivery (SMTP), authentication/session handling, and reCAPTCHA verification. We do not sell personal data.
Website infrastructure is hosted on an IONOS VPS environment. Data processed through the website is handled within that hosting setup and required service integrations.
Data retention and deletion
Request records are stored in our database until they are deleted by an authorized admin user. Completed requests may be moved to an archived status for operational organization, but archival is not deletion.
- Contact/Quote records: retained until manually deleted or no longer needed.
- Admin notes and reply logs: retained with the related request record.
- Admin user accounts: retained while account access is needed, unless removed.
- Session tokens: short-lived and rotated according to authentication configuration.
If you request deletion, we will review and action where legally and operationally appropriate.
Security controls in place
- Admin routes require authenticated sessions.
- Admin account setup requires a master key and reCAPTCHA validation.
- Password storage uses hashing (not plaintext passwords).
- Form submissions are protected by reCAPTCHA v3 verification and score checks.
Your rights
You may request access, correction, or deletion of your personal data, subject to legal and operational obligations. Contact us at info@plumb-on.co.uk.
Contact
For privacy questions, please contact: info@plumb-on.co.uk