Privacy policy

01Who we are

Heliaxis Limited (“Heliaxis”, “we”, “us”) designs and installs solar panels, batteries, heat pumps, EV chargers and related systems for homes and businesses in South Wales. We’re a company registered in England & Wales (No. 16734783) at 9 Turner Street, Newport, NP19 7AZ.

We’re the controller of the personal information described here, which means we decide how it’s used. For anything about your data, contact us at hello@heliaxis.co.uk, on 01633 965205, or by post at the address above.

02The short version

03What we collect and where it comes from

When you visit our website

• Technical information your browser sends, such as your IP address, device and browser type, the pages you visit and the website or advert that brought you here.
• If you accept cookies and arrived from one of our adverts, the campaign details and the Facebook/Google click reference in the web address (see cookies). If you reject cookies, we don’t keep these.
• Where you click on our pages (as anonymous positions on the page, not linked to you), to help us improve the design.
• If you use our roof designer, the postcode you type is looked up by a postcode service and the map loads satellite images of that location from Esri (US). Your roof drawing stays in your browser and we don’t receive it. If you click “Get my exact quote”, the system size, number of panels and whether you chose a battery are added to the web address, so our website analytics (Google Analytics and Umami) record them. They aren’t added to your enquiry. The solar estimator runs entirely in your browser.

When you enquire

• Your name, email, phone number, postcode, the products you’re interested in, your type of property or business, and anything you write in your message. This comes from our website forms, Facebook or Instagram lead forms, WhatsApp, email, phone calls or meeting us in person.
• If you message us on WhatsApp: your WhatsApp number and profile name, and the messages you send, including captions, file names and any location you share. Photos, videos, voice notes and files you send are held by WhatsApp (Meta), and in the WhatsApp Business app on our team’s phone if you message that number. Our CRM records only the caption or file name, not the file itself. If a photo or document is needed for your quote or installation, we may save a copy to your project file.
• Which advert or campaign your enquiry came from, if you accepted cookies or came from a Facebook or Instagram lead form.
• Whether you’re happy for us to message you on WhatsApp: if you tick the box on our forms, agree in a lead form, or message us first, we record that you agreed, when and how. If you reply STOP, we record that too.

When you book a survey online

• What the survey is for, your postcode, the time you pick, and then your name, mobile, email, address and anything you tell us about parking or access.
• Your postcode is looked up with postcodes.io (which uses Ordnance Survey and Royal Mail data) to find roughly where you are. We then check our surveyor’s diary, including their Outlook calendar, for free times, and work out drive times between appointments. We do that ourselves or, if we’ve switched it on, with Google Maps Platform, which receives the locations of the trip (not your name or contact details).
• To stop misuse of the form we keep a scrambled (hashed) form of your IP address with the booking. If we’ve switched it on, Cloudflare Turnstile checks that you’re not a robot. While you’re booking, your browser remembers the time you’re holding until you close the tab.
• Booking online creates a new enquiry. If your email or mobile matches someone already in our records, we flag it for our team to check. We don’t show you anything about the other record or change it.

Please don’t send us health or other sensitive information unless it’s relevant (for example, if someone in the home has a health condition or disability and we should take extra care during a visit). If you do tell us, we’ll ask whether you, and the person it’s about if that’s someone else, are happy for us to keep a note of it. We rely on that explicit consent and use the information only to take that care. If we don’t get it, we’ll delete it. You can withdraw your consent at any time by telling us, and we’ll then delete it from our records. This doesn’t affect anything we did before you withdrew it.

When you become a customer

• Your address, survey details, system design, quotes, invoices, contracts and certificates.
• Photos of your property taken at survey and during installation (roof, fuse board, meter and work areas), with notes.
• If you accept a quote online: the name you type, your drawn signature, the date and time, and your IP address, as a record of your acceptance.
• If you pay a deposit online: the amount and the fact it’s paid. Card payments are taken by Stripe. We never see or store your card details.
• Information from your energy network operator (DNO) about your grid connection application.
• Our notes about calls, visits, messages and emails with you.

If you work with us as a subcontractor or operative

See subcontractors and operatives.

04How we use it, and our legal reasons

Data protection law requires a legal reason (“lawful basis”) for each use:

Where we rely on legitimate interests, we’ve weighed our interests against yours, and you have the right to object (see your rights).

You don’t have to give us your details. But without your name and an email address or phone number we can’t reply to your enquiry. Without your address and contact details we can’t survey, quote for or install your system, and we also need your address for the grid (DNO) notification and the certificates we must provide.

If you work with us as a subcontractor, we need your business and bank details to contract with you and pay you. We also need insurance, qualifications and photo ID for each operative before they can work on our sites. The Construction Industry Scheme (CIS) requires us to verify you with HMRC. If you don’t give us the details we need for that, we may have to deduct tax from your payments at the higher rate.

05Messages from us, and automation

We prefer to keep in touch by WhatsApp and email, so you have everything in writing.

• Some messages are sent automatically: booking confirmations, reminders before your survey or installation, a follow-up if we haven’t heard back, and a review request after your installation. Some quick replies to common questions are also prepared automatically and may be sent by our system after a short delay. Every conversation is handled by our team, and you can always ask to speak to a person.
• Our team uses an AI assistant (Claude, made by Anthropic) to help with admin, such as summarising notes, organising tasks and drafting messages. It can see the details we hold about the customers it’s helping with. A member of our team reviews any message the assistant drafts before it’s sent to you. The assistant doesn’t make decisions about you.
• We use simple automatic rules to share new enquiries fairly between our team and to remind us to reply quickly. None of this has legal or similarly significant effects on you.

To stop follow-ups or review requests, just tell us in reply on WhatsApp or email hello@heliaxis.co.uk. We’ll still send messages we need to for a job that’s in progress (such as installation details) unless you ask us to use another method.

WhatsApp permission. We record when and how you agreed to hear from us on WhatsApp: by ticking “OK to message me on WhatsApp” on our website, in a Facebook or Instagram lead form that asks, by messaging us first, or by telling one of our team. Reply STOP to any of our WhatsApp messages (or ask one of our team) and our system won’t send you any more automatic WhatsApp messages (reminders, follow-ups or quick replies). Reply START to turn them back on. We’ll still answer if you message us, and we may send booking details by email instead.

06Advertising and measuring our adverts

We advertise on Facebook and Instagram (Meta). To see which adverts lead to real customers, and to help Meta show our adverts to people more likely to be interested, we send Meta a small amount of information when an enquiry moves forward (for example, when a survey is booked, a quote is sent or a job is won):

• your email address and phone number in a scrambled (“hashed”) form, not as readable text. Meta uses these to try to match you to a Facebook or Instagram account, so hashing doesn’t make them anonymous
• the advert click reference or Meta lead reference, if you came from one of our adverts
• the type of step and, when a job is won, its value

We don’t send your name, address or the content of your messages. This applies to every enquiry that reaches these steps, not only people who came to us through an advert. For collecting and sending this information, we and Meta Platforms Ireland Limited are joint controllers. We’re responsible for telling you about it, for having a lawful reason to send it, and for stopping if you object. Meta is responsible for what it does with the information after it receives it, which may include combining it with what it already knows to measure and target adverts. You can read Meta’s joint controller terms and Meta’s privacy policy. You can use your rights with us or with Meta. You can object at any time. Tell us, and we’ll stop sending your information to Meta.

If you fill in a lead form on Facebook or Instagram, Meta passes us the answers you give in that form.

07Who we share it with

We don’t sell your personal information. We share it with the organisations below, and only what each one needs. Most are service providers that handle it for us under contracts that require them to protect it and use it only on our instructions. Some also use it for their own purposes, under their own privacy policies: Meta (WhatsApp, Facebook and Instagram lead forms, and the advert measurement described above), Stripe (payments and fraud checks), Google (website analytics and web fonts), and the postcode, map and image services used by our roof designer and maps. Our installation partners and subcontractors, your network operator, MCS and certification bodies, our accountants, HMRC, insurers, legal advisers and, where required, the police or regulators receive what the job or the law needs and are responsible for their own use of it:

We also use design tools (such as OpenSolar and SimpliHeat) to design your system, which hold the project details we enter.

08Data stored outside the UK

Several of our providers are based in, or use services in, the United States or the EU. When your information goes outside the UK we make sure it’s protected to UK standards, using UK “adequacy” regulations (including the UK–US data bridge for certified US companies) or the UK’s approved contract terms (the International Data Transfer Agreement or Addendum). Ask us if you’d like more detail.

09Subcontractors and operatives

If you or your firm works with us as a subcontractor, we collect:

• business, tax and payment details: company and contact details, company and VAT numbers, UTR and CIS status, and bank details for payments
• for each operative: name, role and contact details, qualifications, competency cards, registrations, insurance, and a copy of photo ID
• your signed agreements (with name, signature, date, IP address and device details), and records of sign-ins and document reviews

We use this to set up and manage our contract with you, pay you and meet our CIS tax duties (legal obligation), check that everyone on site is competent, insured and who they say they are (legal obligations under health and safety law, and our legitimate interests in site safety and security), and prepare site safety documents (RAMS). Bank details, UTR and photo ID are only used for these purposes and aren’t shared with customers. Operatives’ names and roles, and the competency cards and qualifications of the crew on a job, go into that job’s site safety documents (RAMS), which we may share with the customer, the principal contractor or regulators where site safety or compliance requires it. We give our MCS certification body the names and qualifications of our Nominated Technical Persons, and we share CIS, tax and payment records with our accountants and HMRC. Our service providers (see who we share it with) also hold this information for us. If you’re an operative, we get your details from the firm you work for. If you’re that firm, please show this notice to the operatives whose details you give us.

10How long we keep it

• Enquiries that don’t go ahead: up to 2 years after we last spoke, so we can pick up where we left off if you get back in touch.
• Customer records: invoices, payment and accounting records for 6 years from the end of the financial year they relate to (tax and company law); installation, certificate and warranty records for as long as your warranties and certification schemes need them; and the rest of your project file (messages, notes, photos and other documents) for 6 years after our work for you ends, in case of questions or claims about the work, unless you ask us to delete it sooner (see delete your data).
• Subcontractor records: for the length of our relationship and 6 years from the end of the financial year in which it ends (for tax, CIS, contract and safety records). We delete copies of an operative’s photo ID once that person no longer works on our jobs.
• Online survey bookings: as part of your enquiry or customer record, as above. If you start booking but don’t finish, the time you held lapses after a few minutes, and we keep only the postcode you typed and the scrambled form of your IP address, for up to 2 years like other enquiries that don’t go ahead.
• Website analytics: for up to 14 months.
• If there’s a complaint or legal claim, we keep what we need until it’s resolved.

11Cookies and similar technologies

When you first visit our website we ask whether you accept cookies. Accept and Reject are equally easy, and nothing optional is stored until you choose Accept. You can change your mind at any time with Cookie settings at the bottom of every page.

If you choose Reject, we remove the Google Analytics and hx_attr cookies if they were set before. We also use Umami for website statistics, which doesn’t use cookies, and record anonymous click positions to improve page layouts. Web fonts are loaded from Google, which receives your IP address when the page loads. Clicking our WhatsApp us button opens WhatsApp (Meta), which has its own privacy policy.

Your customer project page and your survey booking link set no cookies of their own, and our website statistics never record them. While you book a survey, the booking page remembers the time you’re holding in your browser tab until you close it. Our team’s sign-in areas use cookies that are needed to keep staff and subcontractors logged in. You can also block or delete cookies in your browser settings; the website will still work.

12Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you and get a copy
• have it corrected if it’s wrong or incomplete
• have it deleted (see delete your data)
• object to us using it based on our legitimate interests, including for follow-ups, review requests and advert measurement. You can always stop us using it for marketing
• ask us to restrict how we use it, or to transfer it to you or another organisation

Contact us at hello@heliaxis.co.uk or on 01633 965205. There’s no charge, and we’ll reply within one month. We may need to confirm who you are first.

If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

13Keeping it safe

Your information is stored in secure, access-controlled systems, and only staff who need your details for their work can see them. Files and photos are kept in private storage. When they’re opened in our systems or on your project page, they’re shown through links that expire within an hour. Documents we send you by email or WhatsApp go as attachments, so a copy is also kept in our email system and by WhatsApp (Meta), as well as in your own inbox or chat. Your project page link doesn’t expire, and anyone who has it can open it, so please don’t share it. If you think someone else has it, tell us and we’ll replace it so the old link stops working.

14Children

Our services are for adults. We don’t knowingly collect information from children under 18.

15Changes to this policy

We’ll update this policy when the way we use personal information changes. The date at the top shows when it was last updated. For significant changes we’ll let current customers know.