Privacy Notice – ACL London
Effective date: 1 April 2024
Welcome to the ACL London privacy notice. This page explains how we (‑ “we”, “our”, “us”) collect, use, store, and protect any personal data you share with us through our website (https://www.airconditioning‑london.net) or in person at our registered office, 152‑160 Kemp House, City Road, London, EC1V 2NX, United Kingdom.
Our commitment to transparency, security, and compliance with the UK Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR) is reflected in every line of this notice. We encourage you to read it carefully and keep a copy for your records.
1. Why This Notice Matters
In the eyes of the law, “processing” means any operation performed on personal data – from collection and storage to analysis and deletion. This privacy notice tells you:
- What personal data we process, and why.
- The lawful basis for each type of processing.
- How long we keep your data.
- Your rights under GDPR and the Data Protection Act 2018.
- How to contact our Data Protection Officer (DPO) with any question or request.
2. Data Protection Officer
We have appointed a dedicated Data Protection Officer to oversee compliance with data‑privacy law and to serve as your point of contact for any privacy‑related queries.
Name: [First Name Surname]
Email: [insert‑email@airconditioning‑london.co.uk]
If you wish to exercise any of your data‑subject rights, ask a question about how we handle your information, or lodge a complaint, please email the DPO directly.
3. What Personal Data We Collect
We categorize the data we collect into logical groups. This helps us stay transparent and makes it easier for you to understand what we hold.
| Category | Typical Examples | Why We Need It |
|---|---|---|
| Identity data | First & last name, title, date of birth, gender, passport or driver’s licence number | Verifying your identity and fulfilling contractual obligations. |
| Contact details | Billing and delivery addresses, email address, telephone numbers | Communicating order confirmations, invoices, support, and marketing (if you consent). |
| Financial data | Bank account number, payment‑card details, transaction references | Processing payments securely and preventing fraud. |
| Transaction data | Purchase history, product or service details, invoices, receipts | Delivering purchased goods/services and providing after‑sales support. |
| Technical data | IP address, browser type & version, operating system, device identifiers, location data (derived from IP) | Maintaining website security, troubleshooting technical issues, and analysing usage trends. |
| Profile data | Username, password (encrypted), preferences, survey responses, feedback | Personalising your experience and improving our products/services. |
| Marketing data | Consent status for newsletters, preferences for promotional communications | Sending you relevant offers only when you have opted in. |
| Aggregated/anonymous data | Statistical or demographic summaries that cannot identify you | Business analytics, market research, and reporting. |
Note: Aggregated data becomes personal data only if it can be linked back to an identifiable individual.
Special Categories of Personal Data
Special categories (sometimes called “sensitive data”) include information about race, religion, sexual orientation, health, genetics, biometric data, or criminal convictions. We only process such data when a specific lawful basis applies (e.g., explicit consent or a legal requirement).
4. How We Use Your Data
We process personal data for the following purposes, each anchored to a specific lawful basis (see Section 5).
- Contract performance – Managing your orders, delivering products, providing after‑sales support, and handling payments.
- Identity verification & security – Preventing fraud, protecting accounts, and complying with anti‑money‑laundering rules.
- Customer support – Responding to enquiries, troubleshooting issues, and improving service quality.
- Marketing & communications – Sending newsletters, promotional offers, and product updates (only with your consent).
- Legal compliance – Responding to court orders, regulatory requests, or statutory reporting obligations.
- Legitimate interests – Business administration, risk management, network security, and statistical analysis that do not override your fundamental rights.
We never sell or rent your personal data to third parties. Where we share data with trusted service providers (e.g., payment processors, shipping carriers, IT hosting), we require them to sign strict data‑processing agreements that mirror our own privacy standards.
5. Lawful Bases for Processing
Under GDPR we must identify a lawful basis for every type of processing. Below is a concise summary of the bases we rely on:
| Lawful Basis | When We Use It | What It Means for You |
|---|---|---|
| Contractual necessity | When a contract exists (e.g., you purchase a product) | Processing is required to fulfil the contract. |
| Consent | When you voluntarily opt‑in to newsletters, cookies, or surveys | You can withdraw consent at any time via email (hello@airconditioning‑london.co.uk). |
| Legal obligation | When compliance with statutes (tax, health‑and‑safety, court orders) is required | Processing is mandatory; you cannot opt‑out. |
| Legitimate interests | Internal admin, fraud prevention, network security, market research | We balance our interests against your rights; you can object if you feel it adversely affects you. |
| Vital interests | Only in rare emergencies to protect life or safety | Not normally applicable to our services. |
| Public task | Not currently applicable to ACL London. | — |
If a basis becomes invalid (e.g., you withdraw consent), we will cease the related processing immediately, unless another lawful basis applies.
6. How Long We Keep Your Data
We retain personal data only for as long as necessary:
- Contractual data – Until the contract ends plus a statutory retention period (usually 6 years for accounting records).
- Marketing data – Until you unsubscribe or withdraw consent.
- Legal‑obligation data – For the period required by law (e.g., tax records for 7 years).
When the retention period expires, we either delete, anonymise, or securely destroy the data.
7. Your GDPR Rights
You enjoy a suite of rights under GDPR and the Data Protection Act 2018. To exercise any of these rights, contact our DPO using the details in Section 2.
| Right | What You Can Ask For |
|---|---|
| Right of access | A copy of the personal data we hold about you. |
| Right to rectification | Correction of inaccurate or incomplete data. |
| Right to erasure (“right to be forgotten”) | Deletion of your data where lawful. |
| Right to restriction of processing | Temporary halt of processing while a dispute is resolved. |
| Right to data portability | Transfer of your data to another controller in a machine‑readable format. |
| Right to object | Object to processing based on legitimate interests or direct marketing. |
| Right to withdraw consent | Cancel any consent you have previously given (no effect on lawfully processed data). |
We will respond to any valid request within one calendar month, unless a complex request requires an extension (up to two additional months).
8. International Transfers
Most of our processing occurs within the United Kingdom. If we need to transfer data outside the UK/EU (e.g., to a cloud‑service provider), we will ensure an adequate level of protection through:
- Standard Contractual Clauses (SCCs)
- EU‑UK Data Transfer Agreement (when applicable)
9. Security Measures
We employ a layered security approach:
- Encryption: TLS/SSL for data in transit; AES‑256 for data at rest.
- Access controls: Role‑based permissions and two‑factor authentication for staff.
- Monitoring: Continuous network monitoring, intrusion detection, and regular vulnerability scans.
- Data minimisation: Only the data necessary for each purpose is collected and retained.
While no system can be 100 % risk‑free, we review and upgrade our security controls regularly to meet industry best practices.
10. Cookies & Similar Technologies
Our website uses cookies to improve functionality, analyse traffic, and deliver personalised content.
- Strictly necessary cookies – Enable core site features (e.g., shopping cart).
- Performance cookies – Collect anonymous usage statistics (Google Analytics).
- Marketing cookies – Remember your preferences and track conversions (only after you give consent).
You can manage cookie settings at any time via the banner that appears on your first visit or through your browser settings.
11. How We Update This Privacy Notice
We may amend this notice to reflect changes in law, business practices, or technology. Any material updates will be posted on this page with a revised “Effective date”. We encourage you to review the notice regularly.
12. Contact Us
If you have any questions, concerns, or wish to exercise a data‑subject right, please reach out to our Data Protection Officer:
Email: hello@acluk.co.uk
Phone: 02080582548
Mail: Data Protection Officer, ACL London, 152‑160 Kemp House, City Road, London, EC1V 2NX, United Kingdom
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) should you feel your data protection rights have been infringed.
ACL London is committed to safeguarding your privacy while delivering the highest quality air‑conditioning products and services.
