Privacy notice: UK Heat Network
Last updated: 3 October 2026
Who we are
UK Heat Network is run by Herschel Lake, a sole trader. We are the controller of the personal data described here. Contact us about privacy at privacy@ukheatnetwork.co.uk. Our postal address is in section 1 of our Terms of sale, which are on our website and attached to every order confirmation.
We sell a £149 heat network readiness kit: tailored templates for small residential blocks. We don't sign people up to anything else and we don't sell or share data for marketing.
What we collect and why
| What | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|
| Your name, email address, billing address and the details you enter at checkout (your role, the block's postcode, number of flats) | You, through our payment provider Stripe | To take payment, send your order confirmation and questionnaire, and deliver the kit | Contract (Art 6(1)(b)) |
| Your questionnaire answers: block name and address, company names and numbers, how the heating works and is charged for, and names and roles of directors, the regulatory contact and contact details residents should use | You | To tailor and deliver your kit and handle corrections | Contract (Art 6(1)(b)); for people other than you, our legitimate interest in delivering the kit you ordered (Art 6(1)(f)) |
| Emails you send us | You | To answer you, correct your kit and deal with complaints | Contract; legitimate interests |
| Order and payment records (amount, date, refund, invoice details) | Stripe and us | To keep accounts and meet tax law | Legal obligation (Art 6(1)(c)) |
| Your email address, kept after delivery | You | To tell you, until 26 January 2027, about material changes to Ofgem's rules or guidance that affect your kit, as promised in our terms | Contract (it's part of what you bought) |
We use software tools to prepare your kit from your answers. A person checks every kit before it's sent. The software tools we use to prepare your kit never see your name, contact details, or the name, address or postcode of your block or company: these stay on our own computer and are added just before your kit is sent.
We don't need, and ask you not to send, any information about individual residents (names, health, vulnerability or payment problems). The Priority Services Register in the kit is blank and stays with you. If you send us resident information by mistake, we'll delete it and tell you.
Card details: Stripe handles your card details. We never see your full card number. Stripe's own privacy policy explains how it uses data, including for fraud prevention, where it acts as a separate controller.
If you named other people (for example fellow directors): we use their names and roles only to fill in the kit. Please let them know you've shared them with us and point them to this notice.
Our website and visitor counting
Our site doesn't use cookies, local storage, fingerprinting or any tracking that reads or stores information on your device, so we don't ask for cookie consent. We count, on our own server, how many pages are viewed and how many visits complete the self-check, reach the price section or click the buy button. These counts don't record your IP address and aren't linked to you or to any order. We use them in legitimate interest (Art 6(1)(f)) to see whether the page works.
The self-check runs in your browser. Your answers aren't sent to us; we only count that it was completed.
We don't keep our own server logs. Our web host, Cloudflare, processes connection data such as IP addresses on our behalf to deliver and protect the website. Cloudflare also uses some network data for its own purposes, such as security and running its network, as a separate controller: see Cloudflare's privacy policy.
Who we share it with
Only the providers who help us run the service:
- Stripe (payments, refunds and receipts). Stripe processes payment data on our behalf as our processor. It's a separate controller when it uses data for its own purposes, such as preventing fraud and financial loss, choosing banks and payment providers, meeting its legal obligations (including anti-money-laundering checks) and improving its services. See Stripe's privacy policy.
- Cloudflare (website hosting, security and our visitor counts). Cloudflare is our processor for the website content and the visitor logs and counts it makes available to us. It's a separate controller for the operational network data described above.
- Zoho (our business email). Zoho is our processor. Your emails and any files you send us are stored in our Zoho mailbox in Zoho's EU data centre.
- We keep working files on our own computer. We don't use a separate file-storage service.
We'll also share data if the law requires it, for example with HMRC. We don't sell data.
Outside the UK:
- Stripe transfers data to Stripe, LLC in the United States, and may transfer it to its affiliates and service providers in other countries, including India. Stripe, LLC is certified under the UK Extension to the EU–US Data Privacy Framework. Where a safeguard is needed beyond that, Stripe uses the EU standard contractual clauses with the UK International Data Transfer Addendum.
- Cloudflare may process data outside the UK, including in the United States. Cloudflare relies on the UK Extension to the EU–US Data Privacy Framework and, where that doesn't apply, the EU standard contractual clauses with the UK International Data Transfer Addendum, under its data processing addendum.
- Zoho stores our email in the EU, which the UK recognises as adequate. Staff of Zoho's group company in India may access it for technical support, under contractual safeguards.
How long we keep it
- Questionnaire answers and working files (wherever they're stored): deleted 30 days after the 14-day corrections window ends.
- Delivered kit copy and order emails (including your start-now-or-wait choice, if you're buying as an individual): kept for 2 years after delivery, so we can handle questions or complaints.
- Your email for material-change notices: kept until 26 January 2027, or until you tell us to stop.
- Payment and accounting records: kept as long as tax law requires. HMRC says sole traders must keep records for at least 5 years after the 31 January Self Assessment deadline for the tax year.
- Visitor counts: aggregate numbers only, kept indefinitely.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Some rights depend on the lawful basis; we'll explain if one doesn't apply. Email privacy@ukheatnetwork.co.uk. We'll reply within one month.
If you're unhappy with how we've handled your personal data, you have the right to complain to us. Email privacy@ukheatnetwork.co.uk or write to us at the address in section 1 of our Terms of sale. We'll confirm we've received your complaint within 30 days, look into it, keep you updated and tell you the outcome. You also have the right to complain to the Information Commission, the UK's data protection regulator (still known as the ICO): ico.org.uk/make-a-complaint.
Do you have to give us your data?
You need to give us your contact details and questionnaire answers for us to deliver the kit. A person makes every decision about your order, including whether your block is covered and any refund. We don't make decisions about you based solely on automated processing.
Changes
We'll update this notice if how we use data changes, and change the date at the top.