This policy explains how Headroom Technology Ltd ("Headroom", "we", "us") collects and uses personal data when you use the Headroom platform, website and services. Headroom is the data controller. We are a company registered in England & Wales (company number [to be confirmed]), registered office [registered office address].
ICO registration. Headroom Technology Ltd is a separate legal entity and maintains its own registration with the UK Information Commissioner's Office. Registration is being completed and the number will be published here; in the meantime the Service is in limited beta with a small number of invited customers. If you need the position confirmed in writing before using the Service, contact us using the details below.
Headroom is a business-to-business service for renewable-energy installers and developers. This policy covers personal data of our account holders, their staff, and individuals whose details are provided to us in connection with a grid connection application (for example a site owner or occupier).
| Category | Examples |
|---|---|
| Account & contact | name, work email, company, login credentials, plan and billing status |
| Site & application data | site address and postcode, MPAN, asset type and system size, DNO, connection references |
| Site owner / occupier | full legal name, role, organisation, registered address and company number, and Letter of Authority details |
| Uploaded documents | electricity bills, designs, quotes or other files you upload, which we process (including by automated text extraction) to pre-fill applications. Where you attach a document to a site, we also store the file so it stays with that application |
| Usage & technical | IP address, device/browser information, and interactions with the Service (via essential cookies/logs) |
| Payment | billing details processed by our payment provider (we do not store full card numbers) |
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Provide the Service — screening, verdicts, document generation | Performance of a contract |
| Submit applications to DNOs on your instruction | Performance of a contract; the Letter of Authority evidences the site owner's authorisation |
| Account administration, billing and support | Contract; legitimate interests |
| Securing, maintaining and improving the Service | Legitimate interests |
| Service and, where relevant, marketing communications | Legitimate interests, or consent where required |
| Meeting legal and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we balance those interests against your rights. You can object to processing based on legitimate interests (see section 8).
Published network datasets (such as UKPN capacity data, the ENA Embedded Capacity Register and PVGIS / EU JRC) are sources we read from; we do not send your personal data to them as part of screening.
Our infrastructure is hosted within the European Economic Area. Where any provider processes personal data outside the UK or EEA, we put appropriate safeguards in place (such as UK approved transfer mechanisms). [Confirm once sub-processors are finalised.]
We keep personal data only for as long as it is needed, and we run an automated job that applies these periods rather than relying on anyone to remember them.
| What | How long | Why |
|---|---|---|
| Account and contact details | While your account is active, then 12 months | So a returning customer finds their history, without us holding dormant records. An account attached to a live application is kept until that application ages out, because the record needs an owner |
| Applications and document packs | 6 years from last activity | The limitation period for a contract claim, and the period HMRC expects business records to be kept |
| Documents you upload (bills, designs, quotes) | 12 months after the application is connected or refused, or 3 years of inactivity if it never reaches an outcome | Their purpose is to evidence a live application. Once it is decided, they are deleted from the database and from disk |
| Enquiries that do not become accounts | 12 months | Long enough to follow up, not indefinite |
| Sessions and technical logs | 30 days (sessions), 90 days (logs) | Security, troubleshooting and abuse prevention |
| Billing records | 6 years | Tax and accounting obligations |
Connection outcomes. Where a screening prediction is compared against what a network operator actually decided, we keep that comparison indefinitely to improve the Service, but we anonymise it first: the postcode is reduced to its outward part and names are removed, so it no longer identifies anyone.
You can delete a document at any time from the site it belongs to, and ask us to delete your account and its records at any time using the contact details below.
Documents you attach to a site are kept with that application and are deleted when you delete the document, or automatically when the application record itself is deleted. They are visible only to your own account.
Under UK data protection law you have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where we rely on it. To exercise any of these, contact hello@headroom.technology. We will respond within the time limits set by law.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk) — though we would welcome the chance to resolve any concern first.
We use essential cookies and similar technologies needed to run the Service and keep it secure. If we introduce analytics or non-essential cookies, we will update this policy and seek consent where required.
We use appropriate technical and organisational measures to protect personal data, including access controls and encryption in transit. No system is completely secure, and you are responsible for keeping your account credentials confidential.
We may update this policy from time to time. The current version is always posted here with its "last updated" date; material changes will be highlighted where appropriate.
Questions or requests about your personal data: hello@headroom.technology. [Consider a dedicated privacy@headroom.technology inbox.]