HT008 – Data Protection & Information Handling Policy (internal)
Policy Owner: David Owen-Booth
Business: Home Tech Wales
Effective Date: 23 June 2026
Review Date: 23 June 2027
Website: www.hometech.wales
Email: info@hometech.wales
Telephone: 07909 225315
ICO Registration Number: ZB361376
1. Purpose
HomeTech Wales is committed to protecting the privacy, confidentiality and security of personal information. This policy explains how personal information is collected, used, stored, shared and disposed of in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and recognised good information handling practice.
HomeTech Wales provides home improvements, property maintenance, accessibility adaptations, technology support and independent living solutions. In doing so, it is necessary to collect and process certain personal information to respond to enquiries, provide quotations, deliver services, meet legal obligations and maintain accurate business records. HomeTech Wales is committed to handling all personal information lawfully, fairly, securely and transparently, while respecting the privacy and rights of every individual.
2. Scope
This policy applies to all personal information handled by HomeTech Wales and to any future employee, subcontractor, volunteer or third party acting on behalf of the business.
The policy applies to information relating to:
• Customers and potential customers
• Suppliers and contractors
• Business contacts
• Referring organisations and professionals
• Vulnerable adults and individuals receiving support services
Personal information may include names, addresses, telephone numbers, email addresses, photographs, quotations, invoices, technical account information and any other information capable of identifying an individual.
3. Why Information Is Collected
HomeTech Wales only collects information that is relevant and necessary for the provision of services.
Information may be collected to:
• Respond to enquiries
• Prepare quotations and estimates
• Deliver agreed services
• Arrange appointments
• Issue invoices and receipts
• Maintain project records
• Provide technology support
• Meet insurance requirements
• Fulfil safeguarding responsibilities
• Comply with legal and taxation requirements
• Improve services and customer experience
HomeTech Wales will never sell personal information to third parties.
4. Information Collected
Depending on the service being provided, HomeTech Wales may collect:
Customer Information
• Name
• Address
• Telephone number
• Email address
• Emergency contact details where appropriate
Service Information
• Details of requested work
• Property information relevant to the project
• Appointment records
• Quotations and invoices
• Project notes
• Customer communications
• Job photographs
Technical Information
Where technology support services are provided, HomeTech Wales may require access to:
• Device names and settings
• Network information
• Router settings
• WiFi credentials
• Usernames
• Passwords
• PIN codes
• Administrative credentials
• CCTV installer credentials
• Cloud accounts
• Smart home systems
• Recovery information
• Remote support software and settings
Only information necessary to provide the agreed service will be accessed or retained.
Health and Support Information
Some customers, family members, healthcare professionals, occupational therapists, social workers or authorised representatives may disclose information relating to disabilities, medical conditions, mobility issues, accessibility requirements or support needs.
HomeTech Wales follows the principle of data minimisation and does not routinely create or retain medical records. Such information is normally used only to understand customer requirements, adapt services appropriately and ensure work is carried out safely. Information will only be retained where there is a safeguarding, legal or operational reason for doing so.
5. Lawful Basis for Processing
Personal information is processed under one or more of the following lawful bases:
Contract
To provide quotations, undertake agreed work and administer customer contracts.
Legal Obligation
To comply with legal, safeguarding, insurance, regulatory and taxation requirements.
Legitimate Interests
To operate the business effectively, maintain records and communicate with customers.
Consent
Where consent is required, including testimonials, reviews, marketing communications and the use of photographs for promotional purposes. Consent may be withdrawn at any time.
6. Responsibilities
David Owen-Booth, as owner of HomeTech Wales, is responsible for ensuring compliance with data protection legislation and recognised good information handling practice.
Responsibilities include:
• Reviewing this policy regularly
• Maintaining appropriate security measures
• Responding to Subject Access Requests
• Handling data protection enquiries
• Investigating potential data breaches
• Assessing third party systems used to store information
• Ensuring personal information is handled lawfully and fairly
Anyone acting on behalf of HomeTech Wales must follow this policy and protect the confidentiality of information they access.
7. Information Handling Principles
HomeTech Wales seeks to ensure that personal information:
• Is processed lawfully, fairly and transparently
• Is collected only for legitimate business purposes
• Is limited to information that is necessary
• Is accurate and kept up to date where practical
• Is retained only for as long as necessary
• Is protected against unauthorised access, loss or misuse
• Is only shared where there is a lawful reason to do so
8. Information Security and Storage
HomeTech Wales takes reasonable and proportionate measures to protect information from accidental loss, theft, misuse or unauthorised disclosure.
Security measures include:
• Password protected devices
• Multi factor authentication
• Biometric device security where available
• Secure Microsoft OneDrive cloud storage
• Antivirus and security software
• Software updates and security patches
• Restricted access to business records
• Secure disposal of records when no longer required
Business records may be stored on devices used for both business and personal purposes. Such devices are protected using passwords, biometric authentication, multi factor authentication where available and other appropriate security measures.
Personal information will be held in as few locations as reasonably practical to reduce the risk of duplication, loss or unauthorised access.
Paper records containing personal information will be stored securely and destroyed when no longer required.
9. Access Credentials, Security Information and Technology Support
HomeTech Wales may be provided with access credentials, security information and technical account details in order to install, configure, repair, maintain or support technology systems.
This may include:
• Usernames
• Passwords
• PIN numbers
• Administrative credentials
• Router and network settings
• CCTV installer accounts
• Smart home system credentials
• Cloud service accounts
• Recovery information
• Remote support credentials
HomeTech Wales will only collect, access or retain such information where necessary to provide the agreed service.
Where credentials are required solely for installation or commissioning purposes, they will normally not be retained after the work is completed.
Where a customer has requested ongoing support, maintenance or remote assistance, relevant credentials and configuration information may be retained to enable HomeTech Wales to provide that service efficiently.
Such information will be stored within secured business records protected by device authentication, account authentication and document level protection where appropriate.
Access to retained credentials will be restricted to David Owen-Booth unless authorised arrangements are made.
HomeTech Wales will never disclose customer credentials to third parties without authorisation unless required by law.
Where key safes, smart locks, alarm systems or similar security devices are installed, customer chosen access codes will not normally be recorded or retained unless this forms part of an agreed ongoing support arrangement.
Customers remain responsible for maintaining secure backups of their own information and for changing passwords or access codes where appropriate.
10. Communications
Customers may communicate with HomeTech Wales through:
• Telephone
• Email
• Website contact forms
• Facebook
• Facebook Messenger
• WhatsApp
Customers should avoid sending sensitive personal information through social media messaging services unless specifically requested as part of the service being provided.
Communications will be retained only for as long as reasonably necessary for business, legal or safeguarding purposes.
11. Data Accuracy
HomeTech Wales takes reasonable steps to ensure information is accurate and up to date.
This includes:
• Confirming customer details where appropriate
• Correcting inaccuracies when identified
• Removing information that is no longer required
• Limiting unnecessary duplication of records
Individuals may request corrections to information held about them at any time.
12. Subject Access Requests and Individual Rights
Individuals have the right to:
• Request a copy of personal information held about them
• Request correction of inaccurate information
• Request deletion of information where appropriate
• Request restriction of processing in certain circumstances
• Object to certain types of processing
• Understand how their information is being used
• Withdraw consent where processing relies on consent
Requests should be made by email to info@hometech.wales or in writing to HomeTech Wales.
Proof of identity may be requested before information is released.
HomeTech Wales will normally respond within one calendar month as required by data protection legislation.
13. Sharing Information
Information will only be shared where there is a lawful and legitimate reason to do so.
This may include sharing information with:
• Accountants and professional advisers
• Insurance providers
• Local authorities
• Safeguarding agencies
• Emergency services
• Law enforcement agencies
• Approved subcontractors involved in delivering a service
Only the minimum information necessary will be shared.
14. Data Breaches
A data breach may include:
• Loss of personal information
• Unauthorised disclosure of information
• Theft of records or devices
• Accidental sharing of information
• Unauthorised access to systems
Any suspected breach will be investigated promptly.
Where required by law, HomeTech Wales will notify the Information Commissioner’s Office and affected individuals.
Appropriate action will be taken to minimise any harm and reduce the risk of recurrence.
15. Retention and Disposal
Information will only be retained for as long as reasonably necessary.
Typical retention periods are:
• Unsuccessful quotations: 12 months
• Customer correspondence: 3 years
• Job photographs: 7 years
• Project records and invoices: 7 years
• Ongoing support records: Duration of support plus 12 months
• Credentials retained for support: Duration of support agreement
• Safeguarding records: In accordance with safeguarding requirements
• Marketing consent records: Until consent is withdrawn
When information is no longer required it will be securely deleted, destroyed or otherwise disposed of.
16. Photographs and Marketing
HomeTech Wales may take photographs before, during and after works for record keeping, quality assurance, insurance purposes and project documentation.
Permission will be sought before photographs are used for marketing, advertising, social media, websites or promotional materials. HomeTech Wales will maintain a record of that permission where reasonably practical.
No personal information will be disclosed alongside photographs without additional consent.
17. Safeguarding and Disclosure
HomeTech Wales works with older people, vulnerable adults and individuals requiring additional support.
Where there are concerns relating to abuse, neglect, exploitation, fraud, criminal activity or serious risk of harm, information may be shared with appropriate authorities in accordance with safeguarding responsibilities and legal obligations.
Where appropriate and safe to do so, individuals will be informed before information is shared.
18. Complaints
Questions or concerns regarding the handling of personal information should be directed to:
David Owen-Booth
HomeTech Wales
info@hometech.wales
07909 225315
Individuals who remain dissatisfied have the right to raise concerns directly with the Information Commissioner’s Office.
19. Review
| Item | Details |
| Document | HT003 Privacy Policy |
| Version | 1.0 |
| Effective Date | 5 July 2026 |
| Last Reviewed | 5 July 2026 |
| Next Review | 5 July 2027 |
| Policy Owner | David Owen Booth |
| Approved By | David Owen Booth |
The latest version of this document is published on the HomeTech Wales website. Printed or downloaded copies are considered uncontrolled and users should refer to the website to ensure they are viewing the current version.