Your information
HISA Privacy Policy
How we use personal information when you visit our website or contact HISA about an installer, a project or product support.
Last updated:
Version HISA-WEB-PRIVACY-01
1. Who we are and what this policy covers
Hisa Engineering Ltd, trading as HISA ("we", "us" or "our"), is responsible for the personal information described in this policy as its data controller.
Contact us about privacy:
- Email: enquiries@hisauk.com, with the subject “Privacy request”.
- Post: Hisa Engineering Ltd, 396 Hillington Road, Hillington, Glasgow, G52 4BL, United Kingdom.
- Telephone: 0141 530 2010.
This policy explains how we use personal information when you visit our website, request help finding an installer, enquire about a residential or commercial project, or contact us for product support. It also covers information supplied by someone acting for a business, landlord, housing association, developer or other organisation.
Our separate warranty-registration service at https://registration.hisauk.com/ is not part of the website-to-HubSpot enquiry integration. Submitting an enquiry is not warranty registration. Please read the privacy information supplied at the registration service when using it.
This policy does not describe connected-product telemetry, an app account, recruitment or an installer employment relationship. Separate information will be needed if HISA processes personal data for those purposes.
2. Information we collect and where it comes from
We collect information you choose to provide through an available form, by email or telephone, or through an authorised representative. The information depends on the enquiry:
| Enquiry or activity | Information involved |
|---|---|
| Find an Installer | Name, email, telephone number, project postcode, property type, product interest and your message. |
| General or business enquiry | Contact details, organisation and role where supplied, the type of enquiry, and correspondence. A separate general-contact web form is not currently available; use the contact routes shown on the website. |
| Commercial project | Name, company, email, telephone, project postcode or location, building type, estimated heat demand, existing heat source, required flow temperature, project stage and message, where supplied. |
| Product support | Name and contact details, postcode, product, model, serial number, installer, installation date, enquiry type and a description of the issue, where supplied through an available support channel. |
| Enquiry administration | The page and form used, date and time, enquiry reference, audience/enquiry category, product interest, handling status, relevant correspondence and the outcome. For installer matching, this may include the selected installer, coverage area and assignment date. |
| Marketing preferences | Whether you separately opted in, the wording and date of that choice, and subsequent withdrawal or objection records. |
| Website security and operation | Technical request information such as an IP address, browser information, request time and page requested; short-lived security identifiers and submission references used to protect forms and prevent repeat submissions. |
We may receive relevant project or installation details from an installer, a colleague or another person who is helping with your enquiry. We will explain the source and use of that information when required by data protection law.
If you provide another person's information, please make sure you are entitled to do so and make them aware of this policy. Only provide details relevant to your enquiry. Do not send payment-card details, passwords, medical information or other sensitive information in an ordinary enquiry message. If further evidence is needed, we will explain how to provide it appropriately.
Required fields are identified on each form. You do not have to use an online form, and optional fields can be left blank. We may be unable to respond, assess the project or make a useful installer introduction without sufficient contact and project information.
3. Why we use information and our lawful bases
We use personal information only for an identified purpose and an appropriate basis under UK data protection law.
| Purpose | Lawful basis and interest |
|---|---|
| Responding to a request for a quotation or taking steps towards a contract directly with you | Contract / steps at your request before a contract, where that basis genuinely applies to HISA's relationship with you. |
| Answering general questions and dealing with contacts acting for organisations | Legitimate interests in responding to requests, communicating with business representatives and assessing suitable products or projects. A business contact is not automatically personally party to their employer's contract. |
| Reviewing a Find an Installer request and making the requested introduction | Legitimate interests in helping you find a suitable installer and arranging the introduction you requested, subject to a necessity and balancing assessment and clear advance information about sharing. |
| Providing support or administering obligations to an individual customer | Contract where necessary to perform HISA's obligations to you; otherwise legitimate interests in resolving product issues, supporting users and maintaining relevant service records. |
| Keeping records required by law or responding to a binding legal request | Legal obligation, only where a specific applicable obligation requires the processing. |
| Establishing, exercising or defending legal claims | Legitimate interests in protecting legal rights, with access and retention limited to what is necessary. |
| Protecting forms, investigating abuse and preventing duplicate submissions | Legitimate interests in maintaining a secure, reliable website and protecting users and business systems. Separate cookie rules also apply. |
| Sending optional product news and marketing updates requested through these forms | Consent, obtained separately from the enquiry and withdrawable at any time. |
We do not treat merely reading or acknowledging this privacy policy as blanket consent. Providing information for a project or support enquiry does not sign you up for marketing.
Where we rely on legitimate interests, we consider the purpose, whether the use is necessary and the impact on you. You may ask us for further information about that assessment.
Your right to object: you can object to processing based on legitimate interests for reasons relating to your circumstances. We must stop unless we can demonstrate compelling overriding grounds or the processing is necessary for legal claims. You can object to direct marketing at any time, and we will stop using your information for that purpose.
4. Installer introductions, HubSpot and other recipients
Installer introductions
When you ask HISA to help find an installer, our team reviews the enquiry and initially matches requests manually. We may share relevant contact and project details with a selected HISA installer partner so they can discuss your project with you. This can include your name, email or telephone number, postcode, property type, product interest and the relevant parts of your message.
We do not distribute the enquiry automatically to an installer list. We share only what is reasonably needed for the introduction and will not include unrelated support correspondence or sensitive information simply because it is held on the same contact record.
If you do not want an installer introduction or want to discuss limits on sharing, tell us before the introduction is made. This may limit our ability to provide the matching service.
An installer may be a separate data controller when independently assessing a project, giving a quotation or carrying out work. Its own privacy notice will then apply to that processing.
CRM and service providers
We use HubSpot to organise enquiries and related contact information, preserve enquiry history and help our team follow up. We use email addresses to help identify existing contacts rather than intentionally creating a new contact each time someone enquires. This does not mean every enquiry is a sales opportunity: support and warranty-related requests are handled distinctly.
Authorised staff and service providers may access information where needed to perform their roles. Relevant provider categories include:
- CRM hosting and support, including HubSpot;
- website hosting, security and technical maintenance;
- business email and communications services;
- authorised CRM administration and integration providers operating on our instructions;
- professional advisers, insurers or authorities where necessary for legal obligations or claims.
We do not sell personal information or share it with installer partners for their unrelated marketing as part of the enquiry service described here.
5. Marketing and your choices
A request for an installer, quotation, commercial discussion or product support is not an agreement to receive marketing.
If an online marketing option is offered, it will be separate, optional and unchecked by default. We will record what you agreed to and when. Leaving it unticked will not prevent you from sending an enquiry or receiving the response you requested.
Where you opt in to HISA email updates, you can withdraw that consent by using the unsubscribe option in the message or contacting us. Withdrawal does not affect the lawfulness of earlier processing. We may retain a minimal suppression record so that we continue to respect your choice.
Necessary messages about your specific enquiry, appointment, order or support request are separate from optional marketing. We will not use that distinction to disguise promotional messages as service communications.
6. Cookies, technical requests and international processing
Cookies and similar technologies
When an enquiry form is enabled, we use short-lived security cookies to help protect the session, prevent forged requests and manage submission attempts. These are not used by the enquiry adapter for advertising or cross-site tracking.
| Cookie in the current implementation | Purpose | Configured browser lifetime |
|---|---|---|
__Host-hisa_enquiry | Installer-enquiry session protection | 30 minutes |
__Host-hisa_enquiry_commercial_project | Commercial-enquiry session protection | 30 minutes |
__Host-hisa_enquiry_support | Support-enquiry session protection | 30 minutes |
These cookies are set only when the relevant form configuration is ready. Other support forms or hosting components may require the inventory to be updated before release. Blocking essential cookies may prevent secure form submission; email and telephone contact routes remain available.
The current website build loads font files from Google Fonts. When your browser requests those resources, Google receives technical request information, including your IP address.
We will explain any additional analytics, advertising or similar technologies before using them and obtain consent where required. We do not assume that every analytics product qualifies for an exception from consent.
International processing
Some service providers operate internationally and may process information outside the United Kingdom. Where a transfer is restricted under UK data protection law, we must use an applicable adequacy arrangement or appropriate safeguards, such as approved contractual protections, and make any required transfer assessment.
You can contact us for details of the safeguards relevant to your information and how to obtain a copy, subject to appropriate protection of confidential information.
7. How long we keep information and how we protect it
Retention
We keep personal information only for as long as needed for the purpose for which it was collected, taking account of relevant legal obligations and justified claims requirements. We review records and delete or anonymise information when it is no longer needed.
| Record category | Period or decision criterion |
|---|---|
| Sales, Find an Installer and commercial enquiries that do not progress into an active project or customer relationship | Up to 24 months after the last substantive interaction about the enquiry. Delete or anonymise sooner where there is no continuing need. An automated marketing message does not restart this period. Any retention beyond it requires a separately documented legal obligation or justified legal-claim need, limited to the relevant information. |
| Active projects, quotations and customer correspondence | For the active relationship, then only for as long as needed to meet relevant contractual or accounting obligations or justified legal-claim requirements. |
| Installer referral and assignment information | While the introduction/project remains active, then only while needed for the relevant enquiry or customer purpose, applying the unconverted-enquiry limit where it applies and any necessary legal-obligation or justified legal-claim retention. Do not keep detailed project information solely to maintain a suppression preference. |
| Support and warranty-related enquiries | For the relevant support or warranty purpose and any justified legal-claim period. These records are not automatically subject to the unconverted-sales-enquiry rule. A product's long warranty does not automatically justify retaining every enquiry field for that entire period. |
| Marketing preferences and consent evidence | While the consent is relied on and afterwards only for as long as needed to demonstrate and handle questions about that consent or meet justified legal-claim requirements. Retain only the minimum suppression information needed to respect withdrawal or objection. |
| Security identifiers, logs, submission receipts and backups | Only for as long as needed for security, preventing repeat submissions, operational recovery and any applicable legal obligations. Review and deletion take account of those purposes and the relevant backup cycle. Cookie expiry does not mean that all related server records have been deleted. |
Information relevant to an actual dispute or legal requirement may need to be kept longer, but only to the extent necessary. Backup deletion may follow a separate controlled cycle; records should not be restored into routine use after a valid deletion without preserving that deletion decision.
Security
We use proportionate technical and organisational safeguards to protect information against unauthorised access, loss or misuse. These include appropriate access restrictions and secure transmission of enquiries. Service providers are expected to protect information under suitable contractual arrangements.
No online service can guarantee absolute security. Please do not include unnecessary sensitive information in an ordinary form or email.
8. Your rights and complaints
Depending on the circumstances and the lawful basis for processing, you may have rights to:
- receive information about how we use your personal data and obtain a copy;
- correct inaccurate or incomplete information;
- request deletion;
- restrict processing;
- object to processing, including the rights highlighted in section 3;
- receive certain information in a portable format;
- withdraw consent where consent is the basis for processing;
- exercise applicable rights concerning solely automated decisions with legal or similarly significant effects.
These rights are not absolute and some have specific conditions or lawful exceptions. Contact us using the details in section 1. We may request reasonable information to confirm your identity or clarify your request. We normally respond within one month, subject to extensions or other timing rules permitted by law, and will explain any applicable extension. Requests are normally free of charge; a fee or refusal is possible only where the law permits it.
We would welcome the opportunity to resolve a concern, but this does not prevent you from complaining to the Information Commissioner's Office (ICO), the UK's data protection regulator: https://ico.org.uk/make-a-complaint/.
9. Automated checks, links and policy changes
We use automated technical checks to protect forms and reduce spam or repeated submissions. Under the enquiry service described here, installer matching is reviewed by HISA staff; submitting a form does not itself trigger automatic installer assignment.
We do not intend to make decisions about you based solely on automated processing that produce legal or similarly significant effects as part of these website enquiries.
Our website may link to external websites. Their operators may use information under their own privacy notices. The separate warranty-registration service also needs privacy information appropriate to its actual processing; this policy does not certify that service's compliance.
We may update this policy to reflect changes in our services or legal obligations. This version shows its last-updated date above. If we intend to use information for a materially different purpose, we will provide the information and obtain any additional permission required before doing so.