Privacy Policy

1. Who we are

Morheat Ltd is a UK-registered company providing Gas Safe registered plumbing and heating services in Croydon and South London. For the purposes of UK GDPR and the Data Protection Act 2018, Morheat Ltd is the data controller for the personal data we collect through this website and during our work for you.

• Address: 39a Park Hill Road, Croydon, CR0 5NF, United Kingdom
• Email: damorcon@gmail.com
• Phone: 07377 793 825
• Gas Safe Register: #585424
• Company Director: Daniel Morgan

2. What data we collect and why

2.1 Booking a service

When you book a service through our booking page (which uses a third-party scheduling tool, Setmore), the following information is collected:

• Your name, address, email, and phone number — to confirm your appointment, get to your property, and contact you before or after the visit.
• The service you've requested and your preferred time slot — to schedule the job correctly.
• Payment card details for the deposit — handled directly by Stripe. Morheat Ltd does not see or store your full card number, expiry, or security code.

Lawful basis: performance of a contract (UK GDPR Article 6(1)(b)) — we need this data to deliver the service you've booked.

2.2 Contacting us by email or phone

If you email damorcon@gmail.com or call 07377 793 825, we will process whatever information you share to respond to your enquiry. We do not currently use call recording. If this changes, we will update this policy and inform callers at the start of the call.

Lawful basis: legitimate interest in responding to enquiries (Article 6(1)(f)), or steps taken prior to entering a contract (Article 6(1)(b)).

2.3 Website analytics

With your consent, we use Google Analytics 4 to understand how visitors use our website. This includes:

• Pages viewed and time spent on each page
• Referring source (search engine, direct, social, etc.)
• Approximate geographic location (country/region level, derived from your IP address, which is anonymised before storage)
• Device type and browser
• Interactions with key elements — e.g. clicks on "Book" buttons, phone links, email links

Analytics cookies only run if you accept them via our cookie banner. If you reject analytics, no data is sent to Google. You can change your choice any time via Cookie settings.

Lawful basis: your consent (Article 6(1)(a)).

2.4 CP12 gas safety certificates and work records

When we carry out a gas safety inspection or a service, we create a written record of the property, appliances checked, findings, and any remedial action. This record is emailed to the booker (you, or — for rental properties — your landlord or letting agent) and kept as part of our business records.

Lawful basis: legal obligation (Article 6(1)(c)) — HSE guidance requires gas engineers to retain work records; performance of a contract for the service.

3. Third-party processors

We use the following trusted third parties to deliver our service. Each has its own privacy policy covering how it handles data:

• Setmore — online booking platform. setmore.com/privacy
• Stripe — payment processor for booking deposits. stripe.com/privacy
• Google (Google Analytics 4) — website analytics (consent-gated). policies.google.com/privacy
• Netlify — website hosting and content delivery. netlify.com/privacy
• Google Workspace / Gmail — the inbox where booking confirmations and contact emails are received. policies.google.com/privacy

The Setmore booking tool runs inside an iframe on our homepage. When you interact with the booking form, Setmore may set its own cookies and may load additional third-party services (payment providers, fraud checks, analytics) governed by its privacy policy, not ours. We recommend reading Setmore's privacy notice before completing a booking.

4. Cookies

We use two categories of cookies:

4.1 Strictly necessary cookies

Required for the site to work (e.g. remembering your cookie preferences). These are set automatically and cannot be disabled — without them the site would not function. No consent is required under PECR for strictly necessary cookies.

• morheat_consent — stores your cookie preference choice. Expires after 6 months.

4.2 Analytics cookies (consent only)

Set only if you accept analytics via our cookie banner. Used by Google Analytics 4 to understand site usage.

• _ga, _ga_* — Google Analytics session and user identifiers. Typically expire after 2 years.

Your current choice: Change cookie settings.

5. Your rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — ask for a copy of the data we hold about you.
• Right to rectification — ask us to correct data that is wrong or incomplete.
• Right to erasure — ask us to delete data, subject to legal retention requirements (for example, we must retain gas safety records for a period per HSE guidance).
• Right to restriction of processing — ask us to stop processing data in certain circumstances.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time (for example, by changing your cookie preferences).

To exercise any of these rights, email damorcon@gmail.com. We will respond within one calendar month.

6. Data retention

We keep personal data only for as long as we need it:

• Booking records and contact details — retained while the business relationship is active. If you want your data removed, contact us and we'll action it within one month.
• Gas safety certificates and work records — retained for at least 2 years per HSE guidance and recommended industry practice; may be retained longer where required by law or insurance.
• Payment records — retained for 6 years in line with HMRC's financial record-keeping requirements.
• Website analytics — aggregated, anonymised Google Analytics data retained according to Google's default retention (currently 14 months).

7. International transfers

Some of our processors (Google, Stripe, Netlify, Setmore) may transfer data outside the UK, including to the United States. Where this happens, the transfer is protected by the UK–US Data Bridge, Standard Contractual Clauses, or other safeguards recognised under UK GDPR.

8. Children

Our services are directed at adults (18+) who own or rent property requiring gas work. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please email us so we can delete it.

9. How we protect your data

All traffic to and from this site is encrypted with HTTPS. Payment data is handled entirely by Stripe and never touches our systems. Booking data lives inside the Setmore platform, protected by Setmore's access controls. Email correspondence is held in a Google account with two-factor authentication.

10. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will always reflect the latest version. For material changes, we will notify you via the booking confirmation email on your next booking, or by updating a prominent notice on this page.

11. Complaints

If you believe we have handled your data incorrectly, please email damorcon@gmail.com first so we can address your concern directly. You also have the right to complain to the UK's data protection regulator:

• Information Commissioner's Office (ICO)
• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

12. Contact

Any questions about this policy or how we handle your data: damorcon@gmail.com or 07377 793 825.

Last updated: 25 April 2026 · Morheat Ltd · Gas Safe #585424