This policy explains how Headroom Technology Ltd ("Headroom", "we", "us") collects and uses personal data when you use the Headroom platform, website and services. Headroom is the data controller. We are a company registered in England & Wales (company number [to be confirmed]), registered office [registered office address].
ICO registration. Headroom Technology Ltd is registered with the UK Information Commissioner's Office under registration number [ICO registration number to be confirmed]. Headroom is a separate legal entity and maintains its own registration.
Headroom is a business-to-business service for renewable-energy installers and developers. This policy covers personal data of our account holders, their staff, and individuals whose details are provided to us in connection with a grid connection application (for example a site owner or occupier).
| Category | Examples |
|---|---|
| Account & contact | name, work email, company, login credentials, plan and billing status |
| Site & application data | site address and postcode, MPAN, asset type and system size, DNO, connection references |
| Site owner / occupier | full legal name, role, organisation, registered address and company number, and Letter of Authority details |
| Uploaded documents | electricity bills, designs or other files you upload, which we process (including by automated text extraction) to pre-fill applications |
| Usage & technical | IP address, device/browser information, and interactions with the Service (via essential cookies/logs) |
| Payment | billing details processed by our payment provider (we do not store full card numbers) |
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Provide the Service — screening, verdicts, document generation | Performance of a contract |
| Submit applications to DNOs on your instruction | Performance of a contract; the Letter of Authority evidences the site owner's authorisation |
| Account administration, billing and support | Contract; legitimate interests |
| Securing, maintaining and improving the Service | Legitimate interests |
| Service and, where relevant, marketing communications | Legitimate interests, or consent where required |
| Meeting legal and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we balance those interests against your rights. You can object to processing based on legitimate interests (see section 8).
Published network datasets (such as UKPN capacity data, the ENA Embedded Capacity Register and PVGIS / EU JRC) are sources we read from; we do not send your personal data to them as part of screening.
Our infrastructure is hosted within the European Economic Area. Where any provider processes personal data outside the UK or EEA, we put appropriate safeguards in place (such as UK approved transfer mechanisms). [Confirm once sub-processors are finalised.]
We keep personal data for as long as needed to provide the Service and to meet legal, accounting and regulatory requirements. Application records are retained while your account is active and for a reasonable period afterwards; billing records are kept for the period required by law. [Confirm specific retention periods.]
Under UK data protection law you have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where we rely on it. To exercise any of these, contact hello@headroom.technology. We will respond within the time limits set by law.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk) — though we would welcome the chance to resolve any concern first.
We use essential cookies and similar technologies needed to run the Service and keep it secure. If we introduce analytics or non-essential cookies, we will update this policy and seek consent where required.
We use appropriate technical and organisational measures to protect personal data, including access controls and encryption in transit. No system is completely secure, and you are responsible for keeping your account credentials confidential.
We may update this policy from time to time. The current version is always posted here with its "last updated" date; material changes will be highlighted where appropriate.
Questions or requests about your personal data: hello@headroom.technology. [Consider a dedicated privacy@headroom.technology inbox.]