Privacy Policy
This policy explains how we collect, use, store and protect your personal data when you use the Norvera website and services. Please read it carefully.
1. Who we are, Data Controller
Norvera is a trading name of CSS International Ltd, company number 16110027, registered office 85 Great Portland Street, First Floor, London, W1W 7LT. CSS International Ltd is the data controller for norvera.co.uk.
Norvera (CSS International Ltd) is the company you contract with when you buy an installation. We supply the boiler and arrange for the installation to be carried out by an independent Gas Safe registered engineer from our network. We are the data controller for norvera.co.uk. We share the information needed to complete your installation (such as your name, address and contact details) with the assigned engineer so they can carry out the work.
2. Information we collect
| Category | Examples |
|---|---|
| Identity & contact | Full name, email address, phone number |
| Property details | Installation address, postcode, property type |
| Technical data | IP address, browser type, device type, pages visited, referral source |
| Boiler & system data | Current boiler make/model, age, system type (combi, system, regular) |
| Media | Photos of your boiler or installation area that you voluntarily upload |
| Communications | Messages, emails and call records between you and our team |
| Financial data | We do not store payment card details; payments are processed by secure third-party providers |
We collect this information when you submit an enquiry form, call our team, upload photos, or browse the website.
3. How we use your information
| Purpose | Lawful basis |
|---|---|
| Provide a fixed-price quotation | Performance of a contract / pre-contractual steps |
| Match you with a Gas Safe engineer | Performance of a contract |
| Communicate about your enquiry, survey or installation | Performance of a contract |
| Service follow-up and maintenance reminders | Legitimate interests (you may opt out at any time) |
| Respond to complaints or requests | Legal obligation / legitimate interests |
| Improve our website, services and marketing | Legitimate interests |
| Comply with legal obligations | Legal obligation |
| Marketing communications | Consent (you may withdraw at any time) |
4. Sharing your information
- Appointed engineers, relevant details are passed to the engineer, who is an independent data controller with their own privacy policy.
- Service providers, communications, CRM, cloud and analytics processors bound by data processing agreements under UK GDPR.
- Legal & regulatory authorities, where required by law.
- Business transfers, we will notify you before any transfer.
5. Data retention
| Data | Retention period |
|---|---|
| Enquiry and quotation data | 3 years from last interaction |
| Installation records | 10 years (warranty support and legal compliance) |
| Financial transaction records | 7 years (HMRC requirement) |
| Marketing preferences | Until you withdraw consent or object |
| Website analytics (anonymised) | 26 months |
Deletion requests are subject to our legal obligations (see Section 6).
6. Your rights under UK GDPR
- Right of access (subject access request)
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object (including to direct marketing)
- Right to withdraw consent
To exercise any of these rights, contact us at hello@norvera.co.uk. We will respond within one calendar month. If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113.
7. International transfers
Your data is primarily processed in the UK and EEA. Where a provider is located outside these areas, we put in place appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or standard contractual clauses.
8. Security
We protect your data with HTTPS encryption, restricted access controls and secure cloud storage. In the event of a personal data breach, we will notify the ICO within 72 hours and affected individuals where required.
9. Cookies
Our website uses cookies. Please see our Cookie Policy for full details.
10. Changes to this policy
We may update this policy from time to time. The current version is always posted on this page with its last-updated date.