Privacy Policy

Qualitymark Protection Ltd (“We”) are committed to protecting and respecting your privacy.

This policy sets out the basis on which we collect and process personal data.

For the purpose of the Data Protection legislation and rules (the Act), Qualitymark Protection is an insurance broker and the entity and data controller responsible for holding and using your data.  We may share data and information with other parties’, and this is explained in the policy below.

Information we may collect about you

We may obtain personal information from Qualitymark Protection Accredited Installers and their clients for the installations they undertake, or from other third-party sources, including publicly available data.  Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may therefore collect and process the following type of data:

For clients of our installers or the public:

• Information that our installers provide about you via our on-line registration system or manually. This would include your name and address and contact details along with information about the work which has been undertaken. We hold and use this information as it is in ours and our installers legitimate interests to do so.  The information is used for the administration of the product offered and monitoring the conduct of our installers.
• If you contact us, by way of any enquiry, including to make a complaint, we will retain a record. Records may include call recordings if you contact us via telephone and other correspondence. We will usually take details of your name and address and contact details along with details of your enquiry and our reply.  We hold and use this information as it is in our legitimate interests.

For installers or employees of installers:

• Information that you or your employer provide either manually or through our on-line registration system, which may include your name, address and contact details along with information about your role in the installer firm. Information may be provided as part of an application to Qualitymark Protection or to enable us to administer the product (and the contract you enter for this).  Where you are an employee of the installer, we hold and use the information as it is in our legitimate interests to do so.
• If you contact us, by way of complaint or otherwise, we will keep a record of that which will include any correspondence and telephone calls. Where you are the installer, we hold and use the information as part of your agreement with the scheme. Where you are an employee of the installer, we hold and use the information as it is in our legitimate interests to do so.
• We may obtain credit checks, identity checks and other due diligence checks carried out against you, your address(es) or your business(es) and copies of any references taken or this information is obtained from third parties such as credit reference agencies and publicly available information.  We collect this information where you are the installer, applying to register with Qualitymark Protection or have significant control of an installer.  We hold and use this as part of our entry into a contract with an installer.

We use information held about you in the following ways:

• To assess your application to become an Accredited Quality Protection Installer.

• To carry out our obligations and enforce our Accredited Installers obligations under the contract with Qualitymark Protection.
• To provide you with information concerning your registration with Qualitymark Protection.
• To obtain the insurance cover. We will share any details which the insurer requires of an installer and their clients. The client will be provided with an insurance policy confirming their cover.  The insurer will process the information as data controller as they have a legitimate interest in this to provide the required cover.
• To verify your identity and prevent fraud.
• For legal and regulatory reasons.
• In order to conduct inspections on the installations completed by installers.
• To provide installers and their clients with information, products or services that they request from us.
• We may send marketing communications to installers about our products and services, and the products and services of other carefully selected third parties (unless you have opted out of marketing, or we are prevented by law from doing so). You do however have the right at any time to ask us not to contact you for marketing purposes. To opt out of marketing activity please contact sales@qualitymark.co.uk and allow 30 days for your request to be processed.

• Financial or fraud investigation authorities
• Credit reference agencies
• Insurance companies, brokers or other intermediaries. If you require details of the Insurer this will be included in the insurance policy provided to you when work is registered with us.
• Regulatory authorities
• Organisations we’re legally obliged to share personal information with
• External auditors or inspectors
• Contractors
• Certification Bodies, Trustmark, Ofgem, Consumer Codes, Trading Standards, Manufacturers and System Designers
• The purchaser or seller of or investor in any business or asset which we are selling or contemplating selling or purchasing and their advisors or service providers.
• Suppliers and service providers
• Selected third parties such as but not limited to:
  Qure Group Ltd, Company Number 13041330, ICO Registration ZA873287
  The Integrity Foundation, Company Number 07972072, ICO Registration Z3241412
  Home Improvement Consumer Protection Scheme Ltd, Company Number 09507751, ICO Registration ZA209020
  The Double Glazing & Conservatory Ombudsman Quality Assurance Ombudsman Scheme, Company Number 05860672, ICO Registration Number Z1344301

We have contracts in place with all third parties to whom we provide your data to, and they are required to ensure that all the requirements of the Data Protection legislation are met.

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here
• Your right to rectification– You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
• Your right to erasure– You have the right to ask us to delete your personal information. You can read more about this right here.
• Your right to restriction of processing– You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
• Your right to object to processing– You have the right to object to the processing of your personal data. You can read more about this right here.
• Your right to data portability– You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
• Your right to withdraw consent– When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. To make a data protection rights request, please contact us using the contact details at the bottom of this privacy notice.

The data that we collect may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. We take all steps reasonably necessary to ensure that all data is treated securely and in accordance with this privacy policy including when it leaves the EEA.  Where data leaves the EEA it is subject to contractual requirements to ensure the rules continue to apply.  Data will at all times remain subject to the provisions of the Data Protection Act.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will retain your data for as long as it is reasonably required for our legitimate purposes and to meet our regulatory requirements, and for no longer than is necessary.

Call recordings are kept for a maximum of 13 months.

We keep our privacy policy under regular review. This version was last updated on 29^th July 2025. Any changes we may make to our privacy policy in the future will be posted on our website and, where appropriate, notified to you by e-mail.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

If you have any questions or concerns about our use of your personal information, including any requests to exercise your legal rights, you can contact us at The Data Protection Officer, Qualitymark Protection, Solutions House, Chorley Business and Technology Centre, Euxton Lane, PR7 6TE.

Alternatively, you can contact us via email at dpo@qualitymark.co.uk or by telephone on 0345 340 0524.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk