Privacy Policy
Effective date: 2026-09-03
1. Who we are
This site is operated by Spot Free HVAC ("we", "us", "our"). If you have a question about this Privacy Policy or your personal data, contact us at the contact details on this site.
2. What this policy covers
This Privacy Policy explains what information we collect when you visit this website or submit information through our forms, how we use that information, who we share it with, how long we keep it, and the choices and rights you have.
3. Information we collect
3.1 Information you give us in forms
When you submit a contact, sign-up or lead form on the site, we collect the fields you fill in — typically your name, email address, phone number and any message or details you provide. These fields are used to respond to you and to provide what you asked for.
3.2 Technical information collected with every form submission
To protect the form and the people who use it from spam, fraud and abuse, our form system captures the following technical details every time a form is submitted:
- Your IP address
- Your browser and operating system (from the User-Agent header)
- The page you were on when you submitted the form (the referrer URL)
- A timestamp of the submission
- Anti-bot signals (for example whether hidden fields meant for automated scripts were filled in)
We use this information strictly to identify and block bad actors — automated spam submitters and fraudulent enquiries. It is not used to profile or track individual visitors.
3.3 Information collected automatically as you browse
When you visit the site, our hosting provider automatically receives standard log information (IP address, browser type, requested URL, timestamp, response code). This is standard for any website and is used for security and to keep the service available.
3.4 Cookies and similar technologies
We use cookies and comparable browser storage for the following purposes:
- Essential: required for the site to function — for example remembering your cookie-consent choice. These cannot be switched off.
- Analytics: Google Analytics 4 (GA4), loaded through Google Tag Manager. GA4 records aggregate visitor behaviour (which pages are popular, referral sources, device categories) so we can improve the site.
No analytics or advertising cookies are set until you give consent through our cookie banner (where the law requires consent). You can change your choice at any time by clicking the cookie icon at the bottom-left of any page.
4. Why we use your information (legal basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your enquiry or request submitted through a form | Legitimate interest (Art. 6(1)(f)) — you asked us to contact you; and pre-contractual steps (Art. 6(1)(b)). |
| Detecting and blocking spam or fraudulent form submissions | Legitimate interest (Art. 6(1)(f)) — protecting our systems and the people who use them. |
| Analytics (GA4) | Consent (Art. 6(1)(a)) — you accepted the "Analytics" category in the cookie banner. |
| Security logging and hosting-level telemetry | Legitimate interest (Art. 6(1)(f)) — keeping the service available and safe. |
5. Third parties that process data on our behalf
We share the minimum information necessary with the following processors. None of them may use your data for their own purposes, and none of them buy your data from us.
- Web hosting and content delivery: Cloudflare, Inc. serves the site and processes web-server logs (IP, request path, timestamp) as an ordinary part of serving it.
- CleverCrow forms: our form processor. Receives the fields you submit plus the anti-abuse signals in section 3 and delivers them to us.
- Google — Analytics (GA4) and Tag Manager: only when you consent to Analytics. Processes anonymised page-view and behaviour data. Google privacy policy.
We do not sell personal data to any third party.
6. International transfers
Some of the processors listed above (notably Cloudflare and Google) are established in the United States. When your data is transferred outside the EEA/UK we rely on the transfer mechanisms those providers offer, such as the EU-US Data Privacy Framework and Standard Contractual Clauses.
7. How long we keep information
- Form submissions are retained for as long as we reasonably need to respond and follow up (typically up to 24 months), then archived or deleted.
- Anti-abuse technical signals (IP, User-Agent, timestamps) are retained for up to 90 days and then deleted or aggregated.
- Web-server access logs are retained for up to 30 days.
- Analytics data in GA4 is retained on Google's minimum available retention setting (currently 2 months for user-level data).
8. Your rights
If you are in the UK, EEA, California or another jurisdiction with equivalent data-protection law, you have the following rights over your personal data:
- Access: ask for a copy of the information we hold about you.
- Rectification: ask us to correct information that is wrong or out of date.
- Erasure: ask us to delete your personal data.
- Restriction: ask us to pause certain uses of your data while a dispute is resolved.
- Objection: object to processing based on our legitimate interests.
- Portability: ask for a machine-readable copy of data you gave us.
- Withdraw consent: where processing is based on consent, withdraw it at any time using the cookie preferences widget.
- Complain: lodge a complaint with your local data-protection authority.
To exercise any of these rights, use our Data Access & Erasure Request form. We will respond within one month.
9. Children
This site is not directed at children under 16, and we do not knowingly collect information from children. If you believe a child has submitted information to us, please contact us and we will delete it.
10. Security
We use HTTPS everywhere, keep our software up to date and restrict access to submitted information on a need-to-know basis. No system is 100% secure — if we become aware of a breach affecting your personal data we will notify you and the relevant authority as the law requires.
11. Changes to this policy
If we make material changes to how we process personal data, we will update this page. The effective date at the top tells you when the current version took effect.
12. Contact
Questions about this policy or your data: the contact details on this site.