This policy explains how Headroom Technology Ltd ("Headroom", "we", "us") collects and uses personal data when you use the Headroom platform, website and services. Headroom is the data controller. We are a company registered in England & Wales (company number 17361252), registered office Little Tillingham, 103 Winchelsea Road, Rye, TN31 7EL.
ICO registration. Headroom Technology Ltd is registered with the UK Information Commissioner's Office as a data controller under registration number ZC221029. Headroom Technology Ltd is a separate legal entity and holds this registration in its own right.
Headroom is a business-to-business service for renewable-energy installers and developers. This policy covers personal data of our account holders, their staff, and individuals whose details are provided to us in connection with a grid connection application (for example a site owner or occupier).
| Category | Examples |
|---|---|
| Account & contact | name, work email, company, login credentials, plan and billing status |
| Site & application data | site address and postcode, MPAN, asset type and system size, DNO, connection references |
| Site owner / occupier | full legal name, role, organisation, registered address and company number, and Letter of Authority details |
| Uploaded documents | electricity bills, designs, quotes or other files you upload, which we process (including by automated text extraction) to pre-fill applications. Where you attach a document to a site, we also store the file so it stays with that application |
| Usage & technical | IP address, device/browser information, and interactions with the Service (via essential cookies/logs) |
| Payment | billing details processed by our payment provider (we do not store full card numbers) |
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Provide the Service - screening, verdicts, document generation | Performance of a contract |
| Generate a Letter of Authority for the connecting customer to sign | Performance of a contract |
| Account administration, billing and support | Contract; legitimate interests |
| Securing, maintaining and improving the Service | Legitimate interests |
| Service and, where relevant, marketing communications | Legitimate interests, or consent where required |
| Meeting legal and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we balance those interests against your rights. You can object to processing based on legitimate interests (see section 8).
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Cloud hosting and database storage | Helsinki, Finland (EEA) |
| Stripe Payments Europe, Ltd. | Payment processing, card details, billing email address and receipts | Ireland, with group transfers to the United States |
| Anthropic PBC | Automated reading of documents you upload (bills, designs, quotes) to pre-fill applications | United States |
| Google Ireland Ltd / Google LLC | Geocoding of site addresses and rooftop solar imagery (Maps Platform and Solar API), and web fonts served to your browser | Ireland and the United States |
| Resend (Plus Five Five, Inc.) | Sending transactional email such as password reset and account setup links | Ireland (EU region), with group transfers to the United States |
| Microsoft Ireland Operations Ltd | Our own email mailboxes, so messages you send to us are stored and read there | European Union |
| Postcodes.io | UK postcode lookup | United Kingdom |
Published network datasets (such as UKPN capacity data, the ENA Embedded Capacity Register and PVGIS / EU JRC) are sources we read from; we do not send your personal data to them as part of screening.
Our servers and database are hosted in Helsinki, Finland, within the European Economic Area. Some of the sub-processors named in section 5 process personal data outside the UK and EEA, principally in the United States. In particular, documents you upload are read by an automated extraction service operated by Anthropic PBC in the United States, and payment data is handled by Stripe. Where personal data leaves the UK or EEA we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an adequacy decision where one applies.
If you would rather your documents were not sent to an automated extraction service, do not use the upload feature; you can enter the same details into the form by hand and nothing is transferred.
We keep personal data only for as long as it is needed, and we run an automated job that applies these periods rather than relying on anyone to remember them.
| What | How long | Why |
|---|---|---|
| Account and contact details | While your account is active, then 12 months | So a returning customer finds their history, without us holding dormant records. An account attached to a live application is kept until that application ages out, because the record needs an owner |
| Applications and document packs | 6 years from last activity | The limitation period for a contract claim, and the period HMRC expects business records to be kept |
| Documents you upload (bills, designs, quotes) | 12 months after the application is connected or refused, or 3 years of inactivity if it never reaches an outcome | Their purpose is to evidence a live application. Once it is decided, they are deleted from the database and from disk |
| Enquiries that do not become accounts | 12 months | Long enough to follow up, not indefinite |
| Sessions and technical logs | 30 days (sessions), 90 days (logs) | Security, troubleshooting and abuse prevention |
| Billing records | 6 years | Tax and accounting obligations |
Connection outcomes. Where a screening prediction is compared against what a network operator actually decided, we keep that comparison indefinitely to improve the Service, but we anonymise it first: the postcode is reduced to its outward part and names are removed, so it no longer identifies anyone.
You can delete a document at any time from the site it belongs to, and ask us to delete your account and its records at any time using the contact details below.
Documents you attach to a site are kept with that application and are deleted when you delete the document, or automatically when the application record itself is deleted. They are visible only to your own account.
Under UK data protection law you have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where we rely on it. To exercise any of these, contact privacy@headroom.technology. We will respond within the time limits set by law.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk) - though we would welcome the chance to resolve any concern first.
We use essential cookies and similar technologies needed to run the Service and keep it secure. If we introduce analytics or non-essential cookies, we will update this policy and seek consent where required.
We use appropriate technical and organisational measures to protect personal data, including access controls and encryption in transit. No system is completely secure, and you are responsible for keeping your account credentials confidential.
We may update this policy from time to time. The current version is always posted here with its "last updated" date; material changes will be highlighted where appropriate.
Questions or requests about your personal data: privacy@headroom.technology. We aim to respond within one month, as required by the UK GDPR.
You can also write to us at Headroom Technology Ltd, Little Tillingham, 103 Winchelsea Road, Rye, TN31 7EL.