Legal

Privacy Policy

Last updated: July 2026

Who I am

I'm Frankie, the director of Bright Sparks of York Ltd, an electrical contracting business based in York. My website address is brightsparks-york.com. The business is registered with the Information Commissioner's Office as a data controller (registration C1927867).

What data I collect and why

Contact form submissions

When you use my contact form, I collect your name, email address, phone number, and message. I use this solely to respond to your enquiry. I don't add you to any mailing list or share your details with anyone.

Google Analytics (only if you consent)

If you accept cookies via the banner on your first visit, I load Google Analytics 4 (GA4) with IP anonymisation enabled. The data is anonymous and aggregated, I cannot identify you personally from it. Google may process this data on servers outside the UK. If you decline, no analytics cookies are set. Full details, including the specific cookie names and how to change your mind, are in the Cookie Policy.

No other tracking

I don't use any other tracking tools, advertising cookies, social media trackers, or third-party analytics. I don't run remarketing or targeted advertising on this site.

Customer job records

Once you become a customer, I keep records of the work I've carried out at your property. That includes your name, address, contact details, the scope and price of the job, and any electrical certificates I've issued (Electrical Installation Condition Reports, Electrical Installation Certificates, Minor Works Certificates, fire alarm and emergency lighting certificates). The lawful basis is contract performance for the active job, then legal obligation and legitimate interest for the certification record afterwards.

NICEIC notification

When I do work that's notifiable under Building Regulations Part P (consumer-unit changes, new circuits, certain bathroom and kitchen work) I notify NICEIC, my certification body, who in turn notify your local authority. They receive your name, address, and the installation details, that's a regulatory requirement, not optional.

EICR renewal reminders

If I've carried out an EICR for you, I may send a reminder a few weeks before your retest is due (typically every 5 years for a domestic property, every 1 to 5 years for rentals depending on the report). Every reminder email carries a "reply STOP and I won't chase again" line at the bottom, reply with that and I take you off the list. The lawful basis is legitimate interest for an existing customer; I don't send these unprompted to anyone who hasn't been a customer. If you've signed up to my free landlord reminder service instead, those reminders work on your consent, see the next section.

The free landlord reminder service

If you sign up to my free landlord reminder service, I collect your name, mobile number, the property's postcode, the EICR renewal date you give me, and your email if you choose to add it. I use them to send you a personal reminder before it's due. The lawful basis is your consent, the reminders are the thing you signed up for, and you can withdraw it at any time by closing your profile: ring me, message me, or reply STOP to any reminder. When you close your profile I delete the details you gave me from my live systems straight away; backup copies drop off automatically within my normal backup rotation. If you've also been a customer, the certificate and accounts records described above are kept under their own rules and aren't affected by closing a reminder profile. I don't ask for or store your tenants' details. If your profile goes quiet, the last date you asked me to track has passed and we've not spoken since, I'll close it and delete your details within 24 months. If you ticked the tips box, I'll also send the occasional tip or offer for York landlords; that's a separate consent and you can stop those at any time without affecting your reminders. Your details sit in the same secure system as my customer records, run for me by the companies that host my booking system and email, they process the data on my instructions only, never for their own use.

The landlord portal

If you're a landlord, you can sign in to a portal on my site to keep track of your own reminders and, where I've done work for you, your own certificate and job records. Here's how signing in works and what I do with your details.

Signing you in

When you ask to sign in, I send a one-time sign-in link to your email address. This happens automatically and straight away, to the address you type in, and it's the only email the portal ever sends you on its own. The link is the only thing in it. You can also save a passkey on your own device, so next time you sign in with your fingerprint, face, or device PIN instead of waiting for an email.

To do this I process your email address and your sign-in credential, and I keep a short record of how you sign in: which method you used, the email address I verified, and when you first linked it and last used it. I do this to keep your account secure and make sure it's really you signing in. The lawful basis is my legitimate interest in protecting your account, not consent.

Passkeys never send me your fingerprint or face

If you sign in with a passkey, the fingerprint or face check happens on your own device and stays there. I never receive or store any biometric data. All I hold is a public key and a reference to your device, which on their own can't identify you or unlock anything else.

What you can see once you're signed in

Once you're signed in you can see the reminders you've set up yourself, and, where I've carried out work for you, your own certificates and job records. Access is tied to your own account, so you only ever see records that belong to you. If a record was first commissioned by someone else, for example a previous owner of the property, I only hand it over to you after someone at Bright Sparks has confirmed it should go to you, and I log that.

Staying signed in

When you sign in, the portal sets one small cookie so you stay signed in as you move between pages. It's set only after you sign in, it's needed for the portal to work, and it clears when you sign out. There's more detail in the Cookie Policy.

If you invite a tenant

Later on, the portal will let you hand a tenant a booking link so they can arrange access for a visit. When it does, you'll enter the tenant's email on your own device and I won't store it. I hold no details about your tenants.

How long I keep data

Contact form submissions are kept only as long as needed to handle your enquiry. Google Analytics data is retained for 14 months (the default GA4 retention period). Quotes that don't go ahead are kept for 24 months. Job and invoice records are kept for 6 years plus the current tax year. Free landlord reminder profiles are kept while the profile is open, then deleted within 24 months of the relationship ending.

Electrical certification records (EICRs and other certificates) are kept for the lifetime of the installation. Insurance claims, future remedial work, and regulatory enquiries can surface decades after the work was done, and the regulations expect the record to be available. If you ask me to remove your data from a certificate (right to erasure under Article 17), I'll redact your name and contact details from the record but keep the technical lineage (date, address, outcome, retest cadence) for the reasons above. I'll log every such request and tell you what's been redacted.

Your rights

Under UK GDPR, you have the right to:

How to complain about how I handle your data

If you think I've mishandled your personal data, please tell me first so I can put it right. You can reach me by any of these routes:

I'll confirm I've received your complaint within 30 days, look into it without undue delay, and let you know the outcome in plain language. If anything is going to take a while, I'll keep you posted.

If you're not happy with how I deal with it, you can take it to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. I'd always rather sort it out with you directly first.

Contact

If you have any questions about this privacy policy or your data, contact me at: