Privacy Policy | BeBest Plumbing and Drainage

1. Who we are (data controller)

The data controller responsible for your personal data is:

Befast Plumbing & Drainage Limited, trading as BeBest Plumbing and Drainage
Company number: 17448037 (registered in England & Wales)
Registered office: 31 Kitsmead, Copthorne, Crawley, England, RH10 3PN
Email: contact@bebestplumbing.co.uk
Phone: 07508 325291

We do not have a dedicated Data Protection Officer (DPO). For any data protection queries, please contact us using the details above.

2. What personal data we collect and why

We only collect personal data that is necessary for the purposes described below.

What we collect	Why we collect it	Legal basis
Name, phone number, postcode, service required, job details	To respond to your booking or callback request and to provide plumbing or drainage services	Performance of a contract, or steps taken at your request prior to entering a contract, UK GDPR Article 6(1)(b)
Website usage: pages viewed, buttons and links clicked, how far you scrolled, how long before you first interacted, the page you arrived on, the site or advert you came from, your device type and screen size, an approximate location from your IP address, and a session replay of your visit with every field you type into masked	To understand how visitors use the site so we can improve it, and to see which pages and which adverts produce work. This starts when the page loads.	Legitimate interests, UK GDPR Article 6(1)(f). The cookies and browser storage used for this are described in section 3.
The Google advert identifier (the gclid, gbraid or wbraid in an advert link) and any campaign tags on the address you arrived at	To tell which adverts lead to real enquiries, so we are not paying for adverts that do not. Read from the web address you asked for and stored in your browser for up to 90 days.	Legitimate interests, UK GDPR Article 6(1)(f)
A persistent identifier in a cookie and in your browser's storage, and a profile linking your visits together. If you go on to submit the booking form, your phone number becomes the reference for that profile.	To recognise a returning visitor and to see the whole journey rather than single pages.	Legitimate interests, UK GDPR Article 6(1)(f)
Your name and phone number sent to Google in an irreversible hashed form, with your postcode in plain text	So Google can match a completed booking to the advert click that produced it. Only when you submit the booking form.	Legitimate interests, UK GDPR Article 6(1)(f)
IP address and browser or device information	For website security and to detect technical errors.	Legitimate interests, UK GDPR Article 6(1)(f)

We do not process any special category data and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

3. Cookies, analytics and advertising

The short version. We measure how the site is used from your first page load. Our analytics tool, PostHog, is served through our own domain. It sets a cookie and a browser storage entry so that one visit stays one record and a returning visitor is recognised, and it records your visit as a session replay with every field you type into masked.

What is recorded. The pages you view, what you click and where on the page it sat, how far you scroll, how long before you first interact, the site or advert you came from, your device type and screen size, an approximate location worked out from your IP address, and the masked replay. If you submit the booking form, your phone number becomes the reference for your analytics profile, so the visit and the booking are one record rather than two.

Google advertising. Google's advertising tag loads with the page and may set Google's own advertising cookies. If you arrived from one of our adverts, the advert identifier in the link is stored in your browser for up to 90 days and sent with any booking, so we know which advert produced the work. When you submit the booking form, your name and phone number are hashed in your own browser with SHA-256 before they go to Google, with your postcode in plain text, so Google can match the booking to the advert click without receiving your details in readable form.

There is no cookie banner. We do not ask before measuring. If you do not want this, block cookies and site data for this site in your browser settings, or email us and we will tell you how to switch it off for your device. We do not respond to Do Not Track signals.

The booking form. If you submit it we need your name, phone number and postcode to book the job. The advert identifier, if there is one, is sent with the booking so we know which advert produced the work. That is a record of your enquiry.

4. Who we share your data with

We do not sell your personal data. We share it only with the following service providers (data processors) who act on our instructions:

Telegram. When you submit a booking or callback request, the details you provide (name, phone number, postcode, service, any notes and the Google advert identifier if you arrived from one of our adverts) are sent as a message to a private Telegram group used by our team to receive and action bookings. This is how we operate: we do not maintain a separate customer database. Telegram's own privacy policy applies to that message once it is delivered to their platform.
PostHog Inc. (posthog.com), website analytics and session replay for every visitor from the first page load. Data is processed on servers in the United States, under appropriate UK GDPR Article 46 safeguards. See posthog.com/privacy.
Google (Google Ireland Limited, and Google LLC in the United States), advertising and conversion measurement for our Google Ads adverts. Google receives a signal that a page was viewed together with the advert identifier from the link you clicked, may set its own advertising cookies, and receives your name and phone number hashed with SHA-256 in your own browser, with your postcode in plain text, when you submit a booking. See policies.google.com/privacy.
We may disclose personal data if required to do so by law or in response to a valid request from a public authority.

5. How long we keep your data

What we collect	Why we collect it	Legal basis
Booking and enquiry records (in our Telegram group)	Retained in the group for as long as needed to complete and follow up the job, then deleted
PostHog analytics events	12 months, then deleted by PostHog
PostHog session recordings	30 days, then deleted by PostHog
PostHog cookie and browser storage entry	Up to 12 months, or until you clear your browser's site data
Google advert identifier stored in your browser	Up to 90 days, or until you clear your browser's site data
Google's own advertising cookies	Set and controlled by Google, up to 90 days for the conversion cookie. See policies.google.com/technologies/cookies

We review the personal data we hold periodically and delete anything we no longer need.

6. Your rights under UK GDPR

You have the right to: access the personal data we hold about you; ask us to correct inaccurate data; ask us to delete your data where we no longer have a lawful basis to hold it; ask us to restrict processing in certain circumstances; receive your data in a portable format where processing is based on contract; and object at any time to processing based on legitimate interests, including the analytics, session replay and advert measurement described in section 3. Email us and we will tell you how to switch it off for your device.

To exercise any of these rights, contact us at contact@bebestplumbing.co.uk or by phone on 07508 325291. We will respond within one calendar month.

7. Right to complain to the ICO

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk

We would appreciate the opportunity to resolve your concern directly before you contact the ICO.

8. How we keep your data secure

Our website is served over HTTPS. All data in transit is encrypted.
We limit access to personal data to those who need it to carry out their work.
We do not store payment card details. No payments are taken through this website.

9. Children's data

Our services are aimed at adults. We do not knowingly collect personal data from anyone under the age of 18.

10. Changes to this policy

We may update this privacy policy from time to time. The “Last updated” date at the top of this page always reflects the most recent version.