Legal

Privacy Policy

Last updated: July 2026

Who we are

Bright Sparks of York Ltd is an electrical contracting business based in York. Frankie is the director. Our website address is brightsparks-york.com. The business is registered with the Information Commissioner's Office as a data controller (registration C1927867).

What data we collect and why

Contact form submissions

When you use our contact form, we collect your name, email address, phone number, and message. We use this solely to respond to your enquiry. We don't add you to any mailing list or share your details with anyone.

Google Analytics (only if you consent)

If you accept cookies via the banner on your first visit, we load Google Analytics 4 (GA4) with IP anonymisation enabled. The data is anonymous and aggregated, and we cannot identify you personally from it. Google may process this data on servers outside the UK. If you decline, no analytics cookies are set. Full details, including the specific cookie names and how to change your mind, are in the Cookie Policy.

No other tracking

We don't use any other tracking tools, advertising cookies, social media trackers, or third-party analytics. We don't run remarketing or targeted advertising on this site.

Customer job records

Once you become a customer, we keep records of the work we've carried out at your property. That includes your name, address, contact details, the scope and price of the job, and any electrical certificates we've issued (Electrical Installation Condition Reports, Electrical Installation Certificates, Minor Works Certificates, fire alarm and emergency lighting certificates). The lawful basis is contract performance for the active job, then legal obligation and legitimate interest for the certification record afterwards.

NICEIC notification

When we do work that's notifiable under Building Regulations Part P (consumer-unit changes, new circuits, certain bathroom and kitchen work) we notify NICEIC, our certification body, who in turn notify your local authority. They receive your name, address, and the installation details, that's a regulatory requirement, not optional.

EICR renewal reminders

If we've carried out an EICR for you, we may send a reminder a few weeks before your retest is due (typically every 5 years for a domestic property, every 1 to 5 years for rentals depending on the report). Every reminder email carries a "reply STOP and I won't chase again" line at the bottom, reply with that and we take you off the list. The lawful basis is legitimate interest for an existing customer; we don't send these unprompted to anyone who hasn't been a customer. If you've signed up to our free landlord reminder service instead, those reminders work on your consent, see the next section.

The free landlord reminder service

If you sign up to our free landlord reminder service, we collect your name, mobile number, the property's postcode, the EICR renewal date you give us, and your email if you choose to add it. We use them to send you a personal reminder before it's due. The lawful basis is your consent, the reminders are the thing you signed up for, and you can withdraw it at any time by closing your profile: ring us, message us, or reply STOP to any reminder. When you close your profile we delete the details you gave us from our live systems straight away; backup copies drop off automatically within our normal backup rotation. If you've also been a customer, the certificate and accounts records described above are kept under their own rules and aren't affected by closing a reminder profile. We don't ask for or store your tenants' details. If your profile goes quiet, the last date you asked us to track has passed and there has been no contact between us since, we'll close it and delete your details within 24 months. If you ticked the tips box, we'll also send the occasional tip or offer for York landlords; that's a separate consent and you can stop those at any time without affecting your reminders. Your details sit in the same secure system as our customer records, run for us by the companies that host our booking system and email, they process the data on our instructions only, never for their own use.

The landlord portal

If you're a landlord, you can sign in to a portal on our site to keep track of your own reminders and, where we've done work for you, your own certificate and job records. Here's how signing in works and what we do with your details.

Signing you in

When you ask to sign in, we send a one-time sign-in link to your email address. This happens automatically and straight away, to the address you type in, and it's the only email the portal ever sends you on its own. The link is the only thing in it. You can also save a passkey on your own device, so next time you sign in with your fingerprint, face, or device PIN instead of waiting for an email.

To do this we process your email address and your sign-in credential, and we keep a short record of how you sign in: which method you used, the email address we verified, and when you first linked it and last used it. We do this to keep your account secure and make sure it's really you signing in. The lawful basis is our legitimate interest in protecting your account, not consent.

Passkeys never send us your fingerprint or face

If you sign in with a passkey, the fingerprint or face check happens on your own device and stays there. We never receive or store any biometric data. All we hold is a public key and a reference to your device, which on their own can't identify you or unlock anything else.

What you can see once you're signed in

Once you're signed in you can see the reminders you've set up yourself, and, where we've carried out work for you, your own certificates and job records. Access is tied to your own account, so you only ever see records that belong to you. If a record was first commissioned by someone else, for example a previous owner of the property, we only hand it over to you after someone at Bright Sparks has confirmed it should go to you, and we log that.

Staying signed in

When you sign in, the portal sets one small cookie so you stay signed in as you move between pages. It's set only after you sign in, it's needed for the portal to work, and it clears when you sign out. There's more detail in the Cookie Policy.

If you invite a tenant

Later on, the portal will let you hand a tenant a booking link so they can arrange access for a visit. When it does, you'll enter the tenant's email on your own device and we won't store it. We hold no details about your tenants.

How long we keep data

Contact form submissions are kept only as long as needed to handle your enquiry. Google Analytics data is retained for 14 months (the default GA4 retention period). Estimates that don't go ahead are kept for 24 months. Job and invoice records are kept for 6 years plus the current tax year. Free landlord reminder profiles are kept while the profile is open, then deleted within 24 months of the relationship ending.

Electrical certification records (EICRs and other certificates) are kept for the lifetime of the installation. Insurance claims, future remedial work, and regulatory enquiries can surface decades after the work was done, and the regulations expect the record to be available. If you ask us to remove your data from a certificate (right to erasure under Article 17), we'll redact your name and contact details from the record but keep the technical lineage (date, address, outcome, retest cadence) for the reasons above. We'll log every such request and tell you what's been redacted.

Your rights

Under UK GDPR, you have the right to:

How to complain about how we handle your data

If you think we've mishandled your personal data, please tell us first so we can put it right. You can reach us by any of these routes:

We'll confirm we've received your complaint within 30 days, look into it without undue delay, and let you know the outcome in plain language. If anything is going to take a while, we'll keep you posted.

If you're not happy with how we deal with it, you can take it to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We'd always rather sort it out with you directly first.

Contact

If you have any questions about this privacy policy or your data, contact us at: