Privacy Policy
Version 2.0, effective 1 November 2026
1. Who we are
This policy explains how ABCOT Ltd collects and uses personal data when you visit electriccombiboilerscompany.com, buy from us, ask for a quote or survey, register a warranty, or work with us as an installer or merchant. It also covers the data you give us by phone, email or WhatsApp in connection with those services.
ABCOT Ltd trades as Electric Combi Boilers Company (ECBC), AbcotUK and Euroboilerparts. We are the controller of your personal data, which means we decide how and why it is used.
| Company | ABCOT Ltd, registered in England and Wales, company number 03397480 |
| Registered office | 46 Syon Lane, Isleworth, Middlesex TW7 5NQ |
| Trading and correspondence address | Green Acres, Oakley Green Road, Windsor, Berkshire SL4 4QF |
| ICO registration number | ZC206542 |
| Privacy contact | privacy@abcotuk.co.uk |
| Telephone | 0208 998 2024 |
We have not appointed a Data Protection Officer because the law does not require one for a business of our type. Send any privacy question, request or complaint to the privacy contact above.
2. The personal data we collect
We collect only what we need to sell, install and support your boiler, and to run the website safely.
| When | What we collect |
|---|---|
| You place an order | Name, billing and delivery address, email, phone, order details, order notes and payment method. Card payments are handled by our payment provider, takepayments: you enter your card details on its secure payment page, so we never see or store your full card number. If you pay by bank transfer, we see the payment details your bank sends us. |
| You create an account | The above, plus your login details, order history and any saved wishlist. |
| You contact us | Your role (homeowner, installer, merchant or other), name, email, phone, postcode, the type of enquiry and your message. |
| You use the Installation Estimator or Boiler Selector | Your answers about your property and heating needs, your postcode, the estimate or recommendation produced and, if you choose to give them, your name, email and phone. |
| You book a home survey or register a warranty | Name, email, phone, address, property details, boiler model and serial number, installation date and installer details. |
| You subscribe to our newsletter | Your email address and your subscription choices. |
| You apply for a merchant credit account | Business name and registration details, trading address, contact names, job titles, phone, email, trade references, bank details for payment, and credit check results from credit reference agencies. Sole traders and guarantors give personal details such as home address. |
| You are an authorised installer | Business and contact details, qualifications and registrations (such as NICEIC or NAPIT), service area, and the details we publish in our installer directory. |
| You message us on WhatsApp or call us | Your phone number, name, the content of your messages, call recordings (we tell you before the call connects) and call notes. |
| You browse the site | IP address, device and browser information, pages visited, how you reached us, and interactions such as clicks and scrolls. Some of this comes from cookies (section 5). |
We also receive limited data from others: payment confirmations from takepayments, reviews you post on Google (shown through our reviews widget), and contact details from installers or merchants who refer you to us.
We do not ask for special category data, such as health information. If you tell us about a medical need or vulnerability that affects your heating (for example, so we prioritise a callout), we use it only for that purpose and with your explicit consent.
3. How we use it and our lawful basis
UK data protection law requires a lawful basis for each use. Ours are below.
| Purpose | Lawful basis |
|---|---|
| Processing and delivering orders, taking payment, handling returns and refunds | Contract |
| Arranging surveys, installations, servicing and callouts | Contract, or steps you ask us to take before a contract |
| Giving estimates and boiler recommendations through our online tools, and following up if you asked us to | Steps you ask us to take before a contract; otherwise our legitimate interest in responding to enquiries |
| Registering and honouring warranties | Contract and legal obligation (consumer rights) |
| Answering enquiries and support requests, and recording calls for quality, training and resolving disputes | Legitimate interests (responding to the people who contact us, and keeping an accurate record of what was agreed) |
| Assessing and running merchant credit accounts, including credit checks and debt recovery | Contract and legitimate interests (managing credit risk) |
| Managing our authorised installer network and publishing the installer directory | Contract and legitimate interests (helping customers find qualified installers) |
| Sending service emails, such as order confirmations, warranty reminders and safety notices | Contract and legitimate interests |
| Sending marketing emails | Consent, or soft opt-in for existing customers (section 4) |
| Keeping accounting and tax records | Legal obligation |
| Measuring and improving the website, and measuring our advertising | Consent (through the cookie banner) |
| Protecting the site and our customers from fraud, spam and attack | Legitimate interests (security and fraud prevention) |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against yours and concluded they are not overridden. You can ask for details of that assessment. Where we rely on consent, you can withdraw it at any time without affecting what we did before.
4. Marketing
We send marketing emails only to people who have signed up, or to customers who bought from us or asked us for a quote and did not opt out at the time. Customer emails cover our own similar products and services only. Every email has an unsubscribe link, and you can also tell us by email or phone.
Our newsletter runs on MailerLite. MailerLite records whether you open our emails and click links, so we can see which content is useful. If you unsubscribe, we keep your email address on a suppression list so we do not contact you again by mistake.
Installers and merchants may receive business updates, such as product news, price changes and technical bulletins, at their work address. You can opt out of these at any time.
We do not sell your personal data or share it with other businesses for their own marketing.
If you agree to marketing cookies, we may show you ECBC adverts on Google, Facebook and Instagram based on your visit to our site. Section 5 explains how to switch this off.
5. Cookies, analytics and advertising
We use strictly necessary cookies to run the shop and keep it secure. Other cookies are used only if you choose them in our cookie banner, and you can change your choice at any time through the cookie settings on our website.
| Category in our banner | Tools | What they do | Default |
|---|---|---|---|
| Strictly necessary | WooCommerce, WordPress, Google reCAPTCHA, Wordfence, Cloudflare, cookie banner | Basket, checkout, login, remembering your cookie choice, blocking spam and attacks | Always on |
| Performance | Google Analytics, Microsoft Clarity | Count visits and show which pages work. Clarity records mouse movements, clicks and scrolls, and can replay a session so we can see where the site is hard to use | Off until you agree |
| Advanced (marketing) | Google Ads, Meta Pixel (Facebook and Instagram) | Measure which adverts lead to enquiries or orders, and show ECBC adverts to people who have visited us | Off until you agree |
We use Google Tag Manager to load some of these tools. Some pages also show content from other providers, such as our Google reviews widget (Trustindex) and Google Fonts, which receive your IP address so they can deliver that content.
If you agree to Performance or Advanced cookies, Google, Microsoft and Meta receive data about your visit, including your IP address and a device identifier. They act as independent controllers for some of their own purposes, under their own privacy policies: Google, Microsoft and Meta.
You can also block cookies in your browser settings, or opt out of Google Analytics with Google’s browser add-on. Blocking strictly necessary cookies will stop the basket and checkout working.
6. Who we share it with
We share personal data only where we need to, and our service providers may use it only on our instructions.
| Who | Why | Where based |
|---|---|---|
| Authorised installers | To survey, install, service or repair your boiler. Installers are independent controllers and use your details under their own privacy notice | UK |
| takepayments | Card payments through its secure hosted payment page, and fraud checks | UK |
| Our bank | Receiving bank transfers | UK |
| Palletways and APC-Delivered | Delivering boilers (Palletways) and parcels (APC) | UK |
| Freshworks | Customer relationship management: enquiries, quotes and support | US and EEA |
| eKM | Running our spare parts shop | UK |
| BT (Cloud Work) | Recording and storing phone calls | UK |
| Smegoweb, with Cloudflare | Website development, hosting, maintenance and security | India; Cloudflare global |
| Workspace email (including emails the website sends), documents and merchant applications on Google Forms; Analytics, Ads, Tag Manager and reCAPTCHA | UK, EU and US | |
| MailerLite | Newsletter and marketing email, including customers who opt in at checkout | EU (Lithuania) and US |
| Meta | Facebook and Instagram advertising, and WhatsApp messages you send us | Ireland and US |
| Microsoft | Clarity website analytics | US |
| Automattic (Akismet) and Defiant (Wordfence) | Spam filtering and website security | US |
| Trustindex | Displaying our Google reviews | EU (Hungary) |
| Credit reference agencies | Checking merchant credit applications | UK |
| Our external accountants | Bookkeeping, accounts and tax | UK |
| Professional advisers and insurers | Legal, accounting and insurance advice | UK |
We may also disclose data where the law requires it, for example to HMRC, the police or a court, or to protect our rights. If we sell or restructure all or part of our business, data may pass to the buyer, who must use it in line with this policy.
7. Transfers outside the UK
Some of the providers in section 6 store or access data outside the UK. When they do, we make sure one of these protections applies:
- EEA countries (including Ireland, Lithuania and Hungary): UK law recognises these as providing adequate protection.
- United States: transfers to providers certified under the UK Extension to the EU-US Data Privacy Framework, or covered by the UK International Data Transfer Agreement or Addendum.
- Other countries, including India, where our web developer is based: the UK International Data Transfer Agreement or Addendum, plus any extra safeguards needed.
You can ask us for a copy of the relevant safeguards using the contact details in section 1.
8. How long we keep it
We keep data only as long as we need it, then delete or anonymise it.
| Data | Period | Reason |
|---|---|---|
| Orders, invoices and payment records | 6 years from the end of the financial year of the sale | HMRC and Companies Act record-keeping |
| Warranty and installation records | The warranty period plus 6 years | Warranty claims and the 6-year limitation period for contract claims |
| Customer accounts | Until you close the account, or after 3 years of inactivity | No longer needed |
| Enquiries, estimates, selector results and survey requests that do not lead to an order | 2 years from last contact | Follow-up and repeat enquiries |
| Merchant credit account files | Life of the account plus 6 years | Debt recovery and limitation period |
| Installer records | Life of the relationship plus 6 years | Contract and warranty claims |
| Newsletter subscriptions | Until you unsubscribe; your address then stays on our suppression list | Respecting your opt-out |
| Call recordings | 30 days | Quality, training and resolving disputes |
| WhatsApp messages, emails and call notes | 2 years, unless part of an order or warranty file | Customer service |
| Analytics data | Up to 14 months in Google Analytics; Microsoft’s standard retention for Clarity | Website measurement |
| Security logs | 90 days | Protecting the site |
| Unpaid or abandoned orders | 90 days | No longer needed |
9. Security, children and automated decisions
Security. The site uses encrypted connections (HTTPS), a firewall and malware scanning, spam filtering, two-factor authentication for staff logins and activity logging. Access to customer data is limited to staff and providers who need it. No system is completely secure, so if we have a breach likely to put you at high risk, we will tell you without undue delay.
Children. Our products and services are for adults. We do not knowingly collect data from anyone under 18. If you think a child has given us their details, contact us and we will delete them.
Automated decisions. Our Installation Estimator and Boiler Selector calculate an indicative price or a suggested boiler from your answers. They are guides only: a person confirms every quote and recommendation, and we make no decision with legal or similarly significant effects about you by automated means alone.
10. Your rights and how to complain
You have the right to:
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have data deleted, where we no longer need it or have no other lawful basis to keep it;
- restrict how we use it while a concern is resolved;
- receive data you gave us in a portable format;
- object to uses based on legitimate interests, and to direct marketing at any time;
- withdraw consent, including cookie consent, at any time.
To use any of these, contact us at privacy@abcotuk.co.uk or 0208 998 2024. We may ask you to confirm your identity. We reply within one month, extendable by two further months for complex requests, in which case we will tell you why. Searches will be reasonable and proportionate. There is normally no charge.
Some rights have limits. For example, we must keep order and tax records for the periods in section 8 even if you ask us to delete them.
Complaints. If you are unhappy with how we have handled your data, email privacy@abcotuk.co.uk with “Data protection complaint” in the subject line, or write to us at our trading address. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
You can also complain to the UK regulator, the Information Commission, through its Information Commission’s Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113, or 4th Floor, No. 3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL. The ICO will usually expect you to have raised it with us first.
11. Changes to this policy
We will update this policy when our services, suppliers or the law change, and post the new version here with its date. If a change materially affects how we use data you have already given us, we will tell you directly.
Version 1.0, effective 4 November 2026.