GDPR & Data Protection
Last updated: 19 February 2026
Our commitment to your data
C&T Group is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We handle your personal data with care, transparency, and respect.
What Is UK GDPR?
The UK General Data Protection Regulation (UK GDPR) is the UK's data protection law following Brexit. It sets out rules for how organisations must handle personal data — including what data they can collect, how they must protect it, and what rights individuals have over their own information.
The Six Principles We Follow
Under UK GDPR, all personal data must be processed in accordance with six key principles. Here's how we apply them:
1. Lawfulness, Fairness & Transparency
We only collect data we have a legal basis for, we're clear about how we use it, and we never use it in ways that would surprise or harm you.
2. Purpose Limitation
We only use your data for the specific reasons we collected it. We won't use your eligibility data for unrelated marketing without your consent.
3. Data Minimisation
We only collect the data we actually need. We don't ask for information that isn't relevant to your enquiry or installation.
4. Accuracy
We keep your data accurate and up to date. If you spot an error, contact us and we'll correct it promptly.
5. Storage Limitation
We don't keep your data longer than necessary. Our retention periods are set out in our Privacy Policy.
6. Integrity & Confidentiality
We protect your data using appropriate security measures and ensure only authorised staff can access it.
Special Category Data
In some cases, we may need to process special category data — specifically health information. This only applies when:
- You are applying for a grant via the LA Flex Route 3 pathway, which requires evidence of a health condition made worse by living in a cold home
- You have given us explicit written consent to collect and process this information
Health data is handled with the highest level of care, stored securely, and only shared with the relevant local authority or energy supplier as required for your grant application.
Your Rights Under UK GDPR
Right of Access
Request a copy of all personal data we hold about you (Subject Access Request).
Right to Rectification
Ask us to correct any inaccurate or incomplete data.
Right to Erasure
Ask us to delete your data, subject to legal obligations.
Right to Restriction
Ask us to pause processing your data in certain circumstances.
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent
Withdraw consent at any time where processing is consent-based.
Rights re: Automated Decisions
Not to be subject to solely automated decisions that significantly affect you.
To exercise any of these rights, email [email protected] with your request. We will respond within 30 days. We may need to verify your identity before processing your request.
Data Breach Procedures
In the unlikely event of a personal data breach, we will assess the risk and notify the Information Commissioner's Office (ICO) within 72 hours if the breach poses a risk to individuals' rights and freedoms. If the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.
Data Transfers Outside the UK
We do not routinely transfer personal data outside the UK. Where any third-party software or service provider stores data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
How to Make a Complaint
If you believe we have not handled your personal data correctly, please contact us first so we can try to resolve the issue:
- Email: [email protected]
- Phone: 01792 44 66 46
You also have the right to complain directly to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Further Information
For full details of how we collect, use, and store your personal data, please read our Privacy Policy.
Data Protection Enquiries
For any questions about how we handle your data, get in touch.