Privacy notice

This notice explains how Leppo (“we”) uses personal data under the UK GDPR, the Data Protection Act 2018 and, for people in the EU, the EU GDPR.

Whose data, and where it comes from

• Businesses we contact. Names, work email addresses, phone numbers and company details of people at installation and roofing businesses, taken from Companies House and from the businesses' own websites.
• People who use this site. What you type into a form (including the Speed Test: your website, phone number and email), the messages you send when you text or call the demo number, and bookings you make.
• Visitors. Anonymous traffic statistics, and, only if you accept, the Meta pixel.
• Our clients' customers. When we run the system for an installer, we handle their homeowners' enquiries on the installer's behalf as a processor, under a data processing agreement. The installer's own privacy notice applies.

Why we use it, and our lawful basis

• Business outreach: legitimate interests, in offering a relevant service to businesses. We email business addresses at limited companies and similar organisations; we do not send marketing texts to anyone who hasn't agreed to them.
• The Speed Test: to run the test you asked for, including the one test call you agreed to, and to send your report.
• Replying to you, demos and bookings: to take steps you asked for before a contract, and our legitimate interests.
• Running the service for clients: to perform our contract.
• The Meta pixel: your consent, which you can withdraw at any time on the cookie policy page.

How long we keep it

Outreach and Speed Test data: up to 12 months from the last contact, unless you become a client. If you object or unsubscribe, we keep only your email address or number on a suppression list so we never contact you again. Client and billing records: 6 years, for tax law.

Who we share it with

Processors that help us run the service, under contract:

• Instantly (email outreach)
• Twilio (texts and calls, including the demo number and Speed Test calls)
• Resend (transactional email)
• Cloudflare (hosting, security and cookieless web analytics)
• Stripe (card payments and Direct Debit)
• Cal.com and Google (demo bookings and Google Meet calls)
• n8n (the automation that routes form submissions)
• Meta (the pixel, only if you accept, and ad accounts for clients)

Some of these are based outside the UK. Where data leaves the UK, it is protected by UK adequacy regulations or the UK International Data Transfer Addendum.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, and object to direct marketing at any time. The quickest way to stop all contact is the unsubscribe page. You can also complain to the Information Commissioner's Office at ico.org.uk.

Language

This notice is available in English and Dutch. Both versions have equal standing.