Privacy Policy

1. Introduction

This Privacy Policy applies to VDTPanl Ltd ("VDTPanl", "we", "us", or "our"), a company registered in England and Wales with company number 10584327 and registered address at Unit 7, Mendip Business Park, Wells Road, Glastonbury, BA6 9WX. We are the data controller responsible for your personal data processed through our website at www.vdtpanl.com and through our solar energy consultation, installation, and maintenance services for farms and agricultural enterprises.

This policy describes what personal data we collect, why we collect it, how we process it, who we share it with, how long we keep it, and what rights you have regarding your data. We process personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

By using our website or engaging with our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our website and services. We encourage you to read this document carefully and contact us if you have any questions about how we handle your personal information.

2. What Data We Collect

We collect different categories of personal data depending on how you interact with us. The types of data we may collect include the following:

Identity Data

• Full name (first name and surname)
• Job title or role within your agricultural business
• Business or farm name

Contact Data

• Email address
• Telephone number (landline and mobile)
• Postal address of your farm or business premises

Technical Data

• Internet Protocol (IP) address
• Browser type and version
• Operating system and platform
• Device type (desktop, tablet, or mobile)
• Screen resolution and viewport dimensions
• Time zone setting and geographical location (at country or region level)

Usage Data

• Pages visited and the order in which they were viewed
• Time spent on each page
• The website or search term that referred you to our site
• Links clicked within our website
• Date and time of each visit
• Error logs and page response times

Enquiry and Project Data

• Information you provide through contact forms, including details about your farm size, current energy usage, roof type, and budget preferences
• Records of correspondence between you and our team (email, phone, and in-person meeting notes)
• Site assessment data gathered during property visits (building measurements, roof condition, shading analysis, electrical supply details)

Marketing and Communications Data

• Your preferences for receiving marketing communications from us
• Your preferred method of communication

We do not collect any special categories of personal data (also known as sensitive data), such as information about your health, race, ethnicity, religious beliefs, political opinions, trade union membership, genetics, biometrics, sex life, or sexual orientation.

3. How We Collect Data

We collect personal data through several methods, each serving a specific purpose related to delivering our services or improving your website experience.

Direct Interactions

You provide data directly to us when you complete a contact form on our website, request a free site assessment, telephone our office, send us an email, meet with our consultation team in person, or correspond with us by post. Any information you voluntarily share during these interactions may be recorded and processed in accordance with this policy.

Automated Technologies

When you visit our website, we automatically collect certain technical and usage data through the following technologies:

• Cookies: Small text files placed on your device that help us recognise your browser and remember your preferences. See Section 10 for full details on the cookies we use.
• Google Analytics: We use Google Analytics 4 to understand how visitors use our website. This service processes data including page views, session duration, bounce rates, and approximate geographic location. Google Analytics uses first-party cookies and does not collect personally identifiable information by default. IP addresses are anonymised before storage.
• Server Logs: Our web hosting provider automatically records server access logs that include your IP address, browser user agent string, referring URL, pages requested, and timestamps. These logs are used for security monitoring and performance optimisation.

Third-Party Sources

On occasion, we may receive data about you from third-party sources such as business directories, trade publications, agricultural industry events, or referral partners. If another farm or business refers you to us, they may share your name and contact details with your knowledge. We only process such data where we have a lawful basis to do so.

4. Legal Basis for Processing

Under Article 6 of the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases depending on the specific processing activity:

Consent (Article 6(1)(a))

Where you have given clear, affirmative consent for us to process your personal data for a specific purpose. This applies to marketing communications sent via email and the placement of non-essential cookies on your device. You may withdraw your consent at any time by contacting us at [email protected] or using the unsubscribe link in any marketing email. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew consent.

Contract Performance (Article 6(1)(b))

Where processing is necessary to perform a contract we have with you, or to take steps at your request before entering into a contract. This applies when you request a site assessment, receive a quotation, or enter into an agreement for solar panel installation and maintenance services.

Legitimate Interests (Article 6(1)(f))

Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include improving our website functionality, analysing how our services are used, ensuring network and information security, preventing fraud, and conducting general business administration. Before relying on legitimate interests, we carry out a balancing test to ensure our interests do not unfairly impact your rights.

Legal Obligation (Article 6(1)(c))

Where processing is necessary to comply with a legal obligation to which we are subject, such as maintaining financial records for tax purposes, responding to lawful requests from regulatory authorities, or fulfilling health and safety reporting requirements related to installation work.

5. How We Use Your Data

We use the personal data we collect for the following purposes:

• Service Delivery: To respond to your enquiries, schedule and conduct site assessments, prepare quotations, design solar panel systems tailored to your farm, coordinate installation schedules, commission your system, and provide ongoing maintenance and support.
• Communication: To contact you regarding your enquiry or project, provide updates on installation progress, send system performance reports, and respond to questions or support requests.
• Marketing: With your explicit consent, to send you newsletters, information about new services, seasonal energy tips for farmers, details of available grants or incentive programmes, and invitations to agricultural events where we exhibit. You can opt out of marketing communications at any time.
• Website Improvement: To analyse website traffic patterns, identify popular content, diagnose technical errors, test new features, and optimise the user experience for visitors researching solar energy solutions for agricultural applications.
• Security: To protect our website, systems, and data from unauthorised access, cyberattacks, and other security threats. This includes monitoring server logs for suspicious activity and implementing access controls.
• Legal Compliance: To maintain accurate financial records, comply with MCS certification requirements, fulfil our obligations under building regulations and electrical safety standards, and respond to legitimate requests from government bodies or regulators.
• Business Analysis: To understand demand patterns, evaluate the effectiveness of our marketing efforts, forecast business growth, and improve our service offerings for the agricultural sector.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The specific retention periods we apply are as follows:

• Contact form submissions: Retained for 2 years from the date of submission if you do not become a customer. If we enter into a service agreement, your data becomes part of your customer record.
• Customer project records: Retained for 7 years after the completion of installation or the end of our service agreement, in line with HMRC requirements for business records and to support warranty claims.
• Site assessment data: Retained for 3 years from the date of the assessment if no installation contract results. If an installation proceeds, the data is retained with your customer record.
• Marketing consent records: Retained for as long as you remain subscribed to our marketing communications, plus 1 year after you unsubscribe (to maintain a record of your opt-out preference).
• Website analytics data (Google Analytics): Retained for 14 months from the date of collection, after which it is automatically deleted by Google.
• Cookies: Essential cookies expire at the end of your browsing session. Analytics cookies are retained for up to 13 months. Marketing cookies, if accepted, are retained for up to 12 months. See Section 10 for a complete cookie breakdown.
• Server logs: Retained for 90 days for security and diagnostic purposes, then permanently deleted.
• Financial transaction records: Retained for 6 years from the end of the financial year in which the transaction occurred, as required by UK tax law.

When your data reaches the end of its applicable retention period, we securely delete or anonymise it so that it can no longer be associated with you. Anonymised data (which cannot identify you) may be retained indefinitely for statistical analysis purposes.

7. Data Sharing

We do not sell, rent, or trade your personal data to any third party for their marketing purposes. We may share your data with the following categories of recipients, solely for the purposes described in this policy:

• Hosting and Infrastructure Providers: Our website is hosted on secure servers provided by our web hosting partner, who acts as a data processor on our behalf. They store and transmit your data in accordance with their contractual obligations to us and applicable data protection law.
• Analytics Providers: Google LLC processes anonymised website analytics data through Google Analytics 4. Google acts as a data processor and processes this data in accordance with their data processing terms.
• Email Service Providers: If you subscribe to our marketing communications, your email address and name are stored with our email marketing platform provider, who acts as a data processor and processes your data solely on our instructions.
• MCS and Certification Bodies: As an MCS-certified installer, we are required to submit certain installation data (including property address and system specifications) to the Microgeneration Certification Scheme for quality assurance and compliance purposes. Personal contact details are only shared where necessary for certification records.
• Distribution Network Operators (DNOs): When connecting your solar system to the electricity grid, we submit grid connection applications that include your property address and basic system specifications to the relevant DNO. This is a legal requirement for grid-connected solar installations.
• Professional Advisers: We may share data with our accountants, solicitors, or insurers where necessary for legal, financial, or insurance purposes. These parties are bound by professional duties of confidentiality.
• Law Enforcement and Regulators: We may disclose your data if required to do so by law, court order, or regulatory requirement, or if we believe disclosure is necessary to protect our rights, the safety of others, or to investigate fraud.

All third-party processors with whom we share personal data are bound by data processing agreements that require them to protect your data to the same standard we apply, use it only for the specific purpose for which it was shared, and delete it when it is no longer needed.

8. International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA). However, some of our third-party service providers (such as Google for analytics) may transfer and process data in countries outside the UK and EEA.

Where data is transferred to a country that the UK government has not recognised as providing an adequate level of data protection, we ensure appropriate safeguards are in place. These safeguards include:

• Standard Contractual Clauses (SCCs): We require our data processors to enter into the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as approved by the Information Commissioner's Office (ICO).
• Adequacy Decisions: Where the UK Secretary of State has determined that a country provides an adequate level of protection for personal data, we rely on that adequacy decision as the basis for the transfer.

Google LLC participates in the EU-U.S. Data Privacy Framework and processes analytics data under their data processing terms, which include Standard Contractual Clauses as a transfer mechanism. You can request a copy of the safeguards we have in place for international transfers by contacting us at [email protected].

9. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to certain conditions and exemptions as set out in the legislation.

• Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to your request within one calendar month and provide the data in a commonly used electronic format.
• Right to Rectification (Article 16): If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure (Article 17): Also known as the "right to be forgotten", you may request that we delete your personal data where there is no compelling reason for us to continue processing it. This right applies in specific circumstances, such as where the data is no longer needed for the purpose it was collected, or you withdraw consent and there is no other legal basis for processing.
• Right to Restriction of Processing (Article 18): You may request that we temporarily restrict the processing of your personal data. This applies where you contest the accuracy of the data, where processing is unlawful but you oppose erasure, where we no longer need the data but you require it for legal claims, or where you have objected to processing pending verification of our legitimate grounds.
• Right to Data Portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you have the right to receive the personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• Right to Object (Article 21): You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights. You also have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdrew consent.
• Right to Lodge a Complaint: If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. The ICO can be contacted at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Website: ico.org.uk. Telephone: 0303 123 1113.

To exercise any of your rights, please contact us at [email protected] or write to us at our registered address. We will verify your identity before processing your request and aim to respond within one calendar month. If your request is complex or we receive a large number of requests, we may extend the response period by a further two months, in which case we will notify you of the delay and the reasons within the initial one-month period.

There is no fee for exercising your rights. However, if your request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on the request, in accordance with the legislation.

10. Cookies

Our website uses cookies, which are small text files stored on your device when you visit a website. Cookies help us provide a better browsing experience, understand how visitors use our site, and remember your preferences.

Essential Cookies

These cookies are strictly necessary for the website to function correctly. They enable core features such as page navigation, form submission, and security. Without these cookies, the website cannot operate properly. Essential cookies do not require your consent under PECR.

• Cookie consent preference: Stores whether you have accepted or rejected non-essential cookies. Duration: 12 months. First-party cookie.
• Session identifier: Maintains your browsing session as you navigate between pages. Duration: expires when you close your browser. First-party cookie.

Analytics Cookies

These cookies help us understand how visitors interact with our website by collecting information about pages visited, session duration, traffic sources, and navigation paths. All analytics data is aggregated and anonymised. We use these insights to improve website content, structure, and performance.

• _ga (Google Analytics): Distinguishes unique users by assigning a randomly generated number. Duration: 13 months. First-party cookie set by Google Analytics 4.
• _ga_[container-id] (Google Analytics): Maintains session state. Duration: 13 months. First-party cookie set by Google Analytics 4.

Managing Cookies

When you first visit our website, a cookie consent banner appears in the bottom-right corner of the screen. You can choose to accept or reject non-essential cookies. Your preference is stored and remembered for future visits.

You can also manage cookies through your browser settings. Most browsers allow you to view, delete, and block cookies from specific or all websites. Please note that blocking essential cookies may impair the functionality of our website. Instructions for managing cookies in popular browsers can be found on their respective support pages.

If you have previously accepted cookies and wish to change your preference, you can clear your browser cookies and refresh our website to see the consent banner again, or contact us at [email protected].

11. Children's Privacy

Our website and services are directed at business owners, farm managers, and agricultural professionals. We do not knowingly collect personal data from anyone under the age of 16. Our services relate to commercial solar energy installations for agricultural enterprises and are not intended for use by children.

If we discover that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete that data from our records. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at [email protected] so that we can take appropriate action.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or business operations. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email if you are an existing customer or have subscribed to our communications.

We encourage you to review this page periodically to stay informed about how we protect your personal data. Material changes will be highlighted for a period of 30 days following the update. Your continued use of our website after any changes to this policy constitutes your acknowledgement of the updated terms.

Previous versions of this policy are available upon request. Please contact us at [email protected] if you wish to review an earlier version.

13. Contact Details

If you have any questions, concerns, or requests regarding this Privacy Policy or how we process your personal data, you can contact us using any of the following methods:

If you wish to exercise any of your data protection rights, please direct your request to [email protected]. We aim to acknowledge all privacy-related correspondence within 2 working days and provide a substantive response within one calendar month.