How we handle personal information

This notice explains how 21Aircon collects, uses and protects personal information across our website, customer portal and service operations.

Information we collect

• Identity and contact details: names, email addresses, telephone numbers, account roles and business details.
• Property and equipment details: service addresses, access information, installed systems, warranties and service history.
• Requests and correspondence: installation, repair and maintenance requirements, messages, appointment responses and internal operational records.
• Images: photographs you choose to upload. The portal accepts JPEG, PNG and WebP images only, validates them, removes metadata and stores private derivatives. Only upload images you have permission to share.
• Commercial and service records: quote versions, acceptances, applicable terms, maintenance-plan offers and agreements, covered equipment, jobs, visits, reports, invoices, balances, payment status and Xero identifiers. We do not receive or store card, bank-login or Direct Debit credentials.
• Security and signing records: sign-in attempts, sessions, staff access, audit events and rate-limit events. When an authorised customer electronically signs a quote, the private contract record also includes the connection IP address, browser/device user-agent, Cloudflare request and network details, sign-in/session times and signing time.
• Website use: optional Google Analytics data only after consent on www.21aircon.com. The private customer and staff applications do not use Google Analytics.

Why we use it

• To take steps you request before a contract and to provide installation, repair or maintenance services under a contract.
• To manage accounts, sites, appointments, quotes, invoices, warranties, service records and customer support.
• To meet tax, accounting, consumer-protection, health-and-safety and other legal obligations.
• For our legitimate interests in securing the service, preventing misuse, allocating work, improving operations and establishing or defending legal claims, balanced against your rights.
• With consent, for optional website analytics or marketing. You can withdraw consent without affecting earlier lawful use.

Who receives it

Authorised 21Aircon staff and engineers receive only the information needed for their role or assigned work. We use Cloudflare for the website, portal, database, private file storage, image processing, security checks, automation and transactional email. Production D1 databases and private R2 buckets use Cloudflare's EU jurisdiction controls. We use Xero for contacts, invoices, tax records, payment status and credit notes. If you accept website analytics, Google receives analytics information. We may also disclose information to professional advisers, insurers, regulators, law-enforcement bodies or another recipient where the law requires or permits it. We do not sell personal information.

Payments and communications

Invoices and balances may be mirrored from Xero into the portal. The exact signed quote may be attached to the related Xero invoice to preserve the contract and accounting trail. Payment links take you to an approved external service; payment credentials do not pass through 21Aircon's Cloudflare applications. Portal messages are the canonical service history. Notification emails contain a short summary and a secure portal link rather than sensitive attachments.

International processing

Cloud services can involve support, security or resilience processing outside the UK even where primary database and object-storage jurisdiction is set to the EU. Where restricted transfers apply, we require the relevant provider or recipient to use a lawful transfer mechanism and appropriate safeguards.

How long we keep it

• Installation-planner answers and selected images on the marketing site remain in the open browser tab and are not uploaded until you deliberately submit through the secure portal.
• Customer email codes expire after 10 minutes. Customer sessions have a rolling maximum of 30 days and can be revoked; staff sessions last up to 8 hours. One-time upload sessions expire after 15 minutes.
• Requests, messages, images, quotes, appointments and service records are kept while needed to deliver and support the service, deal with warranties, complaints or claims, and meet legal obligations.
• Accounting, invoice and tax evidence is retained for the applicable statutory period. Immutable quote, acceptance, invoice and service-report evidence may be retained for the corresponding contract, warranty and legal-claims period.
• An account-closure request starts a review. We delete or anonymise information that is no longer required, but do not erase records that must be kept by law or to preserve another person's rights.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or an objection to certain uses. You can withdraw consent at any time. Some rights are limited where information must be retained by law or for legal claims. We may need to verify identity before acting. You can also complain to the Information Commissioner's Office.

Security and your choices

We use passwordless customer sign-in, password and authenticator-based 2FA for staff, private storage, access checks, encryption, audit records, rate limits and automated file validation. No online service is risk-free. Keep access links and devices secure, do not email sensitive documents unless asked, and tell us promptly if account access may have been compromised.

Questions or data requests

Send a privacy question or rights request to hello@21aircon.com, call 01635 534810, or use the account-privacy controls in the customer portal.

Status

Operational privacy notice updated 24 July 2026. Contract-specific consumer, business, cancellation and maintenance terms are controlled separately and are not replaced by this notice.