Privacy notice

Who we are

resiliencelab.co.uk is run by Floodwatch Ltd trading as Resilience Lab. Floodwatch Ltd is a company registered in England and Wales (company number 17031025). Registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE.

We are the data controller for the personal data described here. Contact us about anything in this notice at [email protected].

What we collect and why

• Newsletter sign-ups: your email address (and name if you give it), so we can send the newsletter you asked for. Lawful basis: consent. You can unsubscribe at any time.
• "Register interest" and orders: your name, email, delivery address and postcode, company name and any PO reference, and the items in your basket, so we can tell you when ordering opens and, once the shop is live, process and deliver your order. Lawful basis: taking steps at your request before a contract, and performing the contract.
• Guide downloads and enquiries: your email address and anything you write to us, so we can send the guide or reply. Lawful basis: consent or legitimate interests (answering you).
• Installer introductions and site surveys: the details you give in the form, shared only with the installer you ask us to introduce you to. Lawful basis: consent.
• Electricity bill analyser: your bill is read in your own browser. Names, addresses, postcodes, account numbers and MPANs are stripped on your device and are never sent to us. If you choose to save a result, we store only anonymised figures (such as daily kWh and tariff rate).
• Website analytics: if you accept analytics cookies, Google Analytics records how pages are used (pages viewed, approximate location, device type). Lawful basis: consent. See our cookie policy.
• Security and fraud prevention: technical data such as IP address, used by our hosting provider to keep the site safe. To stop abuse of our sign-up and "Register interest" forms we also process a pseudonymised form of your IP address (a keyed hash, never the address itself) for rate limiting, and keep it for 24 hours. Lawful basis: legitimate interests.

Who we share it with

We never sell your data. We share it only with service providers who process it on our behalf under contract:

• Cloudflare (website hosting and database).
• Resend (sending emails such as order confirmations and newsletters).
• Stripe (card payments, once the shop is live; we never see or store your card number).
• Google (analytics, only if you accept analytics cookies).
• Our UK suppliers, who receive only your name and delivery address so they can post your order directly to you.
• Installers, only if you ask us to introduce you to one.

International transfers

Some providers (for example Cloudflare, Stripe and Google) may process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Agreement / Addendum.

How long we keep it

• Newsletter: until you unsubscribe.
• "Register interest" requests: 12 months, unless you place an order.
• Orders and invoices: 6 years after the end of the financial year, as required by HMRC.
• Enquiries: up to 2 years.

Your rights

You have the right to access, correct or delete your data, to restrict or object to how we use it, to data portability, and to withdraw consent at any time. To use any of these rights, email us. We will reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put things right first.