Privacy Policy

This Privacy Policy explains how Limitless Digital Group Limited, trading as BestHeating ("we", "us", "our"), collects, uses, shares and protects your personal data when you visit bestheating.com, create an account, place an order, contact us, or interact with our marketing. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, for electronic marketing and cookies, the Privacy and Electronic Communications Regulations (PECR).

1. Who We Are (Data Controller)

BestHeating is a trading name of Limitless Digital Group Limited, which is the Data Controller for the personal data we process.

• Registered address: Dawson Court, Billington Road Industrial Estate, Burnley, Lancashire, BB11 5UB, United Kingdom
• Company number: 03955231
• ICO registration number: Z1205869

We provide this privacy information to meet our duty to be transparent about how we use your data.

2. Scope of This Policy

This policy applies to:

• Visitors to the BestHeating website
• Customers and account holders
• Individuals who contact us, create an account, sign up to marketing, or interact with us via email, phone, social media or surveys

Separate policies apply to cookies and similar technologies (see Section 9).

3. Personal Data We Collect

We may collect the following categories of personal data:

• Identity & contact data – name, email, telephone, billing/delivery addresses.
• Account data – login, saved addresses, preferences, wishlists.
• Order & transaction data – products purchased, order numbers, delivery/returns and tracking events, payment status, refund details (we do not store full card numbers or CVV).
• Technical & usage data – IP address, device, browser type, pages viewed, interactions, referral sources, approximate location derived from IP.
• Marketing & communications data – your marketing preferences, records of consent/opt out, competition entries, survey responses, and support correspondence.
• Data from third parties – payment providers (e.g., payment status), fraud prevention services (risk indicators), delivery partners (tracking updates), analytics/advertising platforms (with your consent), and review platforms (if you leave a review or respond to a review invitation). We only collect what’s needed for the stated purposes and tell you when we obtain data from another source.

Children’s data: Our website and products are not intended for children under 18 and we do not knowingly collect children’s personal data.

4. Sources of personal data

• Directly from you (checkout, account setup, support, returns, competitions).
• Automated technologies (cookies, SDKs, pixels and similar technologies—see Cookie Policy). Under PECR, consent is required for non essential cookies; any exceptions are narrow.
• Third party partners: payment processors, fraud screening tools, delivery carriers, analytics/advertising platforms (e.g., Google/Meta/TikTok tags if enabled), review platforms such as Trustpilot (controller/processor roles vary by feature).

5. Lawful Bases for Processing

We only use your data where we have a lawful basis under Article 6 UK GDPR. Below is a concise mapping of key purposes to lawful bases:

Purpose	Lawful basis
Process & deliver your orders	Contract (to fulfil our contract with you)
Take payments / issue refunds	Contract; Legitimate interests (fraud prevention)
Account management	Contract
Operational analytics & site improvement	Legitimate interests (improve services), applying cookie rules where relevant
Email/SMS marketing to existing customers	Legitimate interests under PECR soft opt in; opt out available at collection and in every message
Email/SMS marketing	Consent
Postal (direct mail) marketing to existing customers	Legitimate interests (to promote relevant products and services to customers based on their relationship with us, where such communications are proportionate and relevant; you have the right to object at any time)
Serving/measurement of online advertising using tracking technologies	Consent (non essential cookies/pixels)
Inviting reviews / customer feedback	Legitimate interests (service improvement; demonstrate trust), respecting PECR rules
Legal, tax & compliance	Legal obligation

6. Special Categories of Data

Where a bathroom, washroom, or lavatory is provided, extended, or adapted to suit the condition of a disabled person, it can be zero-rated for VAT.

Depending on your relationship with us, we may process special category i.e., “sensitive” personal data when confirming your eligibility for this VAT relief as part of our Disability Declaration Form.

We process this special category data, Your Health Data, to carry out our legal obligations to maintain records under the VAT Act 1994.

7. Payment Providers (Klarna, PayPal Credit, Braintree, Worldpay and other gateways)

When you choose to pay using a third party payment method (such as Klarna, PayPal Credit, Braintree, Worldpay, or other supported payment gateways), we may share limited personal data with the relevant provider so that they can process your transaction, assess eligibility, prevent fraud, and comply with their own regulatory obligations.

This typically includes:

• Contact details (name, email, billing/delivery address)
• Order details (items purchased, order value, order reference)
• Device/technical information captured at checkout
• Payment status or risk/fraud assessment details (returned to us by the provider) Each provider acts as an independent controller for parts of this processing and handles your data under its own privacy notice

Payment processors may also carry out automated checks such as identity verification, creditworthiness assessments and fraud screening, which can involve automated decision making. Your rights in relation to automated decisions are explained in Section 13 (including the right to request human review).

To offer Klarna’s payment options, we share certain contact and order details with Klarna at checkout so Klarna can assess whether you qualify for their payment methods and tailor the options available. Klarna processes your personal data in line with Klarna’s Privacy Policy.

PayPal Credit and other payment gateways

When using PayPal Credit and payment gateways, your payment information is processed directly by the provider. We do not store your full card details or security data. These providers operate as regulated financial service providers and process personal data under their own privacy policies and compliance frameworks (including fraud checks, risk scoring and regulatory reporting).

These gateways act as controllers for the data they receive and processors (on our behalf) only where applicable — consistent with the controller/processor distinctions under the UK GDPR. Their role depends on the specific service they provide in relation to your transaction.

We only provide these providers with the information necessary to complete your payment, detect fraud, or resolve a dispute or refund.

8. How We Use Your Personal Data

We use your data to:

• Fulfil and manage orders
• Communicate with you about your purchases
• Provide customer support
• Manage your online account
• Send marketing communications (where permitted)
• Improve our website, products and services
• Detect and prevent fraud
• From competitions and third party promotions where you have been clearly informed and consented, including sending relevant marketing communications (where permitted).

8.1 Marketing communications and your choices

We may send you marketing communications where permitted by law, depending on your consent choices or, for existing customers, the PECR soft opt in (for email/SMS). You can control how you hear from us at any time. The options differ depending on the type of marketing:

Email marketing (newsletters and promotional emails)

If you have opted in to receive email marketing—and no longer wish to do so—you can unsubscribe at any time by clicking the “unsubscribe” link included in any marketing email we send you

Direct mail (postal marketing)

If you have opted in to receive marketing by post and wish to stop receiving these communications, you can opt out by contacting us at unsubscribe@limitlessdigital.com

Important information about your preferences

Email marketing and direct mail are managed separately. This means that opting out of one type of marketing will not automatically stop the other.

If you wish to stop receiving all marketing communications, please contact us and specify your request at: dpo@bestheating.com

Processing time

Please note that you may continue to receive communications for a short period while we process your request.

8.2 Third party online marketing

We may use your personal data (such as your email address, name, or phone number) to create custom audiences and similar audiences on third-party advertising platforms such as Meta (Facebook and Instagram).

This allows us to show relevant advertisements to individuals who have previously interacted with us, and to reach new people who are likely to be interested in our products and services.

When doing this, your data is securely hashed before being shared with these platforms and is used solely for audience matching purposes.

These platforms match the data against their own user base for audience targeting purposes. We do not receive any additional personal data about you from these platforms.

We only use data from customers who have consented to receive marketing communications or where we have a lawful basis to do so.

9. Sharing Your Personal Data

• Payment providers & fraud prevention services (to take payments, prevent fraud).
• Delivery & logistics partners (to deliver orders and send tracking updates).
• IT & hosting providers (to operate our website and systems).
• Analytics & advertising partners (with your consent, for analytics/ads).
• Email/SMS & marketing platforms (to send service messages and, where permitted, marketing).
• Customer review platforms (e.g., Trustpilot) — platform roles vary depending on the service provided; see Trustpilot’s controller/processor explanation.

We require processors to handle data only on our instructions and to keep it secure (controller–processor contracts as required by UK GDPR Article 28).

We do not sell your personal data.

10. International Transfers

Some partners are located outside the UK (for example, within the EEA or the US). Where we make restricted transfers, we implement appropriate safeguards such as:

• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, and a Transfer Risk Assessment; and/or
• reliance on an adequacy mechanism, including the UK extension to the EU US Data Privacy Framework (the “UK US Data Bridge”) where applicable.

These tools ensure your data continues to receive a high level of protection consistent with UK GDPR when transferred internationally.

You can request a copy of the relevant safeguards by contacting us.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our site, remember your preferences, analyse performance and, where you consent, personalise ads or measure ad performance.

• Under PECR, you must be told about cookies and consent is required for non essential cookies. Essential cookies (e.g., security, basket) do not require consent.
• For online advertising (e.g., Meta/Google/TikTok pixels, remarketing, cross site tracking), consent is required for setting/reading identifiers used for ad selection, delivery, profiling and related measurement.

Manage your settings anytime via our Cookie banner and Cookie Policy.

12. Data Retention

We keep personal data only as long as necessary for the purposes described or to meet legal requirements:

• Orders & invoices: to comply with legal obligations (e.g. HMRC requirements).
• Customer accounts: while active, then a defined period (e.g., up to 6 years) after last activity to handle queries/claims.
• Marketing records: until you opt out or after a period of inactivity (we routinely suppress unsubscribed contacts).
• Cookie identifiers / online identifiers: per our Cookie Policy and platform defaults.

We publish retention criteria in line with ICO guidance on transparency.

13. Automated decision making & profiling

• We use automated tools to screen orders for fraud. These tools may flag orders for manual review; we do not make decisions solely by automated means that produce legal or similarly significant effects without human involvement.
• If you choose Klarna, Klarna may conduct automated creditworthiness assessments to decide if a financing option can be offered (see Klarna’s policy). Where Article 22 UK GDPR applies, your rights include obtaining human review, expressing your view and contesting the decision.

We also create non-intrusive customer segments (e.g., by purchase category) to send relevant communications, respecting PECR/consent choices and your right to object to direct marketing.

14. Security

We apply appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, system monitoring, staff training, and vendor due diligence. Payment data is handled by PCI compliant providers. We regularly review our security controls as part of our accountability programme. We restrict access to personal data to authorised personnel and maintain procedures to deal with suspected data breaches.

15. Your Rights

Under UK GDPR, you have the right to:

• The right to be informed about the data we hold about you and what we do with it
• The right of access to the data we hold about you, including receiving a copy of the data
• The right to correct inaccuracies in the data we hold about you, this is also known as ‘rectification’
• The right to be forgotten in certain circumstances, allowing you to ask us to delete or remove data where there is no good reason for us to continue processing it, this is also known as ‘erasure’
• The right to restrict (i.e., prevent) the processing of the data if you want us to establish its accuracy or the reason for processing it
• The right to transfer the data we hold about you to another party where we use it with consent or for the performance of a contract. This is also known as ‘portability’
• The right to object to the processing of data where we rely on a legitimate interest and there is something in your particular situation which makes you want to object to the processing. You also have this right if we process data for direct marketing purposes
• Rights relating to any automated decision-making and profiling of your personal data.
• The right to withdraw consent at any time where we rely on consent (this does not affect the lawfulness of processing before withdrawal).

We may need to verify your identity before processing your request. We aim to respond to all legitimate requests within one month. Requests are usually free of charge, although we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

16. How to Contact Us

If you have any questions about this policy or wish to exercise your rights, please contact:

• Email: privacy@bestheating.com
• Post: Data Protection Officer, Limitless Digital Group Limited, Dawson Court, Billington Road Industrial Estate, Burnley, Lancashire, BB11 5UB

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): www.ico.org.uk / 0303 123 1113.

17. Third party links & services

Our website may link to third party sites (e.g., courier tracking, social networks, review platforms). Those sites have their own privacy policies and practices. For embedded review widgets or social plugins, loading may be controlled by our cookie consent tools to ensure compliance.

18. Changes to This Policy

We will update this Privacy Policy when necessary to reflect changes to our processing or applicable law. We will post changes here and update the “Last updated” date. Where appropriate, we will notify you directly.