GDPR Policy
Last updated: 28 April 2026
This GDPR Policy sets out how Zenith Renewables Limited aims to comply with the UK General Data Protection Regulation, the Data Protection Act 2018 and related UK data protection requirements.
The purpose of this policy is to explain how we handle personal information responsibly, lawfully, fairly and transparently. It applies to the personal information we process through our website, enquiries, quotations, customer communications, installations, suppliers and business administration.
Data Controller Details
For the purposes of UK data protection law, Zenith Renewables Limited is the data controller for the personal information described in this policy unless stated otherwise.
Who This Policy Applies To
This policy applies to personal information relating to:
- Website visitors.
- People who submit enquiry forms or quote requests.
- Prospective customers and existing customers.
- Residential and commercial project contacts.
- Suppliers, contractors and professional advisers.
- Employees, workers, subcontractors and representatives where relevant.
- Anyone who contacts Zenith Renewables Limited by phone, email, website form or other communication channel.
It applies to personal information held digitally, by email, in business systems, on websites, in forms, in project records and, where relevant, in paper records.
Data Protection Principles
Zenith Renewables Limited aims to process personal information in line with the core UK GDPR principles. We aim to ensure that personal information is:
- Processed lawfully, fairly and transparently.
- Collected for specified, explicit and legitimate purposes.
- Adequate, relevant and limited to what is necessary.
- Accurate and, where necessary, kept up to date.
- Kept only for as long as necessary.
- Processed securely using appropriate technical and organisational measures.
- Handled with accountability, with appropriate records and controls where required.
These principles guide how we collect, use, store, share, retain and delete personal information.
Lawful Bases for Processing
We only process personal information where we have a lawful basis to do so. The lawful basis depends on the purpose of the processing.
| Processing activity | Examples of data used | Likely lawful basis |
|---|---|---|
| Responding to enquiries | Name, phone, email, postcode, enquiry details | Legitimate interests and/or steps before entering into a contract |
| Preparing quotations and recommendations | Contact details, property information, project requirements | Contract or steps before entering into a contract |
| Delivering installations or services | Customer details, property address, project communications, service records | Contract |
| Keeping accounting and business records | Customer, invoice, payment and contract records | Legal obligation and legitimate interests |
| Website security and fraud prevention | IP addresses, technical logs, security event records | Legitimate interests |
| Marketing updates | Name, email, phone, marketing preferences | Consent or legitimate interests, depending on context |
| Analytics and performance monitoring | Cookie identifiers, device data, website usage information | Consent where required, or legitimate interests for limited essential analytics |
Where we rely on legitimate interests, we consider whether the processing is necessary and whether our interests are overridden by the rights, freedoms or interests of the individual.
Types of Personal Information We Process
Depending on how you interact with us, we may process:
- Identity information, such as name and contact name.
- Contact information, such as email address, phone number and address.
- Property information, such as postcode, property type, site address and project details.
- Energy project information, such as interest in solar panels, battery storage, hybrid inverters or complete packages.
- Communication records, such as form submissions, emails, notes and call details.
- Customer and contract information, where a quotation or project proceeds.
- Billing and accounting information.
- Website and technical information, such as IP address, device information, cookie data and website usage data.
- Supplier, contractor and business contact information.
We aim to collect only the personal information we need for a clear business or legal purpose.
Special Category Data
Special category data is more sensitive personal information and includes information such as health data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, sex life and sexual orientation.
Zenith Renewables Limited does not normally need special category data for website enquiries, quote requests or renewable energy services.
If special category data is ever processed, we will only do so where necessary, where we have a lawful basis under Article 6 UK GDPR, and where a separate Article 9 condition applies. We will also consider whether additional safeguards or a Data Protection Impact Assessment are required.
Individual Data Protection Rights
Individuals have rights over their personal information. These rights are not always absolute, but we will consider and respond to valid requests in line with UK data protection law.
These rights may include:
- The right to be informed about how personal information is used.
- The right of access to personal information.
- The right to rectification if information is inaccurate or incomplete.
- The right to erasure in certain circumstances.
- The right to restrict processing in certain circumstances.
- The right to data portability in certain circumstances.
- The right to object to processing in certain circumstances.
- Rights relating to automated decision-making and profiling, where applicable.
- The right to withdraw consent where processing is based on consent.
We aim to respond to rights requests without undue delay and normally within one month, unless an extension is permitted by law. We may need to verify identity before acting on a request.
Data Security Measures
Zenith Renewables Limited uses reasonable technical and organisational measures to protect personal information.
These may include:
- Secure website hosting and access controls.
- Limiting access to personal information to people who need it.
- Password protection and secure account management.
- Using reputable third-party providers for website, email, form, CRM or IT services.
- Keeping software, plugins and systems updated where reasonably possible.
- Using appropriate safeguards for business devices, accounts and records.
- Reviewing access to personal information when staff, contractors or suppliers change.
No system is completely risk-free, but we aim to handle personal information with appropriate care and security.
Data Retention and Deletion
We do not keep personal information for longer than necessary. Retention periods depend on the purpose of the processing, legal requirements, contractual needs and business records.
| Record type | Typical retention approach |
|---|---|
| Website enquiries that do not become customers | Usually up to 24 months after last contact, unless there is a business or legal reason to keep them longer |
| Quote and survey records | Usually up to 24 months, or longer where linked to a customer project |
| Customer project records | For the project duration and then normally up to 7 years for contractual, accounting and legal purposes |
| Invoice, payment and accounting records | Normally 6 to 7 years, depending on tax and accounting requirements |
| Marketing consent and suppression records | For as long as needed to manage consent, preferences and opt-out records |
| Security and website logs | Usually between 30 days and 12 months, unless needed for investigation or security purposes |
When information is no longer needed, we will delete, anonymise or securely dispose of it where reasonably practical.
Sharing Personal Information
We do not sell personal information. We may share personal information where necessary for legitimate business, service, legal or operational reasons.
We may share information with:
- Employees, contractors, subcontractors and representatives working on our behalf.
- Surveyors, installers or technical specialists involved in a project.
- Product suppliers, manufacturers or warranty providers where needed for product support.
- Website, hosting, email, CRM, form, analytics and IT service providers.
- Payment, accounting, finance, bookkeeping and professional advisers.
- Insurers, legal advisers, regulators or public authorities where required or appropriate.
Processors and third parties
Where third-party providers process personal information on our behalf, we aim to use appropriate contractual and organisational safeguards.
International transfers
Some systems or providers may process data outside the UK. Where this happens, we will take reasonable steps to ensure appropriate safeguards are in place.
Personal Data Breaches
A personal data breach may include accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information.
If we become aware of a suspected personal data breach, we will assess the incident, take appropriate steps to contain it and consider the risk to individuals.
Where legally required, we will report a personal data breach to the Information Commissioner’s Office. Where the breach is likely to result in a high risk to individuals, we will also notify affected individuals where required.
Responsibility, Awareness and Training
Everyone handling personal information on behalf of Zenith Renewables Limited is expected to treat it responsibly and in line with this policy.
We expect staff, contractors and representatives to:
- Only access personal information where needed for their role.
- Keep personal information confidential.
- Use approved systems and secure working practices.
- Report suspected data protection issues or security incidents promptly.
- Avoid collecting unnecessary personal information.
- Follow instructions around retention, deletion and secure disposal.
Where appropriate, we will provide guidance or awareness training to people who handle personal information for the business.
Policy Review
This GDPR Policy may be reviewed and updated from time to time to reflect changes in our business, website, systems, services or legal obligations.
The latest version will be published on this page with the updated date shown at the top.
Contact Us About Data Protection
If you have questions about this GDPR Policy, want to exercise your data protection rights, or need to raise a data protection concern, contact Zenith Renewables Limited:
You also have the right to complain to the Information Commissioner’s Office if you are unhappy with how your personal information has been handled.