Privacy Policy | HomeHub Smart Solutions

Last updated: 3 November 2026

This policy explains, in plain English, what personal information HomeHub Smart Solutions collects, why we collect it, where it is kept and what your rights are. We have tried to describe what we actually do, not what a template says we should do. If anything here is unclear, ring us on 01403 626006 and we will explain it.

1. Who we are and how to contact us

HomeHub Smart Solutions is the trading name of Home Hub Smart Solutions Limited, a company registered in England and Wales under company number 15412644. Our registered office is 88 Cook Way, Broadbridge Heath, Horsham, West Sussex, RH12 3US. In this policy, "we", "us" and "our" mean Home Hub Smart Solutions Limited.

We are the data controller for the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it. We are registered with the Information Commissioner's Office as a data controller under registration reference ZC233660.

You can contact us about anything in this policy by phone on 01403 626006, by email at [email protected], or by post to the registered office address above.

2. What we collect and where it comes from

We collect information when you enquire through the form on our website, call or text us, email us, book a free site survey, or become a customer. While we work with you, we build up a record of the job. Depending on how far things go, that record can include:

Your name and contact details (phone number, email address, postal address)
The address of the property where the work is to be done
Details of your enquiry, such as the rooms involved, the equipment you have or want, and what you are trying to achieve
Photos and videos you send us of your property, by email, WhatsApp or with the form on our website. We use them to understand the job before we visit. Our own system, running on our own server, may describe them in a note to help us prepare; they are not sent to any outside AI service. They are kept and deleted along with your enquiry or job
Site survey notes and photos of the installation, before, during and after the work
The results of any network check we run at your property (see section 6)
Quotes, job records, invoices and payment records (never full card numbers, see section 5)
Correspondence with you, including emails to and from our info@ address, SMS conversations and notes of calls and visits
Messages and comments you send our Facebook Page or Instagram account (@homehub.smartsolutions): your message, your public name and profile picture as Facebook or Instagram shows them to us, and the ID those services give your account. Our customer system collects them so we can answer you from one place, and they are kept and deleted like any other correspondence (see section 8 and how to ask us to delete your data)
WiFi network names and passwords, and device sign-in details, where we need them to set up and hand over your system (see section 6)
If you use the form on our website: the first page you visited on our site and, if you arrived from one of our adverts or a link carrying a campaign tag, which advert or campaign it was (including Google's click reference). This tells us which of our advertising brings real enquiries

Two things about our phone system that you should know. First, calls to and from our business number are recorded when they are answered. Our own system, running on our own computers, turns each recording and each voicemail into a written transcript and a short summary. We do this so we have an accurate note of what was discussed and agreed, and to keep an eye on the quality of our service. If you would rather a call was not kept, tell us and we will delete the recording and its transcript. Second, if you call us and we cannot answer, our system may message you, by WhatsApp or by text, to ask what you need, and we will ring you back if you ask us to.

We also look a few things up in public sources, and only when there is a reason to. If we miss a call from a number we do not know, we check public caller ID sites (tellows and shouldianswer) to see whether others have reported it as a sales or nuisance call. We never do this when you ring us about our community support programme. When we add the address of a property, we may look it up on the Energy Performance Certificate register and with postcodes.io, so we know the type, age and size of the building and its local council before we visit. If you contact us from a business email address, we may read your business website and your company's entry at Companies House. Before a meeting we have booked with you, we may search the web (using Bing) for you and your organisation. And to find a place on the map and work out the drive time, we use public map services built on OpenStreetMap.

3. Why we use your information and our lawful bases

Data protection law says we need a proper reason (a "lawful basis") for everything we do with your information. In plain terms, ours are:

To do the job you have asked for (contract). Preparing your quote, booking the survey and installation, doing the work, invoicing you, and looking after you under our 12-month workmanship guarantee.
To run the business properly (legitimate interests). Keeping notes and records of enquiries and jobs, recording and transcribing calls and voicemails so we have an accurate account of what was agreed, messaging you when we miss your call, noting which page or advert a website enquiry came from, and holding records in case a question or dispute comes up later. We also note when you open the quotes, invoices and links we send you, as explained below.
Marketing (consent). We only send marketing emails or texts if you have agreed to receive them, and you can stop them at any time (see section 7).
Measuring our adverts (consent). Google Ads only measures our adverts with cookies, and only receives the hashed contact details described in section 4, if you click Accept All on our cookie banner. Meta (Facebook and Instagram) likewise only measures our adverts, and only receives the hashed contact details described in section 4, if you click Accept All. You can change your choice at any time on our Cookie Policy page.
Because the law says so (legal obligation). Keeping business and tax records for HMRC, and responding to lawful requests from authorities.

When you open what we send you. When you open a quote or invoice we send you, our own server records that it was opened, roughly how long the page was actively read, which parts were viewed, and whether you downloaded it or pressed Accept or Pay. For a quote it also keeps the IP address and browser details (the "user agent") each time it is opened, so we can tell you reading it apart from an email system checking the link; for an invoice it keeps neither. When you open a booking link we send you, the time, IP address and browser details are recorded too. If you accept a quote online, the name you type, any signature you draw, the time and the IP address it came from are kept with the quote and printed on your signed copy; if you decline one online, we note the IP address it came from. If we host a preview or showcase for you (at app.hhssuk.co.uk/s/...), our server records which screens you open, how long you spend on each, what you click, any question you type into it and how much of any film you watch; for those it keeps the type of device (phone, tablet or computer) and the size of the window, but no IP address or browser details. Review pages we host for you (at hhssuk.co.uk/p/...) save the ticks and notes you enter to our CRM, with a history of each change. We use all of this only to follow up at the right time and to keep an accurate record of what was agreed. We do not use cookies or third-party tracking for any of it.

We do not make any decisions about you by purely automated means that have legal or similarly significant effects on you. A first reply to a new enquiry may be sent automatically to acknowledge it. When you first get in touch, our digital assistant, Sparky, may also message you on WhatsApp (or by text if you are not on WhatsApp) to collect what we need before a visit: your name, address and email, what the problem is, a little about the property, any photos that would help and the times that suit you. Sparky tells you it is an assistant, never quotes a price, and can book the survey visit at a time you choose from the ones it offers. It runs on our own computers. When one of us asks it to think harder about a task, it may ask Anthropic, an AI service provider, for help. Anthropic then receives the words of our request and the records Sparky looks up for it, such as names, addresses and job, quote or equipment details, some of which may first have come from a call, a voice message or a photo. It never receives the recordings, voice messages or photos themselves, passwords, alarm or key safe codes, bank or card details, or the links that open your quotes and agreements. A person reads every enquiry, and every quote, price and piece of advice comes from a person. If you would rather not deal with Sparky, reply STOP or ring us on 01403 626006.

4. The systems and companies we use

We keep your data in as few places as we sensibly can. Our customer records (enquiries, quotes, jobs, invoices, notes) are held in our own CRM system, which runs on a server we own, located in the UK, and is backed up every night. Beyond that, these companies process data on our behalf:

Microsoft 365 handles our email and calendar
The Number People provides our business phone line, which connects to our own phone system; call recordings stay on our own system
Twilio sends and receives our text messages
WhatsApp (part of Meta) carries the messages we exchange with you on WhatsApp
Meta Platforms (Facebook and Instagram) carries the messages and comments you send our Facebook Page or Instagram account, and our replies
Anthropic is an AI service provider. It helps our assistant, Sparky, when one of us asks it to think harder about a task. It receives the words of the request and the records Sparky looks up for it, such as names, addresses and job, quote or equipment details, and never recordings, voice messages, photos, passwords, access codes, bank or card details, or the links that open your quotes and agreements. Under its commercial terms it does not use that data to train its models.
Stripe processes card payments (see section 5)
Cloudflare delivers our website, carries every connection to our CRM at app.hhssuk.co.uk, encrypted, and runs the speed test in our network checks (see section 6)
Hostinger hosts our website
FormSubmit passes the form on our website to us by email, but only if our own system cannot be reached when you send it
Ubiquiti carries the connection between your UniFi network and us, only if you have signed our remote monitoring agreement (see section 6)
Google Analytics and Microsoft Clarity give us website statistics. They run on every visit but set no cookies unless you click Accept All; until then Google receives only a basic record of page views and enquiries, and Clarity records how the pages are used, such as scrolling and clicks, without cookies (see our Cookie Policy)
Google Ads shows our adverts and, if you accept its cookies, measures which of them lead to enquiries. When you then send our website form, a hashed copy of the contact details you entered goes to Google so it can match the enquiry to an advert (see our Cookie Policy)
Meta Platforms (Facebook and Instagram) measures our adverts on those sites, and only if you click "Accept All" on our cookie banner. The Meta Pixel then runs on our website, and when you send us an enquiry our own system tells Meta about it, passing your email address and phone number in scrambled (hashed) form so Meta can match the enquiry to an advert without us handing over the details themselves. If your enquiry later becomes work with us, we may tell Meta that too, in the same hashed form. If you choose "Essential Only", nothing about you is sent to Meta (see our Cookie Policy)
ipinfo.io tells a network check at your property the public IP address and provider of your internet connection (see section 6)
Apple works out drive times and delivers notifications for the app our engineers use (see section 14)

One thing we want to be clear about, because a lot of firms are vague on it. We use AI tools to help draft messages and to transcribe calls and voicemails, and those tools run on our own computers, on our own premises. The one exception is the one described above: when one of us asks our assistant Sparky to think harder about a task, the words of the request and the records it looks up may go to Anthropic, an AI service provider, never recordings, voice messages, photos, passwords or codes. Your information is not sent to any other AI cloud service.

Setting up your smart devices often involves creating or configuring accounts with the device manufacturers (for example your camera, doorbell or speaker brand). Those accounts are yours, not ours: the manufacturer handles your data under its own privacy policy, and we walk you through what has been set up at handover.

Some of the companies listed above process data outside the UK. Where they do, the transfer is protected by safeguards approved under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement and Addendum built into their contracts. Ask us and we will tell you which safeguard applies to a provider and how to see it. We never sell your information to anyone.

5. Payments

Card payments (Visa, Mastercard, American Express, Apple Pay and Google Pay) are taken through secure Stripe payment links. Your card details go directly to Stripe, and we never see or store your full card number. Receipts come from Stripe. Stripe's handling of your card details is covered by its own privacy policy at stripe.com/privacy.

6. WiFi, device passwords, network checks and monitoring

To set up your network and smart devices, and to hand everything over to you working and demonstrated, we sometimes need to keep hold of WiFi network names and passwords or device sign-in details. These are stored encrypted on our own systems and used only to support your installation. We keep them while your system is under our 12-month guarantee or an ongoing support arrangement with us, delete them when that ends, and delete them sooner if you ask.

Network checks at your property. When we look into a WiFi or network problem, we usually run a check from our engineer's phone or laptop, or from a small test device connected to your network. It records how your network is set up and how well it works: your WiFi network's name and the access point the check is connected to, how quickly your router answers, the public IP address and provider of your internet connection, speed test results, and the devices it can see on your network, with the names they give themselves. Run from a laptop or test device, it also records those devices' hardware addresses and makers, and the other WiFi networks within range. If you let us sign in to your UniFi controller for the check, it also records the access points, networks, connected devices and recent events the controller lists. To find your public IP address and provider the check asks ipinfo.io, and the speed test runs against Cloudflare's servers. A check does not record what anyone does online. Our CRM writes up the results, and they are kept with your job record (see section 8).

Remote monitoring of your network. If you sign our remote monitoring agreement, we connect to your UniFi network through Ubiquiti's own secure cloud service, as an administrator you can see and remove in your UniFi app at any time. Our CRM then checks the health of your network kit automatically: each unit's status, the internet connection, and the devices connected to your WiFi (their names, type, signal and how much data they have used). We do not record or use the content of anything you do online, or the broad traffic categories UniFi can show. We only sign in and look more closely to investigate an alert or when you ask us to, and we tell you about any setting we change. We do this under the agreement you sign with us. The list of your network kit and the alert history are kept with your job record (see section 8). You can withdraw your permission at any time: we then stop monitoring straight away and remove our access within 2 working days.

7. Marketing and how to opt out

We only send marketing emails or texts to people who have agreed to receive them, and we keep a record of that consent. Every marketing message we send includes an unsubscribe link, and clicking it stops them. You can also opt out at any time by emailing [email protected] or calling us. Opting out of marketing does not affect the messages we need to send you about your own enquiry or job, such as quotes, appointment confirmations and invoices.

8. How long we keep your information

Business records (quotes, invoices, job records and the correspondence that goes with them) are kept for at least 6 years, because tax law requires it. Site photos and the results of network checks are kept as part of the job record.
Call recordings and voicemail transcripts are kept for up to 12 months and then deleted, unless they form part of a job record or relate to an open question or dispute, in which case they are kept with that record.
Enquiries that do not become jobs are deleted 12 months after our last contact with you.
Records of opening and reading a quote or invoice are deleted after 12 months.
Records of how a preview or showcase we hosted for you was used are deleted 12 months after each visit.
Records of opening a booking link, and the ticks and notes you leave on a review page we host for you, are kept with the job or project they belong to.
Marketing consent records are kept for as long as you are on our marketing list, so we can show your consent and honour your opt-out.

9. How we keep your information safe

Our customer records live on a server we operate in the UK, not scattered across third-party clouds, and are backed up nightly. WiFi and device passwords are stored encrypted. Staff sign in to our CRM with a passkey or a password, and repeated wrong attempts are blocked. The pages we send you, such as your portal, quotes and booking links, open only from a long, random private link, and we can replace your portal link at any time if you ask.

No system connected to the internet is ever completely secure, and we will not pretend otherwise. If a breach ever put your data at risk, we would report it to the ICO within 72 hours as the law requires, and tell you directly and promptly if it posed a real risk to you.

10. Your rights under UK GDPR

You have the right to:

Ask for a copy of the personal information we hold about you
Have anything inaccurate corrected
Ask us to delete your information
Ask us to restrict what we do with it
Receive the information you gave us in a portable, machine-readable format (this applies to data we process electronically under the contract or consent bases)
Object to how we are using it
Withdraw any consent you have given, at any time

To use any of these rights, contact us using the details in section 1. There is normally no charge, we may need to check your identity first, and we will respond within one month. For a particularly complex request the law allows up to a further two months, and we would tell you within the first month if we needed that. Some records we are required to keep by law (such as invoices, for tax) cannot be deleted before their retention period ends, but we will always tell you what we can and cannot do. To have us delete what we hold from a Facebook, Instagram or WhatsApp conversation, see Delete your data.

11. CCTV systems we install

When we install a CCTV system at your home or business, the recorded footage is yours. You own and control it, and in day-to-day use we have no access to it. If you ask us to connect to your system remotely for support or maintenance, or take out a monitoring plan with us, we act only on your instructions and access footage only so far as that work needs.

If your cameras only capture your own private property, data protection law generally does not apply to your home use. Where they can see beyond your boundary, such as a street, a shared path or a neighbour's property, you have responsibilities of your own under data protection law, and we give you plain-English guidance on them at handover.

12. Guardian monitoring and children

Our Guardian service monitors the wellbeing of an adult being cared for, and the activity and alert data it produces is about that adult. Where the person being monitored is not our customer, we rely on our and their family's legitimate interests in safeguarding their wellbeing, and, because activity and alert data can reveal information about a person's health, we ask for the monitored person's explicit consent before the service goes live wherever they have capacity to give it. Where they do not, we ask the person arranging care to confirm they are authorised to act for them (for example under a Lasting Power of Attorney) and that monitoring is in the person's best interests. We explain the system to the monitored person in plain terms at installation, and they can use all the rights in section 10.

Our services are designed for adults and we do not market to children or ask them for information. Children may appear incidentally in things like site photos or camera test footage during an installation; we keep such material to the minimum needed for the job, treat it with the same care as everything else, and will remove it on request.

13. HomeHub Office software

HomeHub Office is the business management software we provide to other trade businesses as a subscription. When you sign up we collect your trading name, your email address and your card payment through Stripe, and, if you pick your company from the Companies House lookup, your company number and registered office address. We use this to set up and run your account, to bill you and to contact you about the service, on the basis of our contract with you. Billing records are kept for at least 6 years because tax law requires it.

The information you and your team then put into your own HomeHub Office instance, such as your customers, quotes, jobs and invoices, belongs to you. For that data you are the controller and we are your processor: we only hold and process it to provide the service, on your instructions, under the data processing terms in the HomeHub Office Terms of Service. It is kept on servers we own in West Sussex, backed up nightly, never shared with other customers, and deleted 30 days after your subscription ends.

14. The HHSSUK app our engineers use

Our engineers use our own iPhone and iPad app, HHSSUK, signed in to our CRM. It is a working tool for our staff, not an app for customers, and it contains no advertising or analytics code.

What it sends to our CRM. The photos, documents and voice notes an engineer adds to a job; the results of network checks run at your property (see section 6); the texts they choose to send you from it, such as "on my way" with the number of minutes; and a notification token, so the CRM can send them reminders and alerts through Apple's notification service.
Location. The app uses the phone's location in two ways, and never records it or sends it to us. iOS only lets an app see which WiFi access point the phone is connected to when Location is allowed, which is how a network check notices the phone moving between access points. And to estimate the drive time to a visit, the phone asks Apple Maps for a route from where it is to the visit's address. Only the number of minutes goes into an "on my way" text.
Camera and microphone. Used only when an engineer takes a photo, photographs a receipt or document, or records a voice note for a job.

What the app adds to a job is kept with the job record (see section 8).

15. Cookies

Our website uses a small number of cookies. Analytics and advertising cookies are only set if you click Accept All, although Google Analytics and Microsoft Clarity still measure visits without cookies, as section 4 explains. Full details, including how to change your choice, are in our separate Cookie Policy.

16. Changes to this policy

If we change how we handle your information, we will update this page and change the date at the top. If a change is significant and you are an existing customer, we will make a point of telling you.

17. Questions and complaints

If you have a question or a complaint about how we have handled your information, please come to us first, and we will do our best to put it right. Contact Home Hub Smart Solutions Limited on 01403 626006, at [email protected], or by post to 88 Cook Way, Broadbridge Heath, Horsham, West Sussex, RH12 3US.

If you are not happy with our answer, you have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk.