Enquiry forms and UK GDPR for plumbing firms

What counts as personal data on a plumbing form

Almost everything a customer types into a job request form is personal data: name, phone number, email, home address or postcode, and often details about their home and the problem. Photos of a leak under the sink can show the inside of someone's home. Even the time they asked for a callback is information about them.

That does not mean you should avoid forms. It means you should treat what comes through them with care, in the same way you would treat a customer's house keys.

Collect only what you need

The easiest way to reduce risk is to ask for less. For most plumbing enquiries, you need a name, one way to contact them, the postcode or town and a description of the job. A full address can usually wait until you book the visit. Date of birth, landlord details or how they heard about you are rarely needed at enquiry stage.

Shorter forms also bring more enquiries, so data minimisation and good marketing point the same way. When we design forms, we ask which fields you actually use when calling customers back, and remove the rest.

Tell people what happens to their details

The ICO says you must give people privacy information at the time you collect their personal data, including your purposes for using it, how long you will keep it and who you will share it with. That information must be concise, transparent, intelligible, easily accessible and written in clear and plain language.^[1]

For a website form, that usually means two things:

1. A short line next to the form, for example: "We use these details only to reply to your enquiry and arrange the job. See our privacy notice for how long we keep them."
2. A privacy notice page linked from that line and from the footer, with the fuller detail.

The ICO notes that combining approaches such as layering and just-in-time notices is often the most effective way to explain this.^[1] The short line by the form is the just-in-time part. The notice page is the layer underneath.

What a plumbing firm's privacy notice should cover

Write it for your business, not copied from a template for a different kind of company. If it says you use tools you do not, or omits ones you do, it is inaccurate.

How long to keep enquiries

Decide a retention period for each kind of record and stick to it. Enquiries that never turn into jobs do not need to be kept for years. Records of completed work may need to be kept longer, for example for guarantees, accounts or safety records. Write the periods down, put them in your privacy notice and set a reminder to clear old data.

Email inboxes are the usual weak point. Enquiry emails pile up for years because nobody deletes them. A simple rule, such as moving unsuccessful enquiries to a folder and clearing it every few months, solves most of the problem.

Keep it secure

Security for a small trade website comes down to a few basics:

• HTTPS on every page, so form data is encrypted on the way to you.
• Forms that email you rather than storing data on the website, so there is no database of customer details for someone to steal from the site.
• Strong passwords and two-step login on your email, hosting and domain accounts.
• Spam protection that does not leak data, such as hidden honeypot fields and rate limits, rather than third-party tools that send visitor data elsewhere without explanation.
• Up-to-date software, or a simple site with little software to update.

Our own builds follow this pattern: the form sends an email through your mail account and keeps no copy on the website.

Marketing to people who enquired

Someone sending a job request is asking you to respond to that job. That does not automatically mean they want your newsletter or seasonal offers. Electronic marketing, such as emails and texts, is covered by the Privacy and Electronic Communications Regulations as well as UK GDPR, and generally needs consent or a narrow exception for existing customers.

If you want to send marketing, add a separate, unticked opt-in box to the form, say clearly what you will send, and make it easy to unsubscribe. Never make marketing a condition of getting a quote. For anything beyond the basics, the ICO's direct marketing guidance is the place to check.

Photos and uploads

Letting customers upload a photo of the problem can save a wasted visit. It also means you hold images of the inside of people's homes. If you offer uploads, explain why you ask for photos, keep them only as long as needed for the job and make sure they are not stored in a public folder on the website.

When a customer asks about their data

Occasionally a customer will ask what you hold about them, or ask you to delete it. Under UK GDPR people have rights to access their data, have it corrected and, in many cases, have it deleted. For a small plumbing firm these requests are rare and usually simple.

1. Check who is asking. Make sure the request really comes from the customer, for example by replying to the email address they used before.
2. Find everything. Look in your inbox, job records, phone and any booking or invoicing system.
3. Respond within a month. Send a copy of what you hold, or confirm what you have deleted.
4. Keep what the law requires. You may need to keep some records, such as invoices for tax purposes, even after a deletion request. Explain that politely.

Writing down where customer data lives, before anyone asks, makes these requests quick to handle. It is also a useful exercise in its own right, because it often reveals old data you no longer need.

Checklist for your form

• Only the fields you need to reply are required.
• A short privacy line sits next to the form, linking to the full notice.
• The privacy notice describes what your business really does.
• Retention periods are set and followed.
• The site uses HTTPS and the form does not store data on the website.
• Accounts are protected with strong passwords and two-step login.
• Marketing is opt-in, separate and easy to stop.

For cookies and analytics on the same site, see the cookies guide. Our own privacy notice shows one way of explaining a simple enquiry form.