Privacy notice

Draft. This notice describes how HPH Systems works today. It must be checked by a solicitor before HPH Systems is offered to other businesses. Fill in everything in [square brackets].

Version 2026-10-31 · Last updated: [date]

Who we are

HPH Systems is provided by [legal name of the company selling HPH Systems], a company registered in England and Wales (number [number]), registered office [address] ("we", "us"). Contact us about privacy at [privacy email address]. Our ICO registration number is [ICO number].

Two different roles

• Information a business puts into HPH Systems (its customers, jobs, quotes, invoices, messages, certificates, photos and staff records): the business decides what goes in and why, so the business is the controller and we are its processor. We only use this information to run HPH Systems for that business, under our data processing agreement below. If you are a customer of a business that uses HPH Systems, please contact that business about your information.
• Information about the people who use HPH Systems (account holders and their staff, for logins, security and billing): we are the controller. The rest of this notice is mainly about this.

What we collect about HPH Systems users

• Account details: name, email address, mobile number, the business you belong to and what you can use in it.
• Security details: your password (stored only as a scrambled "hash", never as the password itself), your authenticator app set-up (stored encrypted), backup codes (hashed), and records of sign-ins and failed attempts, kept to protect accounts.
• Billing details: [how subscriptions are paid, and by which payment provider].

Why we use it, and our lawful basis

• To provide HPH Systems under our contract with your business, and to let you log in (contract, and our legitimate interest in providing a secure service).
• To keep accounts and data secure, for example by limiting login attempts (legitimate interests).
• To meet legal obligations, such as keeping accounting records (legal obligation).

We do not sell personal information, and we do not use it for advertising.

Who else handles the information (sub-processors)

We will tell businesses before adding or replacing a sub-processor.

Cookies and similar technology

HPH Systems uses only what it needs to work: a login cookie, a short-lived cookie between your password and your authenticator code, and your browser's storage for preferences (such as the business you last used and settings for screens) and for a copy of the business's records on each device you use, so the app opens quickly. That copy only holds what your login can see, is replaced when your access changes, and is deleted when you log out or your login runs out. There are no advertising or tracking cookies, so no cookie banner is needed for them.

How long we keep it

• A business's information is kept while it uses HPH Systems. Daily backups are kept for 30 days.
• When a business leaves, its information is deleted, and its last copy and backups are deleted 30 days after that.
• Staff routes: deleted at the end of each day. Last positions: deleted after 7 days. Job timer locations: kept with the time entry they belong to, as a record of the hours worked, until the business deletes it.
• Account and billing records: 6 years from the end of the financial year they relate to, as HMRC requires for business records.

Security

HPH Systems is only reached over encrypted connections (HTTPS). Every login needs a password and a code from an authenticator app. Connection secrets (such as email and accounting logins) are stored encrypted. Each person only sees the businesses and areas they have been given. Each business's own connections (its email, WhatsApp number, Xero and card payments) belong to that business only. HPH Systems manages your login and subscription but does not open your business's jobs, customers, messages or accounts, unless your main account lets HPH Systems support in for a set time from Settings › Security, which ends by itself.

Your rights

You can ask to see, correct or delete your information, ask us to limit or stop using it, object, or ask for a copy to take elsewhere. In HPH Systems, Settings › Privacy, terms and credits lets you download your account details and your business's data, and ask for your account to be closed. For anything else, contact [privacy email address]. We reply within one month. If you are unhappy, you can complain to the Information Commissioner's Office at ico.org.uk.

Terms of service

Draft. To be checked and completed by a solicitor before HPH Systems is sold. Fill in everything in [square brackets].

Version 2026-10-31 · Last updated: [date]

1. Who these terms are between

These terms are between [legal name of the company selling HPH Systems] ("we") and the business that signs up to HPH Systems ("you"). HPH Systems is for businesses only, not for consumers. By signing up you confirm you can agree to these terms for your business.

2. Using HPH Systems

• We give you a non-exclusive, non-transferable right to use HPH Systems for your own business while you subscribe.
• You are responsible for the people you give access to, and for keeping logins and authenticator devices safe.
• You must not misuse HPH Systems: no unlawful content, no spam, no attempts to break its security, and no copying or reselling HPH Systems.

3. Certificates, forms and professional responsibility

• HPH Systems helps you record your work. It does not check that work is safe or complies with regulations. The engineer who completes and signs a certificate is responsible for its content, for the tests and checks behind it, and for holding the registrations and qualifications the work needs (for example Gas Safe Register, an electrical competent person scheme, or F-gas certification).
• Calculated values (for example combustion ratios, F-gas leak check intervals, temperature checks and overall results) are there to help. You must check them against the regulations, industry standards and manufacturers' instructions before relying on them.
• You must only use registration numbers you are entitled to use, and you are responsible for following each scheme's rules. HPH Systems does not show scheme logos (such as Gas Safe Register's); only your own company logo appears on your documents.
• Only people who are suitably qualified, competent and registered for the work may complete and issue certificates. Before a certificate is completed, the person completing it confirms this in HPH Systems, and that the details are accurate; that confirmation is kept with the certificate.
• We do not promise that any form meets every standard. Regulations and industry standards (for example BS 7671 and the gas industry's procedures) change. We make reasonable efforts to keep the forms up to date, but you must check that each form you use meets the rules that apply to your work on the day, and tell us if you find a problem.
• HPH Systems' certificates are not the model forms of, and are not approved by, any registration scheme or standards body.

4. AI features

AI features draft messages, quotes and other content and can carry out requests you give them. You are responsible for checking what they produce before it is sent or relied on. Using AI features means the relevant information is processed by our AI provider (see the privacy notice). Each business has a monthly allowance of AI requests [set out the allowance in the plan].

5. Services from other companies

HPH Systems can connect to services such as Xero, Microsoft 365, Gmail, WhatsApp and the DVLA. Those services are provided by those companies under their own terms, which you must accept and follow. We are not responsible for them, and a connection may stop working if they change their service.

6. Your data

• You own the information you put into HPH Systems. We process it only to provide HPH Systems, as set out in the data processing agreement, which forms part of these terms.
• You are responsible for having a lawful basis for the personal information you put in, and for telling your customers and staff how you use it.
• Keep your own copies of records you must keep by law. For example, landlord gas safety records must be kept for at least two years. Certificates stay in HPH Systems while you subscribe, and you can download or print them at any time.
• You can export your information at any time while you subscribe: Settings › Privacy, terms and credits › Download all your business's data gives every record in a standard format (JSON), and the jobs, quotes and invoices lists can be downloaded as CSV for spreadsheets. When your subscription ends, we delete your information as set out in the privacy notice.

7. Fees

[Plans, prices, VAT, billing period, payment method, late payment, price changes with notice, refunds.]

8. Availability and changes

We aim to keep HPH Systems available and will try to give notice of planned maintenance. We may improve or change HPH Systems, and will give reasonable notice of changes that significantly reduce what it does. [Any service level the company wants to commit to.]

9. Liability

• Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.
• We are not liable for loss of profits, revenue, business or goodwill, or for indirect or consequential loss.
• Our total liability in any 12 months is limited to [the fees you paid us in those 12 months]. [Solicitor to confirm the cap is reasonable under the Unfair Contract Terms Act 1977.]
• We are not responsible for the content of certificates, documents or messages you or your staff create or send.

10. Your responsibility to us (indemnity)

You will cover our reasonable losses and costs (including legal costs) from any claim made against us by someone else that arises from your work or your staff's work, from the checks behind a certificate, or from information you or your staff put into HPH Systems that is wrong or that you had no right to use. [Solicitor to confirm the wording and any cap.]

11. Ending the subscription

You can cancel [notice period]. We may suspend or end access if you seriously break these terms or do not pay, after giving notice where we reasonably can.

12. Intellectual property

HPH Systems, its name, logo, design and software belong to us. Your content belongs to you.

13. Other organisations' names

HPH Systems is not linked to, approved by or endorsed by Gas Safe Register, NICEIC, NAPIT, the IET, the Heating and Hotwater Industry Council (Benchmark), HSE, OFTEC, any other registration scheme or standards body, or any other software company named in HPH Systems. Their names are used only to describe what a form or feature is for, or to say whose files HPH Systems can import.

14. General

We may update these terms and will give [30 days'] notice of material changes by email. Each version has a version number; you are asked to agree to a new version when you next log in, and we keep a record of the version each person agreed to and when. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Data processing agreement

Draft. This sets out the terms required by Article 28 of the UK GDPR. To be checked by a solicitor. It forms part of the terms of service.

1. Roles

The business using HPH Systems is the controller of the personal data it puts into HPH Systems. [Legal name] is its processor.

2. Details of the processing

3. What we will do

1. Process the personal data only on the business's documented instructions (using HPH Systems as designed counts as an instruction), unless the law requires otherwise, in which case we will tell the business first if the law allows.
2. Make sure everyone who can access the data is bound by confidentiality, and only open the business's data in HPH Systems when the business has let HPH Systems support in (Settings › Security), for as long as it allows.
3. Keep appropriate security measures in place, including encrypted connections, two-step login, encrypted connection secrets, access limited to each business, and daily backups.
4. Only use the sub-processors listed in the privacy notice, under written terms giving the same protection, and tell the business before adding or replacing one so it can object.
5. Only transfer data outside the UK with a lawful safeguard in place (for Anthropic, the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, in Anthropic's Data Processing Addendum) [confirm].
6. Help the business respond to people exercising their data protection rights, and with security, breach notification and data protection impact assessments.
7. Tell the business without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data.
8. At the end of the service, delete the data (with backups deleted within 30 days), unless the law requires us to keep it, after giving the business the chance to export it.
9. Make available the information needed to show we meet these obligations, and allow reasonable audits [set notice and frequency].

Credits and licences

HPH Systems is built with the following open source software and open data. Thank you to everyone who makes them.

Full licence texts are kept with the software: public/vendor and public/fonts/OFL.txt in the HPH Systems files, and in each server library's own folder. Company and product names mentioned in HPH Systems (such as Xero, Microsoft, Google, WhatsApp, Gas Safe Register, NICEIC, NAPIT, REFCOM and Tradify) belong to their owners and are used only to describe connections and imports. HPH Systems is not connected with or endorsed by them.