1. Who we are
OneCloud Pvt Ltd, trading as Serving Foxes, is the data controller for the personal data described in this notice. We are registered with the Information Commissioner's Office (ICO) under registration number ZC130857.
| Company | OneCloud Pvt Ltd (company number 16991609, England and Wales) |
|---|---|
| Address | 160 London Road, Barking, IG11 8BB |
| Data protection contact | Data Protection Lead, hello@servingfoxes.co.uk · 020 4569 1189 |
When we pass your details to an energy supplier, lender, insurer, installer or other partner, that partner usually becomes a separate controller for its own use of your data and will give you its own privacy notice.
2. What we collect
We only collect what we need for your quote or application. Depending on the service, this may include:
- Contact and business details: name, job title, business name, phone, email, address, and the answers you give in our eligibility checker (such as the service you need, business type, time trading, turnover range and anything you tell us would make it easier to help you).
- Energy and utilities: site address, meter numbers (MPAN/MPRN), usage data, current supplier, contract dates, signatory details and bank details for direct debit.
- Business finance: details of directors and guarantors, dates of birth, address history, ID documents, bank statements, credit history and financial information.
- Insurance: claims history, details of key persons, and sometimes health information.
- Solar, heat pumps and grants: property details, EPC, photos of the property, and where a scheme requires it, benefits status, income, household composition and sometimes health conditions.
- Calls and messages: call recordings and the content of emails and WhatsApp messages.
- Website: IP address, device information and, with your consent, analytics cookies.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to quote requests and introducing you to partners | Steps you've asked us to take before a contract; legitimate interests for business contacts |
| Energy, broadband, water and payment comparisons and switches | Contract; legitimate interests |
| Business finance and insurance introductions | Steps before a contract; legal obligation for anti-money laundering checks |
| Solar, heat pump and grant applications | Steps before a contract; legal obligation where scheme rules require it |
| Recording calls for quality, training, compliance and resolving disputes | Legitimate interests (we tell you at the start of the call) |
| Handling complaints and ombudsman referrals | Contract; legal obligation |
| Marketing | Consent, or legitimate interests where the law allows (see section 8) |
| Publishing reviews and testimonials | Consent, before we publish any name or quote |
| Analytics cookies | Consent |
We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Lenders and insurers may use automated decision-making; their own privacy notices explain this and how to ask for a human review.
4. Health and other sensitive data
Some insurance products and grant schemes need health information. We only collect it where the product or scheme genuinely requires it, with your explicit consent or another lawful condition, and we restrict who can see it. We never ask you to send health information, ID or bank statements by WhatsApp or unencrypted email. Insurance and finance applications may ask about unspent convictions; we only use that information for that application.
If you tell us about circumstances that mean you need extra support, we'll ask your permission before recording it. See Need extra help?
5. Who we share your data with
We share your data only with people who need it to deliver what you've asked for:
- Energy, broadband, water and payment providers on our panel, to quote and complete switches or set-ups
- Lenders and finance providers, to assess and arrange funding
- Insurers and insurance intermediaries, to quote and place cover
- MCS-certified installers, certification bodies and grant scheme administrators, to survey, install, certify and claim funding
- Credit reference and fraud prevention agencies (usually through the lender), for identity, credit and anti-fraud checks
- The Energy Ombudsman, other ombudsmen and regulators, for complaints and regulatory obligations
- Our IT and service providers (CRM by HubSpot, website hosting and form handling by Netlify, address lookup by Ideal Postcodes, telephony and call recording, email, cloud storage, e-signature, WhatsApp Business and analytics), who act on our instructions under written contracts
- Professional advisers, auditors and insurers, and the police, HMRC or courts where the law requires
We never sell your personal data, and we don't share it with third parties for their own marketing without your consent.
6. Transfers outside the UK
Some of our software providers may store or access data outside the UK. We only allow this where the destination has UK adequacy regulations, where an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place, or where another lawful exception applies.
7. How long we keep your data
| Record | How long |
|---|---|
| Enquiries and quotes that didn't go ahead | 12 months from last contact |
| Energy, utilities and payment contracts arranged | 6 years after the contract ends |
| Finance files | 6 years after completion; anti-money laundering and ID records 5 years after the relationship ends |
| Insurance files | 6 years after the policy ends (longer for liability cover where claims may arise later) |
| Solar, heat pump and grant files | The scheme's audit requirement or the installation warranty period, whichever is longer |
| Call recordings | 12 months, or until a complaint is closed plus 6 years |
| Complaints and ombudsman cases | 6 years after closure |
| Marketing opt-outs | Kept so we can keep honouring your opt-out |
| Website analytics | 14 months |
8. Marketing
- Marketing is always optional. You don't have to agree to it to get a quote.
- We only email or text sole traders, partnerships and householders with their prior consent, or about similar services if they're already a customer, with an easy opt-out in every message.
- We screen numbers against the Telephone Preference Service (TPS and CTPS) and our own suppression list before calling, and we never withhold our caller ID.
- We don't make automated marketing calls without specific consent, and we don't cold-call households about home energy improvements.
- We honour opt-outs within 48 hours. To opt out, reply STOP, use the unsubscribe link or email hello@servingfoxes.co.uk.
9. Your rights
You have the right to:
- Access a copy of the personal data we hold about you
- Correct inaccurate data (we'll tell anyone we've shared it with)
- Erase your data where we no longer have a lawful reason to keep it
- Restrict our use of it while we check accuracy or an objection
- Portability of data you gave us, in a machine-readable format
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent at any time, as easily as you gave it
To use any of these rights, contact us by phone, email, letter or WhatsApp. It's free, and we'll respond within one month (or tell you within that month if we need up to two more months for a complex request). We may ask for proportionate proof of identity.
10. Keeping your data secure
We use multi-factor authentication, role-based access, encryption of devices and stored data, encrypted transfer for ID, bank and health documents, company-managed devices, and regular patching and backups. If a data breach is likely to put you at high risk, we'll tell you without undue delay.
11. Cookies
Cookies are small files stored on your device. We use:
| Type | Purpose | Consent needed? |
|---|---|---|
| Essential | Remembering your cookie choice. Our eligibility checker and address finder don't set cookies. | No |
| Trustpilot review widget | Shows our Trustpilot rating and lets you leave a review. Trustpilot may set its own cookies; see Trustpilot's privacy and cookie policies. | Set by Trustpilot |
| Analytics (Google Analytics) | Understanding how visitors use the site so we can improve it. Only loaded if you click "Accept analytics". | Yes |
You can change your choice at any time using Cookie settings, or by clearing cookies in your browser.
12. Questions and complaints
If you have a question or concern about how we use your data, contact us first. We acknowledge data protection complaints within 30 days and will tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.