1. Introduction and Scope

JMT Works Ltd (“the Company”, “we”, “us”) is committed to protecting the privacy and security of personal data belonging to our customers, suppliers, contractors, and any other individuals we deal with in the course of our business as an MCS certified installer of Air Source Heat Pumps.

This policy explains what personal data we collect, why we collect it, how we keep it secure, who we share it with, and the rights individuals have over their data. It applies to all personal data processed by the Company, whether held electronically (including within EasyMCS) or on paper, and to everyone who processes data on our behalf, including external consultants.

This policy is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and to satisfy the data protection requirements set out in the MCS Installer Operating Requirements (clause 5.4) and the MCS Customer Commitment (clause 6.3).

2. Who We Are

Data Controller: JMT Works Ltd

• Company registration number: 14792702

• Registered address: 6 Sylvia Court, Wembley, England, HA9 6HS

• Contact for data protection queries: João Moreira Tavares, Director — info@jmtworks.co.uk / 020 4629 2899

As a small business, we do not have a dedicated Data Protection Officer. João Moreira Tavares, as Director and Licensee, holds overall responsibility for data protection compliance.

3. What Personal Data We Collect

Depending on our relationship with an individual, we may collect and process:

• Customer contact details: name, address, phone number, email address

• Property details: property type, energy usage, existing heating system, photographs taken during survey

• Contract and financial information: quotations, signed contracts, payment and invoicing details, deposit records

• Installation records: system design, performance estimates, commissioning data, MCS certificate details

• Communication records: emails, call notes, complaint records

• For suppliers/contractors: contact details, insurance and qualification records, contract terms

4. How and Why We Use Personal Data

We process personal data on the following lawful bases:

• Contract: to provide a quotation, carry out a survey, deliver an installation, and fulfil the terms of a customer contract.

• Legal obligation: to comply with MCS Scheme requirements (e.g. raising an MCS certificate within 30 days and retaining installation records for a minimum of six years), Building Regulations notifications, and tax/accounting law.

• Legitimate interests: to communicate with customers about their installation, manage our business records, and improve our services — carried out in a way that does not override individuals’ rights.

• Consent: where we ask to use contact details for marketing purposes, which customers may withdraw at any time.

5. Sharing Your Data

We share personal data only where necessary, and always with appropriate safeguards in place:

• MCS: customer contact details are provided to MCS when an MCS certificate is raised, so MCS can carry out its customer outreach and scheme monitoring activities, as required by the Customer Commitment.

• Our Certification Body: installation and customer records may be shared as part of compliance assessments.

• HIES (financial protection provider): relevant contract and installation details, to provide the customer’s guarantee/insurance-backed protection.

• External consultants: Fabio Carpene and Jerome Carasco, as external consultants providing administrative, documentation and QMS support, may access personal data strictly to carry out those support functions, under a confidentiality and data processing agreement. They do not use data for any other purpose.

• EasyMCS: our document management platform, used to store and manage customer and installation records securely.

We do not sell personal data, and we do not share it with any third party for their own marketing purposes.

6. Data Retention

We retain installation and customer records for a minimum of six years, in line with MCS Installer Operating Requirements. Some records (e.g. those relating to guarantees, warranties, or ongoing legal obligations) may be retained for longer where required. Records are reviewed periodically and securely deleted or anonymised once no longer needed.

7. How We Keep Data Secure

We take the security of personal data seriously and apply the following measures:

• Installation and customer documentation is stored within EasyMCS, a cloud-based platform with its own access controls and backup infrastructure.

• Access to records is limited to those who need it to perform their role — João Moreira Tavares (Director), and external consultants strictly for their agreed support functions.

• Paper records, where used, are kept in a secure location and disposed of securely (e.g. shredding) when no longer needed.

8. Your Rights

Under UK GDPR, individuals have the right to:

• Access the personal data we hold about them.

• Have inaccurate data corrected.

• Request erasure of their data, where applicable (this may be limited by our legal obligation to retain installation records for six years).

• Restrict or object to certain processing.

• Receive their data in a portable format, where applicable.

• Withdraw consent at any time, where processing is based on consent (e.g. marketing).

To exercise any of these rights, please contact João Moreira Tavares at info@jmtworks.co.uk. We will respond within one calendar month.

If an individual is unhappy with how we have handled their data, they also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Data Breaches

If we become aware of a personal data breach that poses a risk to individuals’ rights and freedoms, we will assess the risk and, where required, report it to the ICO within 72 hours and inform affected individuals without undue delay.

10. External Consultants and Data Processing Agreements

Where external consultants (currently Fabio Carpene and Jerome Carasco) access personal data in the course of providing administrative or documentation support, we have written confidentiality and data processing agreements in place with each, setting out the scope of data they may access, the purpose it may be used for, and their obligation not to use it for any other purpose, including sales, marketing, or customer-facing communication.

11. Cookies and Website

Our website, jmtworks.co.uk, uses Google Analytics (via Google Site Kit) to help us understand how visitors use our site, such as which pages are viewed and how visitors arrived at the site. This involves the use of cookies. Our website also includes a contact form, which collects your first name, last name, and email address so we can respond to your enquiry; this information is used only for that purpose. 

12. Review of This Policy

This policy was last reviewed in July 2026 and will be reviewed at least annually, or sooner if there is a significant change to how we process personal data.