Privacy Policy

Last updated: 22 April 2026

This notice explains how 24H Plumbing collects and uses your personal information when you visit our website, fill in our contact form, or call us about a plumbing job.

If anything is unclear, please email us at [email protected] and we will explain.

1. Who we are

24H Plumbing is a trading name of Khaitco Plumbing Ltd, a company registered in England and Wales.

We are the data controller for the personal information described in this notice. That means we decide what data we collect about you and what we do with it.

2. What personal information we collect

We collect personal information in three ways: when you contact us, when you use our website, and when we deliver a job.

When you contact us through the website form:

  • Full name

  • Phone number

  • Email address

  • Postcode

  • Service you need (boiler, blocked drain, leak, and so on)

  • Anything else you write in the message field

When you call the phone number on our adverts or website:

  • Your phone number (passed by your network in the normal way)

  • The fact that you called, the time, and how long the call lasted

  • A recording of the call (see Section 9 for details)

  • Anything you tell us during the call so we can quote and dispatch a plumber

The phone number shown on our Google adverts is a Google forwarding number. Google routes the call and shares the call metadata (number, time, duration) with us through Google Ads. The call itself is then handled through CircleLoop, our telephony provider, which records the audio. Sections 4 and 9 explain who sees what.

When you visit our website:

  • IP address

  • Browser type and version

  • Device type and operating system

  • Pages you visited and how you arrived (for example, which advert you clicked)

  • Cookie identifiers and similar technology

When we deliver a job:

  • Service address

  • Job details, photos taken on site, parts used, time spent

  • Payment details (handled by our payment processor; we do not store full card numbers)

We do not knowingly collect personal information from children under 16.

3. How we use your information and our legal basis

UK GDPR requires us to tell you why we use your data and which of the six lawful bases we rely on. For each purpose below we list the data used and the legal basis.

Quote, dispatch a plumber, and complete the job you asked for. Data used: contact details, address, job description, on-site notes. Legal basis: contract (Article 6(1)(b)).

Reply to enquiries and callbacks before any job is booked. Data used: contact form data, call recording metadata. Legal basis: pre-contract steps under Article 6(1)(b).

Take payment and issue an invoice. Data used: name, address, payment details. Legal basis: contract (Article 6(1)(b)) plus legal obligation for tax records (Article 6(1)(c)).

Keep records for HMRC and accounting. Data used: invoices, payment records. Legal basis: legal obligation (Article 6(1)(c)).

Measure which adverts and pages bring in plumbing jobs, including uploading job outcomes back to Google Ads (see Section 4). Data used: click identifier (gclid), conversion event, job value. Legal basis: legitimate interest under Article 6(1)(f), namely running cost-effective advertising.

Block click fraud on our paid search adverts. Data used: IP address, click metadata. Legal basis: legitimate interest under Article 6(1)(f), namely preventing budget waste.

Send marketing emails, SMS, or WhatsApp messages about plumbing offers (only if you tick the box or ask us). Data used: email, phone, name. Legal basis: consent under Article 6(1)(a). You can withdraw consent at any time.

Respond to complaints, legal claims, or insurance work. Data used: whatever data is relevant. Legal basis: legitimate interest under Article 6(1)(f) and legal obligation under Article 6(1)(c).

If we ever rely on legitimate interest, we have weighed your privacy against our business need and concluded the use is reasonable and proportionate. You can object at any time (see Section 7).

Is providing your data optional? Filling in the contact form or telling us your address on a call is required to book a plumbing job. Without that information we cannot quote, dispatch a plumber, or invoice you. Marketing consent is always optional and you can refuse it without affecting the service we provide.

4. Who we share your information with

We share data only with parties who help us run the business. We do not sell your data. For each recipient below we list the purpose, the data shared, and the country where they process it.

Our plumbers and engineers attend the job. They receive your name, address, phone, and job notes. Processed in the United Kingdom.

Subcontracted heating engineers carry out gas and boiler work that we pass to a partner firm. They receive your name, address, phone, and job notes. Processed in the United Kingdom.

GoHighLevel (HighLevel Inc.) is our CRM and holds the record of your lead, job, and pipeline. It receives all form and call data. Processed in the United States.

Google Ireland Ltd runs Google Ads, Google Analytics, and the Google Ads call forwarding number. It receives click identifiers, IP addresses, cookies, job value for completed conversions, and call metadata. Used for ad measurement, retargeting, call routing, and offline conversion uploads. Processed in the EU and United States.

CircleLoop (Damson Cloud Ltd) is our business telephony provider. It receives your phone number, call audio, and call metadata. Processed in the United Kingdom.

WhatsApp (Meta Platforms Ireland Ltd) is used to send plumbing offers where you have given us your number and opted in. It receives your name, phone number, and message content. Processed in the EU and United States.

ClickCease (CHEQ AI Technologies) detects and blocks fraudulent ad clicks. It receives your IP address, browser fingerprint, and click metadata. Processed in the EU and Israel.

CookieYes (Speed Wagon Inc.) records your cookie consent choice. It receives the consent record, IP address, and timestamp. Processed in the EU and United States.

Square (Block Inc.) processes card payments and online payment links. It receives card data (Square tokenises the card so we do not receive the full card number), billing email, amount, and order reference. Processed in the EU and United States.

Revolut Ltd and Virgin Money (Clydesdale Bank plc) hold our business bank accounts. When you pay us by bank transfer they see your name, account number, sort code, and payment reference. These banks process your payment under their own regulatory obligations, not as our GDPR processors.

Xero (Xero Ltd) is the accounting software used by our accountant for bookkeeping and tax filing. It receives invoice data (name, address, job summary, amount). Processed in the European Union and New Zealand.

HMRC, courts, and regulators receive whatever the law requires, when the law requires it. Processed in the United Kingdom.

We have written contracts with the processors above that meet the requirements of UK GDPR Article 28.

Specific note on Google Ads offline conversions: when a job we quoted from a website lead or call goes ahead, we send the click identifier (gclid) and the job value back to Google Ads so we can see which adverts produced real work. The upload contains the click identifier and the job value in GBP. It does not contain your name, address, phone number, or email.

Specific note on Google call forwarding: the phone number on our paid adverts is provided by Google. Calls to that number are forwarded through Google to our CircleLoop business line. Google sees the call duration and timestamp linked to the advert click, but Google does not receive the call audio. See Section 9 for how the call audio itself is handled.

5. International transfers

GoHighLevel, parts of Google's services, CookieYes, and ClickCease are based outside the UK. The UK Information Commissioner's Office recognises the United States as having an adequate data protection framework where the recipient is certified under the UK Extension to the EU-US Data Privacy Framework. Where a transfer relies on UK Standard Contractual Clauses or the International Data Transfer Agreement, we have those in place with each processor.

You can request a copy of the safeguards we use by emailing [email protected].

6. How long we keep your information

We keep personal data only as long as we need it for the purpose we collected it.

  • Enquiry that did not turn into a job: 1 month from last contact, then deleted from the CRM.

  • Customer records (booked or completed jobs): 6 years after the last job, to match the HMRC accounting record requirement.

  • Invoices, payment records, VAT records: 7 years (legal obligation under HMRC rules).

  • Call recordings: 3 months, held by CircleLoop and then deleted.

  • Marketing consent records: until you withdraw consent, then deleted within 30 days.

  • Website cookie data: individual cookie lifetimes range from session-only to 13 months. The CookieYes panel lists each one.

  • Call metadata received via Google Ads: as long as Google retains it under its own policies.

  • Click-fraud detection logs (ClickCease): per ClickCease retention, currently 12 months.

After the retention period ends, we either delete the data or anonymise it for statistics.

7. Your rights

Under UK GDPR you have the right to:

  • Be informed about how we use your data (this notice does that)

  • Access the personal data we hold about you

  • Rectify anything that is wrong or incomplete

  • Erase your data where one of the grounds in Article 17 applies

  • Restrict how we use your data while a query is resolved

  • Portability of data you gave us, in a structured machine-readable format

  • Object to processing based on legitimate interest, including profiling

  • Withdraw consent at any time where we relied on consent (this does not undo processing we did before you withdrew)

  • Avoid solely automated decisions that have a legal or similarly significant effect on you. We do not make any such decisions.

To use any of these rights, email [email protected] with enough detail for us to identify you and what you want. We will respond within one calendar month. We may ask for proof of identity to protect your data.

8. Cookies and similar tracking

Our website uses cookies and similar technologies (pixels, local storage, device identifiers) to make the site work, measure how it is used, and run advertising.


We split cookies into four categories under our consent banner (powered by CookieYes):

  • Necessary cookies make the site and the form work. These do not need consent.

  • Analytics cookies (Google Analytics 4) tell us how many visitors arrive and which pages they read. We set these only if you accept.

  • Advertising cookies (Google Ads) let us measure which advert brought you to the site and show you relevant ads on other sites. We set these only if you accept.

  • Functional cookies remember your preferences. We set these only if you accept.


You can change or withdraw your cookie choice at any time using the cookie button in the page footer. The CookieYes panel on every page lists every cookie we use, what it does, who sets it, and how long it lasts. CookieYes scans our site and updates that list automatically.

9. Calls to us

Calls to any of our numbers are handled through CircleLoop, a UK-based business telephony provider (operated by Damson Cloud Ltd). CircleLoop records every call and stores the audio for 3 months, after which the recording is deleted. During that period we may listen to recordings for quality assurance, to verify the quote we gave you, and to handle any dispute or complaint.

The phone number shown on our Google adverts is a Google forwarding number. Calls to it are routed by Google to our CircleLoop line. Google sees the call duration and the timestamp linked to your advert click but does not receive the call audio.

Legal basis for call recording: legitimate interest under Article 6(1)(f) (training, quality, evidence of the quote agreed, dispute resolution). If you do not want your call recorded, you can email your enquiry to [email protected] or ask the engineer to call you back from a personal mobile.

10. Marketing

We will only send you marketing about plumbing offers, seasonal reminders (boiler servicing, pipe insulation), or new services if you have ticked the marketing consent box on the form or asked us by email, phone, or WhatsApp.

We may contact you by email, SMS, or WhatsApp. WhatsApp messages are sent through WhatsApp Business and are covered by Meta's own processing of the message in transit (see Section 5 on international transfers).


You can opt out at any time by:

  • Clicking "unsubscribe" in any marketing email we send you

  • Replying STOP to any marketing SMS

  • Replying STOP or blocking our number on WhatsApp

  • Emailing [email protected]


Opting out of marketing does not stop service messages about a job you have booked.

11. Complaints and contact

Please let us put things right first. If you have a privacy concern, email [email protected] and we will respond within one calendar month.

If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office:

12. Changes to this notice

We will update this notice when our processing changes or when guidance from the ICO changes. The "Last updated" date at the top of the page shows the current version. For changes that materially affect how we use your data we will post a notice on the homepage for at least 30 days.

If you have an active job with us at the time of an update, we will email you a summary of what changed.