| Data controller | OneCloud Pvt Ltd, trading as Serving Foxes |
|---|---|
| Company number | 16991609 (registered in England and Wales) |
| Registered office | 160 London Road, Barking, IG11 8BB |
| ICO registration | ZC130857 |
| Data protection contact | Data Protection Lead, hello@servingfoxes.co.uk · 020 4569 1189 |
| Version | 1.0 · 13 October 2026 · next review October 2027 |
1. Purpose, scope and legal framework
This policy explains how OneCloud Pvt Ltd, trading as Serving Foxes, collects, uses, shares, protects and disposes of personal data in line with UK data protection law. Compliance is mandatory for everyone within its scope: all directors, employees, contractors, agents, introducers, temporary staff and volunteers who handle personal data on our behalf, wherever they work.
It covers all personal data we process in any format (digital, paper, phone recordings, WhatsApp and other messaging, CRM and email) about prospective and existing customers (including sole traders, partners, directors and named contacts), householders applying for solar, heat pumps or grants, website visitors, guarantors and key persons named in applications, partners' staff, and our own employees, applicants and contractors.
It is based on the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the Data (Use and Access) Act 2025, and guidance from the Information Commissioner's Office (ICO).
2. Roles, responsibilities and definitions
| Role | Responsibilities |
|---|---|
| Board of Directors | Approves this policy, resources compliance, receives an annual data protection report, signs off high-risk processing |
| Data Protection Lead | Maintains the Record of Processing Activities, handles rights requests and complaints, manages breaches, runs impact assessments, reviews supplier contracts, liaises with the ICO, delivers training |
| Heads of each service line | Make sure their team's processes, scripts and forms follow this policy |
| IT / systems owner | Access control, encryption, backups, device management, security incident response |
| All staff and contractors | Follow this policy, complete training, report breaches and rights requests immediately, ask when unsure |
We are not currently required to appoint a statutory Data Protection Officer, because our core activities do not involve large-scale monitoring or large-scale special category data. The Board reassesses this each year.
Our role. We are a controller for our own customer, lead, marketing and HR data. When we pass a customer's details to an energy supplier, lender, insurer or installer, that partner usually becomes a separate controller. Software and service providers we use (such as CRM, telephony, email, website hosting and address lookup) are our processors.
3. Data protection principles
| Principle | What it means at Serving Foxes |
|---|---|
| Lawfulness, fairness and transparency | Every activity has a lawful basis. Forms, call scripts and WhatsApp replies explain or link to our Privacy Notice. We never mislead people about who we are or that we are paid commission by suppliers. |
| Purpose limitation | Data collected for one quote is used for that quote and related servicing. Using it for a different service line needs a compatible purpose or consent and must respect marketing rules. |
| Data minimisation | We collect only what a quote or application genuinely needs. We do not ask for bank details, ID or health information "just in case". |
| Accuracy | We confirm details with the customer before submitting to a partner, and correct errors promptly. |
| Storage limitation | We keep data only for the periods in section 8, then delete or anonymise it. |
| Integrity and confidentiality | We protect data with appropriate technical and organisational measures (section 7). |
| Accountability | We keep records of processing, lawful basis assessments, impact assessments, consents, contracts, training and breaches. |
4. Personal data we process and lawful bases
| Activity | Typical personal data | Lawful basis |
|---|---|---|
| Quote requests (website, phone, email, WhatsApp) | Name, job title, business name, phone, email, address, eligibility checker answers | Steps prior to a contract at the person's request; legitimate interests for business contacts |
| Energy, broadband, water and payment comparisons and switches | Site address, MPAN/MPRN, usage data, current supplier and contract dates, bank details for direct debit, signatory details | Contract; legitimate interests |
| Business finance introductions | Directors' and guarantors' details, address history, ID documents, bank statements, credit history, financial information | Steps prior to a contract; legal obligation for anti-money laundering checks |
| Insurance introductions | Contact details, claims history, key person details; sometimes health information | Steps prior to a contract; plus an Article 9 condition for health data |
| Solar, battery, heat pump and grant applications | Property details, EPC, property photos, benefits status, income, household composition; sometimes health conditions | Steps prior to a contract; legal obligation where scheme rules require it; Article 9 condition for health data |
| Consulting introductions | Contact details, business information | Contract |
| Call recording | Voice, call content | Legitimate interests (callers are told at the start) |
| Complaints and ombudsman referrals | Contact details, complaint details, correspondence | Contract; legal obligation |
| Marketing | Name, email, phone, business name, preferences | Consent or legitimate interests, subject to PECR |
| Website and cookies | IP address, device data, cookie identifiers, analytics | Consent for non-essential cookies |
| Reviews and testimonials | Name, business, review content | Consent before publishing |
| HR and recruitment | CVs, contracts, payroll, right-to-work, absence, performance | Contract, legal obligation, legitimate interests |
Legitimate interests. Before relying on legitimate interests we complete a Legitimate Interests Assessment (purpose, necessity and balancing tests).
Consent. Consent must be freely given, specific, informed and unambiguous, given by a clear positive action (no pre-ticked boxes), recorded, and as easy to withdraw as to give.
Special category data. We collect health and other sensitive data only where a product or scheme genuinely requires it, under explicit consent or another Article 9 condition, with an Appropriate Policy Document where required. Access is restricted, and such data is never sent over WhatsApp or unencrypted email.
Criminal offence data. Insurance and finance applications may ask about unspent convictions. We process this only for that application, under a DPA 2018 Schedule 1 condition.
Children. Our services are for businesses and adult householders. We collect the minimum about children only where a grant application requires household composition.
Automated decisions. We do not make decisions with legal or similarly significant effects based solely on automated processing. Lenders and insurers may; their privacy notices explain this.
5. Sharing, processors and international transfers
We share personal data only with recipients who need it to deliver what the customer asked for, under a written agreement:
- Energy, broadband, water and payment suppliers on our panel (separate controllers)
- Lenders, finance providers, insurers and insurance intermediaries (separate controllers)
- Solar and heat pump installers, certification bodies and grant scheme administrators
- Credit reference and fraud prevention agencies, usually through the lender
- The Energy Ombudsman and other ombudsmen or regulators
- IT and service providers such as CRM, telephony and call recording, email, cloud storage, e-signature, WhatsApp Business, website hosting and form handling, address lookup and analytics (our processors)
- Professional advisers, auditors and insurers; police, HMRC or courts where the law requires
We never sell personal data, and we do not share leads with third parties for their own marketing without consent. We send only the data a recipient needs, use secure portals or encrypted email for ID, bank and health documents, have Article 28 contracts with every processor, carry out due diligence before onboarding suppliers, and check that leads from introducers were collected lawfully.
International transfers. Personal data may only leave the UK where the destination has UK adequacy regulations, an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place with a transfer risk assessment, or a specific Article 49 exception applies.
6. Individuals' rights
Any request about personal data, however it arrives, is passed to the Data Protection Lead the same working day. We support the rights to be informed, access, rectification, erasure, restriction, portability, objection (including stopping direct marketing immediately), and rights around automated decision-making.
- We verify identity proportionately and do not demand excessive ID.
- We respond without undue delay and within one month, extendable by two further months for complex requests (we tell the person within the first month).
- Requests are free unless manifestly unfounded or excessive, and every request is logged.
We acknowledge data protection complaints within 30 days, investigate them, and tell the person the outcome and their right to complain to the ICO (ico.org.uk, 0303 123 1113).
7. Security and personal data breaches
We protect personal data with measures proportionate to the risk, including multi-factor authentication on email, CRM, cloud storage and telephony; role-based access; encryption of devices and stored data; encrypted transfer of ID, bank and health documents; company-managed devices; WhatsApp Business only on company accounts; clear desk and screen locking; confidential shredding; regular patching, anti-malware and tested backups; removal of leavers' access on their last day; and an annual review against Cyber Essentials as a minimum.
Any suspected breach is reported to the Data Protection Lead immediately. We contain it, assess the risk, notify the ICO within 72 hours where there is a risk to individuals, tell affected individuals without undue delay where the risk is high, notify affected partners, and record every breach in our breach log.
8. Retention
| Record | Retention period |
|---|---|
| Enquiries and quotes that did not proceed | 12 months from last contact |
| Energy, utilities and payment contracts arranged | 6 years after the contract ends |
| Finance files | 6 years after completion; AML / ID records 5 years after the relationship ends |
| Insurance files | 6 years after the policy ends (longer for liability covers where claims may arise later) |
| Solar, heat pump and grant files | The scheme's audit requirement or the installation warranty, whichever is longer |
| Call recordings | 12 months, or until a complaint is closed plus 6 years |
| Complaints and ombudsman cases | 6 years after closure |
| Marketing consent and suppression list | While marketing continues; suppression list kept so opt-outs are honoured |
| Website analytics | 14 months |
| Unsuccessful job applicants | 6 months after the decision |
| Employee records | 6 years after employment ends |
9. Marketing
- Limited companies and LLPs: emails and texts are permitted without prior consent if the person is identified, the message is relevant to their role, and every message has a simple opt-out.
- Sole traders, partnerships and householders: only with prior consent, or under the "soft opt-in" for existing customers, with an opt-out at collection and in every message.
- Calls: we screen every number against TPS, CTPS and our own suppression list and never call registered numbers without specific consent. We never make automated calls without specific prior consent, and always display our caller ID.
- We honour opt-outs within 48 hours, and we check current ICO and government rules before any campaign to householders about home energy improvements.
10. Privacy by design and governance
We consider data protection at the start of any new service, system, supplier or campaign. A Data Protection Impact Assessment is completed before processing special category data at scale, introducing new technology such as AI call analysis or automated lead scoring, combining data across service lines at scale, or any other high-risk processing. If a high risk cannot be reduced, we consult the ICO first.
We pay the ICO data protection fee annually, train all staff at induction and every year (sales and call teams also complete PECR training), and review this policy every 12 months or sooner if the law, ICO guidance or our services change. Breaching this policy may lead to disciplinary action, and deliberately or recklessly obtaining or disclosing personal data without authority can be a criminal offence under section 170 of the Data Protection Act 2018.