If you are interested in Vaillant products or services, then we will collect some personal data from you when you first make contact with us so that we can assist you, such as your name, phone or email and what your enquiry is about.

In many cases, we will collect your name, address, phone number, email address, and your Vaillant product model and serial number, date of installation, when your product is registered for our guarantee. There are 3 ways that products can be registered with us:

1. You call us to register your product, sometimes the registration call will be taken by a third party who we work with such as Domestic & General and they will collect your details, register the product, and send your data to Vaillant;

2. You use our online product registration process; or

3. Your local installer will pass your registration details to Vaillant after they install the heating product.

For more information about how we use your personal data during and after registering your Vaillant Products, please see the section titled:

Product registration & guarantee

Vaillant do not buy or sell names and addresses, so it’s unlikely we would obtain your personal data in any other way.

Under data protection law, we must have a legal basis to process your personal data, Vaillant process under one of the following basis:

1. CONSENT

e.g., usually, we rely on your consent to process your personal data in relation to direct marketing and advertising of our products and services to you (where you haven’t made enquiries to us first) and website cookies that are not necessary for the functioning of the website e.g. tracking and advertising. You can withdraw your consent to this processing at any time.

2. THE INITIATION OR PERFORMANCE OF A CONTRACT WITH YOU OR THE STEPS TAKEN PRIOR TO ENTERING INTO A CONTRACT

e.g., Where you are an existing customer or professional Partner of ours, we will be processing your personal data in performing our obligations under the contract with you or if we have not been contacted by you before, many of our services require us to process your personal data prior to entering a contract with you, in both cases, we process your information to enable us to provide our services.

3. LEGITIMATE INTERESTS PURSUED BY US OR BY A THIRD PARTY

e.g., where we process your personal data for our own business purposes, e.g. product monitoring, service quality, handling complaints, statistical use etc. this is being processed for the purposes of the legitimate interests pursued by us or by a third party.

4. COMPLIANCE WITH A LEGAL OBLIGATION.

We may need to process or share your personal data where we have a legal obligation that we are required to comply with, an example might be the police or emergency services, insurance investigations and court orders.

5. VITAL INTERESTS

We will share your personal data where it is necessary to protect the vital interests of you or a third party.

In particular, we process your personal data in order to answer your enquiries, to provide assistance in using our website, products and services, to prepare or conclude repair, maintenance and other service contracts, to provide you with requested information or services via our website or other means, to adapt our internet offers, products and services to your interests or to improve them and to support the marketing of our products and services. Specific details of the legal basis we rely on for each of our products and services can be found in the relevant product and service sections to follow.

Occasionally, as a one-off piece of work, we ask a third-party (currently Experian based in the UK) to provide us with a profile of a typical Vaillant customer so that we can more accurately target new customers with similar profiles that are likely to be aligned with the characteristics of our brand. E.g. Experian might tell us; existing customers in X profile generally listen to online music streaming services. Using that profile information Vaillant might then run a marketing campaign on Spotify to attract more customers matching that profile. To create the profiles, Experian require a selection of our current customer addresses (no other personal data is provided), from this Experian will use their own data within a system called Mosaic (more information can be found at www.experian.co.uk/business/platforms/mosaic ) to understand what the most likely main characteristics of people at those addresses are.

Our lawful basis for using existing customer addresses to gain these insights is our legitimate interests, in that it is legitimate for a business to seek to attract new customers, and understanding the likely characteristics of existing customers by profiling their address will mean the marketing messages we send and how we send them, will be aimed at the most likely future customers of Vaillant through the most successful channels.

We of course do not delete your address from your Vaillant product account after this work is done as we need it for your product registration and any repairs/service/queries. However, Experian will not retain your address as notified by Vaillant once the profiling has been completed. Please note that as a credit reference agency Experian independently holds data on millions of UK individuals and households and their use of that data is subject to their own privacy policies.

Market Segmentation

We use existing customer postcode data in market segmentation software (supplied by TransUnion or Experian) to understand what the average characteristics of Vaillant customers are and where they are located around the UK e.g. (i) to identify key customer characteristics who purchase from us (ii) typical customer lifestyle preferences (iii) and likely customer behaviours towards heating industry products and services. We use this market segmentation service to better target our national Tv, Radio, and internet marketing activities around the UK. Please be assured we do not profile individual customers, nor do we use your postcode in the market segmentation software to send you direct advertising. Please see separate section of this privacy notice ‘Electronic advertising’ to understand the limited circumstances where we could advertise directly to you. Our lawful basis for using your postcode data for market segmentation is our legitimate interests, in that it is legitimate for a business to seek the best use of its marketing budget and activities to optimise our business and improve the relevance for our existing and future customers. We will periodically re-assess our key customer profiles and update to the latest market segmentation to keep the information we obtain from that market segmentation up to date. As your postcode is part of the data in your boiler registration account, we will retain it in accordance with the retention period for the section in this privacy notice covering Product Registration.

You can browse our website without identifying yourself or registering with us. However, even when you browse our website, your device transmits data, classed as personal data, to us via your browser that is technically necessary to establish the connection and use our website. This includes, the date and time of the connection, your IP address, requested web pages and downloaded files, data on the transmission and use of the website, information on the browser and browser settings, operating system and device and the internet address from which you accessed our site. We use this information to ensure the security of our web pages, to measure the effectiveness of internet advertising, to compile statistics and to measure the activities on the website with the aim of improving our offer.

Our website uses cookies to collect much of this information, more information is available in the section titled; Cookies, analysis tools, tracking and targeting

Our website provides links to some of our apps available in AppStore that offer personalised services. These personalised services require you to provide us with your personal data, so that you can use the respective service and systems, to register or so that we can contact you to provide the information or services that you requested. For example, MYVAILLANTAPP asks for your login name, email, and Wi-Fi access as a minimum, optionally you may also provide the ambient temperature, energy consumption, heating schedules, etc. for your home for more sophisticated functions of the personalised services to work e.g. local weather compensation data relies on having your location.

Other apps we provide access to are V Smart, Senso, VRC700 all available on AppStore.

When we ask you to provide us with personal data in the apps, we will indicate whether it is necessary to provide the service. Required information is marked with an asterisk (*). All other information you provide to us is voluntary to enhance the personalised service to you.

Our lawful basis for processing your personal data in respect of personalised services, is the performance of a contract with you (since you will accept the terms and conditions for the app when you register) or the steps required prior to entering a contract with you.

We retain the personal data required for the services for as long as you are registered on the app and thereafter for as long as required and permitted by law.

If you are already a customer of ours, we may also be able to associate and link your app registrations with your existing customer account.

Third parties may have access to your personal data in an app where the apps are created or hosted by another business or our Group Companies. The third parties responsible for our apps are Google Analytics in the EU and USA, Crashlytics, also owned by Google, and the Vaillant Group Head Office in Germany.

Our website allows you to search for your local Vaillant installer who can install, repair, or service Vaillant products. You can use this search without entering any personal data entering only a city, your approximate browser geo-location, or postcode area. However, you can also enter your exact address. The sharing of your city, approximate browser geo-location, or postcode area, or address (“Location Data”) is voluntary and so our lawful basis to use it is your consent. We will not retain your Location Data.

When the local installer search results display, you can make contact directly or you have an option for us to send your name, email address and what your enquiry is to your chosen installer(s) and ask them to contact you. In this case you will provide your name, address, postcode, contact number and email address and our website will send this as an email to the installers for you, please note you will not receive confirmation of the email being sent.

Our lawful basis for processing your personal data in your enquiry form is our legitimate interests which are to provide customers with this add-on service. Vaillant do not store the sent email or record it on an account for you, it will remain in our email server but it is not accessible by anyone at Vaillant.

Our website allows you to make an enquiry to a local tradesperson/installer who can quote for installation of a Vaillant product. By clicking on the Get a Quote from a local Installer, you will complete an enquiry form with your name, email and telephone number and the details of your requirements (we call this your “Enquiry Form Data“).

The enquiry form is then used by our UK team to match your enquiry with a local tradesperson. When the local tradesperson receives your enquiry they can accept it or reject it in our system. If the tradesperson accepts your enquiry, they will make contact with you to arrange an install quote. Vaillant will also share the tradespersons details with you. If the tradesperson rejects your enquiry, they can no longer see your enquiry form or your personal data and Vaillant will identify another tradesperson who we know will accept your enquiry and forward your enquiry form to them following the same process.

We will also send you a survey about your experience using the ‘Get a Quote from a local Installer’, to understand how it can be improved, and whether you purchased one of our products as a result of using the tool, and if not, what influenced you to go with a different brand. You always have the choice about whether to complete any surveys we send you or not.

Our lawful basis for processing your Enquiry Form Data as set out above is our legitimate interests which are to provide customers with this service and the swift resolution to any enquiry you make about our products, and to ensure the service is working for our customers. We will save your Enquiry Form Data in our customer database Salesforce hosted by our Head Office Vaillant GmbH in Germany for no more than 12 months from your enquiry, this is to enable us to support any questions you might have about your enquiry.

If for any reason your enquiry form doesnt submit, we use a cookie to note the postcode you provided (Cookie Data) to help us better understand areas where customers who are interested in the Vaillant brand are located. Our lawful basis for processing your Cookie Data is your consent which is collected via our cookie consent banner when you first use our website, and this can be changed at any time. You can also delete cookies in your browser settings. You can find out more about cookies and how long they last in the below section titled Cookies, analysis tools, tracking and targeting.

The careers link on our website will take you to the Vaillant GmbH website hosted in Germany to view vacancies across our whole group. As this website is not operated by Vaillant Group UK your continued use of it will be subject to that website’s privacy notice.

If you have any concerns about anyone or anything in our business acting unlawfully, you can use the whistleblowing link on our website, this will take you to the Vaillant GmbH website hosted in Germany and the BKMS logging system. As this website is not operated by Vaillant Group UK your continued use of it will be subject to that website’s privacy notice.

If you are a professional installer or repairer of our products, you can become a member of our loyalty scheme (known as Vaillant Advanced) by using the link on our website homepage ‘Professionals’. By clicking Log-in as an existing member, or the ‘Sign-Up’ link you will be transferred to the website www.Vaillant-Advanced.co.uk and your continued use of the Advance website will be subject to the separate privacy and cookie notice on the Advance website and a separate cookie consent will be obtained. From September 2025 all information for our professional customers such as product information, training, loyalty reward scheme, offers and support will be available through our re-launched My Vaillant Pro website or app.

We provide several ways to contact us as set out on the website:

1. by telephone;

2. by email; or

3. by filling in our website contact form.

In each case, we will ask you to provide us with your name, address and phone or email contact details, where applicable details of the Vaillant product, customer number, order number and any details describing your concern. We use your personal data to process your request, to answer questions about our products and services, to accept your orders, to arrange appointments, to document services provided or to invoice for services. If you have provided us with your telephone number, mobile number, or email address, we will use this to communicate with you regarding your request until the order has been completed. This also includes messages via email or SMS to confirm or remind you of appointments or to send email confirmation following a service visit. If your enquiry is about purchase and installation of a new Vaillant product we will pass your enquiry form to our third party RIPPL in the UK, who will use your postcode to refer your enquiry to approximately 3 third party installers from the ‘Local Vaillant Installer Search’ on our website (more information on how we use your data in the Local Vaillant Installer search is shown in that section above).

NEW - When it is particularly busy, and in order to reduce call wait times, we use the services of third party call handlers, currently these are Answer4U, and Moneypenny, both have a team of call handlers who are trained to use Vaillant’s phone and customer database and are capable of making service and repair bookings, as well as most things our own employees can do for you. They will only have access to our customer’s accounts whilst they are logged in and taking calls.

UPDATED For general enquiries made on our website contact form, your information will be handled by Microsoft who provide our email services, and our third-party integrated supplier Vonage, whose systems will add your enquiry into our customer database and ensure one of our contact centre agents is allocated your enquiry and responds to you.

Our lawful basis for collecting your personal data when you get in touch with our contact centre is our legitimate interests in as far as we aim to provide excellent customer service by responding to your request, and if you request services, become, or are already a customer of ours, then our lawful basis is that it is necessary for the performance of a contract we have with you.

We will retain your personal data in respect of contact us queries, complaints, orders, and servicing etc. in the product registration account for as long as you have a Vaillant product under a guarantee and thereafter for the purposes of the Gas safe registration scheme and for us to provide and manage the product and services. If you no longer have a Vaillant product or you have moved house, you can ask us to remove your details from the product registration account.

UPDATED Service Reminders

If you book a service or repair with Vaillant, we will automatically send you a reminder just prior to the anniversary of the installation date, so that you are able to re-book your annual service in good time to maintain your product guarantee (where this is still in place) and to ensure the safety of your product. We use a third party Essendex based in the UK to send SMS messages for annual service reminders, and they will be provided with your phone numbers only to do this task, once the messages are sent Essendex delete your phone number. Our lawful basis for sending service reminders is our legitimate interests, in that it is legitimate to support those customers who choose to use Vaillant for their servicing to maintain the validity of their guarantee and safety of their product. A record of your services with Vaillant is kept on your product registration account until the product is replaced and destroyed. However, you can opt to stop receiving service reminders by replying STOP to the SMS message, or by contacting us at dataprotectionUK@vaillant-group.com

Consent – Electronic Marketing

When you contact us, we may also ask you if you object to receiving certain marketing communications from us. If you do not object, then our lawful basis for use of your personal data for sending marketing communications to you electronically is your consent. Please see the separate section Electronic Advertising below for more details on this.

Call recordings and surveys

We also record calls which will contain your personal data such as name, address, and phone number when checking your ID. You may also be asked if you would be happy to complete a customer survey at the end of a call, but this is entirely optional and your responses will be pseudonymised (name removed but your call-in phone number might remain). Call recordings are collected using our telephony system and are held by our third-party telephony provider (Vonage) their data centre storing the recordings is in the UK and they only process your personal data on our instructions.

Our lawful basis to make the call recordings and seek customer survey participation is our legitimate interests, namely, training, quality assurance, claim and complaint management. For service calls we retain the recordings for a maximum of 6 years. For any other calls we retain the recordings for 1 year.

If you use the ‘Press Office’ link on our website and fill in an email form, these forms go directly to our Marketing Agency (Bright McCann) based in the UK who will provide you with their own privacy notice. We do not hold or process your personal data ourselves in this situation unless our Agency subsequently seeks to discuss your matter with us, in which case we will only use any personal data provided to answer the questions from our Agency.

You can request information about our services and products to be sent to you by email or by post. For this purpose, you can fill in an enquiry form relating to literature requests under the ‘Contact Us’ page on our website and provide details of the information you require and your name, email address and/or postal address.

These enquiry forms go directly to a third party (Staci UK) to handle on our behalf. Staci UK will only use your personal data to provide the requested information, but your personal data will be visible on any envelopes or parcels that they send to you. However, if you raise any questions, or place any orders for our products or services Staci UK do not manage this, and in that situation, they send all of your contact details to us to process the enquiry (see the section above on ‘Contact Us - Contact Centre’ for the processing of your personal data in this case).

Our lawful basis for processing your information in your enquiry form via Staci is our legitimate interests, in that it is legitimate for a business to use a third party to respond to an enquiry form where that business does not have the resources to manage this internally, we have outsourced this service to Staci UK. Staci UK will retain your personal data from the literature request form for 12 months after your request was fulfilled, at which time it will be deleted.

Provided you have given us your consent or not objected when asked, we may contact you by email, telephone, or SMS to provide details of offers or complimentary services that may be of interest to you based on the services you have previously used or purchased. To lawfully manage these communications we process information about your consent (date and time), about the products and services you use, the sending of the advertising (in particular the content of our messages, date and time), information about the delivery and opening of the messages, the data for establishing the connection between the website and your browser and device. We associate this information with your existing account data so that we can better understand your interests and send you more relevant information and offers.

Our lawful basis for processing your personal data for electronic advertising is your consent. You can withdraw your consent to electronic marketing at any time and stop receiving electronic marketing by using the unsubscribe link at the bottom of any of our electronic marketing or by contacting us by phone or emailing the data protection officer dataprotectionUK@Vaillant-group.com. In the case of withdrawal of consent to electronic marketing your personal data will then be placed on a suppression list to ensure that you are not sent electronic marketing communications in future. Please note it can take up to 30 days for any electronic marketing already in process to complete and you may continue to receive some communications during this time.

We may also occasionally send you a request to help us with market and customer research, customer surveys, or provide a product or service review. The only personal data we process for this purpose is your name and email address and the responses you provide to us. We do not record your responses in your product account, the responses are retained separately and are only accessible by limited members of staff who are analysing the feedback to improve our services or produce a report.

In most cases we will aggregate the results of all responses to produce an overview of the outcomes to share with relevant persons in our UK business or our head office in Germany e.g. 35% of respondents would be interested in a smart device that adjusted their boiler settings to the most economical usage for them.

In order to conduct market and customer research, customer surveys, or gather product or service reviews, we often use third parties who specialise in these activities. It is challenging to provide the names of every third party we might engage with at any time in the future, but some key examples are KHWS, Leftfield, Forsta, GIM, and Vaillant GmbH in Germany.

Our lawful basis to seek this kind of feedback and reviews, is our legitimate interests in that a professional well managed organisation reasonably needs to ensure that its product offering, customer service, and quality of service meets customer’s expectations, and our plans and investments are directed to where a demand exists. You can ignore these requests or take part at your own choice or use the unsubscribe option where it is offered in the emails. We will retain your details and responses for as long as the data is valid and accurate, and any report containing aggregated results is still in circulation (in order to evidence should that be required).

You can make a service or repair appointment with us either by phone, or where you are no longer covered by the manufacturer’s guarantee, by using MyVaillant Web (you need to have registered your product with us in My Vaillant Web first, see details in next section). To make an appointment, we require information on the type of order (repair, maintenance or other), the product concerned (e.g. serial number, name, class, type, model, performance), your name, title, email address, telephone number (landline or mobile) and the location of the product and your information will be matched with an existing product registration account, or a new account will be created if it is the first time you have contacted us. Our account system is provided by a third party (Salesforce) and is managed by Vaillant GmbH in Germany, Salesforce do not have access to your personal data.

Our lawful basis for processing your personal data to make appointments is the performance of a contract or the steps required prior to entering a contract with you for this service. We need this information to book or coordinate appointments with you and our engineers (or possibly a third-party installer working on our behalf), to confirm the order and to communicate with you and possibly a third-party installer during the processing of the order.

At our discretion, we may also share limited information about Vaillant engineer visits or product checks we conduct on any of our products that you own, with third-party engineers/installers if they provide us with evidence that they installed, or are working on one of our products on your behalf and where sharing that information with them is appropriate in the circumstances.

Our lawful basis for disclosing details of Vaillant engineer visits with a third-party engineer/installer is our legitimate interests in that it is legitimate to support the third-party engineer/installer to resolve any issues with Vaillant products and to provide technical background for their future reference when maintaining or servicing Vaillant products for their customers’.We will retain your personal data in respect of appointments, orders and visit reports in the product registration account for as long as you have a Vaillant product, if you move and let us know we will hide your personal data, or if you have the product replaced with a non-Vaillant product then we will close the account until its permanent deletion within 6 years of the product being replaced.

Although Vaillant engineers will not collect any additional personal data from you during a repair or service visit, to ensure that they have a full view of the boilers status they will use a diagnostic tool which connects directly to your boiler and collects data about the boiler including boiler serial number, boiler performance, energy information, control features, and historical information.

Our lawful basis for collecting and processing this data is for us to fulfil our obligations to you under the contract to repair or service your boiler and for our legitimate interests to support a holistic overview of the boiler’s status, its performance, and faults during its lifetime, and to provide the most efficient resolution to any future faults or issues arising with it.

We retain the boiler data for the lifetime of the boiler, to assist Vaillant and other engineers in quickly resolving any issues with the boiler.

Once you have one of our products installed, you should ensure it is registered as soon as possible to benefit from our product Guarantee, you can register the product in several ways:

1. by calling us (see website contact us details);

2. by following the QR code (sticker on the front of your product);

3. a registration card enclosed with your product packaging, puts you in contact with our service partner Domestic and General;

4. by using My Vaillant Web online; or

5. your third-party engineer/installer may register your Vaillant product on your behalf and they should notify you that they have shared your personal data with Vaillant, provide you with a link to this privacy notice, and offer details of the product guarantee.

In all cases, you will need to provide your name, address, email, and phone contact details, make and model of the product, installation date, installer details, and the serial number of the product you are registering.

For My Vaillant Web you will need to register for a My Vaillant Web account first, please refer to the separate privacy notice for My Vaillant Web.

Our lawful basis for processing your personal data for product registration is that it is necessary for the purposes of a contract we have with you or the steps prior to entering a contract with you in relation to the product guarantee.

We also provide your registration details to the Gas safe registration scheme, our lawful basis for sharing your personal data is a legal requirement placed on us which of course is there to protect you should there be any issues with the gas supply or product. You should check the separate privacy notice for the Gas Safe scheme for details of how they will use your personal data.

We will retain your personal data in respect of the product and gas safe registration for as long as the Vaillant product is owned by you and for 6 years after the product is removed, or you move from the install address, or you replace the Vaillant product with a non-Vaillant product.

We offer a help portal on our website where you can search for information on numerous questions and topics like an FAQ section. In principle, you can use the help portal without disclosing any personal data. However, please refer to the section on Cookies, analysis tools, tracking and targeting for more details of your device data that we may collect via cookies.

We may operate a live chat which allows you to communicate directly and personally with a member of our call centre about our products and promotions. To provide the live chat, we use a service provided by salesforce.com Germany GmbH, Erika-Mann-Straße 31, 80636 Munich, Germany ("Salesforce"). To enable the live chat service, we set a cookie on your device. We process information during the chat (start and end, duration, and its content). Furthermore, the data for establishing the connection to our website and the use of the live chat are processed to be able to provide the service. You may also provide us with other personal data when using the chat so that we can help you with your request (e.g., name, contact details, heating system) so that we can identify you if you are an existing customer. We process the information to provide the live chat and for statistical purposes.

Our lawful basis for processing your personal data within the chat is the performance of a contract or the steps required prior to entering a contract with you, and our legitimate interests, which are to fulfil your enquiry effectively and to your satisfaction.

Personal data processed during the chat may be retained on your customer account if you have one, and if you are not an existing customer it may be used to create an account with us, but only if that is appropriate to your enquiry.

We offer a WhatsApp chat function which allows you to directly communicate with a member of our call centre about our services and promotions. To provide this, we use a service provided by WhatsApp, Meta Platforms Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour (“WhatsApp”) and CM Telecommunications Ltd, 24/25, The Shard, 32 London Bridge St, SE1 9SG London (“CM.com”). Communication via WhatsApp can only be initiated by you within WhatsApp by messaging 0330 100 3143 or by scanning the WhatsApp QR code on our ‘Contact’ page located here.

Messages sent to us via WhatsApp are protected by End-to-End encryption, meaning the contents are only accessible by the sender (you) and the recipient (us). Conversations that take place via WhatsApp are processed and stored within a European Data Centre with this same level of encryption.

You may provide us with personal data when using the chat so that we can help you with your request (e.g., name, contact details, heating system) so that we can identify you if you are an existing customer. We process the information to provide communication via WhatsApp and for statistical purposes.

Our lawful basis for processing your personal data within the chat is the performance of a contract or the steps required prior to entering into a contract, and our legitimate interests, which are to fulfil your enquiry effectively and to your satisfaction.

Personal data processed during the WhatsApp chat may be retained on your customer account if you have one, and if you are not an existing customer it may be used to create an account with us, but only if that is appropriate to your enquiry.

In addition to the other processing mentioned in this privacy notice, you may also have reason to be referred to our boiler replacement team for a quote. The team will ask for your name, address, and phone/email contact details. We retain your personal data in the quote for 3 months and then we remove your personal data and retain the quote details purely for our internal statistical and reporting purposes. If you contact us after 3 months from your initial quote, you will need to request a re-quote and any prices quoted in the initial quote cannot be guaranteed.

If you wish to proceed with your quote, you will be asked whether you wish to pay in full or pay in instalments on finance, if you select payment in instalments, we will pass your name, address, telephone number and email to our third-party finance provider Novuna and they will contact you for you to complete their application process. Vaillant does not have any access to your application to Novuna. For details of how Novuna process your personal data please see their privacy notice. Novuna will confirm to us whether your finance application was successful, and we will then arrange the installation of your new boiler.

If you pay us directly in full for your new boiler, we can accept payment by BACS directly from you into our bank account, or if you wish to pay on a card, we will put you through to our third-party payment processor Worldpay/FIS Global who will take the card details off you and process your payment. Vaillant do not have any access to your payment card details and you should refer to the payment processors privacy notice for how they will process your personal data. The payment processor will confirm to us whether the payment has been successful or not.

When you proceed with a boiler purchase, we will retain your personal data and details of the boiler and installation for as long as the boiler is installed and for a maximum of 6 years thereafter.

Our lawful basis for processing your personal data for the Boiler Replacement Scheme quote is our legitimate interests in providing the best customer service to our customers. Our lawful basis for processing your personal data when you accept the quote and wish to purchase the boiler replacement service is for the purposes of a contract we have with you, and you will have accepted our terms and conditions when entering the contract.

Our web site contains links or references to other web sites that we do not control and to which our privacy and cookie notice does not apply. Please be sure that you read the privacy policy of every website you visit to ensure you are happy with all the way that your personal data is being processed.

Facebook & Instagram (Meta)

Our websites use social plugins (“plugins”) provided by the social networks facebook.com and Instagram.com, operated by Meta Platforms Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour

Dublin 2 Ireland. The plugins are identifiable by either:

• a Facebook logo (white letter f on blue background or a thumb up icon) or the notice “Facebook Social Plugin”. For a full list of all social Plugins please see http://developers.facebook.com/docs/plugins; or

• a Instagram logo (depicting a camera, but in the most minimal way and in multicolour, with just a square, a circle, and a dot on a white background). For a full list of all social Plugins please see Social Plugins - Instagram : EKM

When you visit a page of our website that contains a social plugin, your browser establishes a direct connection to Facebook or Instagrams servers. Facebook and Instagram directly transfer the plugin content to your browser which embeds the latter into the website, enabling Facebook and Instagram to receive information about your having accessed the respective page of our website. Thus we have no influence on the data gathered by the plugin and inform you according to our state of knowledge:

The embedded plugins provide Facebook and Instagram with the information that you have accessed the corresponding page of our website. If you are logged into Facebook or Instagram, your visit can be assigned to your Facebook or instagram account. If you interact with the plugins, for example by clicking “Like”, or entering a comment, the corresponding information is transmitted from your browser directly to Facebook or Instagram and stored by it. Even if you are not logged into Facebook or Instagram, there is possibility that the pluginstransmits your IP-address to Facebook or Instagram.

For the information on the purpose and scope of data collection and processing by Facebook and Instagram, as well as your rights in this respect and settings options for protecting your privacy please visit either: Facebook’s privacy policy: http://www.facebook.com/policy.php or Instagram’s privacy policy https://privacycenter.instagram.com/policy .

If you are a Facebook or Instagram member and do not want Facebook or Instagram to connect the data concerning your visit to our website with your member data already stored by Facebook or Instagram, please log off Facebook or Instagram before entering our website. Further you can block Facebook and Instagram social Plugins by using add-ons for your browser, like the “Facebook Blocker” e.g. https://addons.mozilla.org/en-GB/firefox/addon/fb_ad_block/

Facebook Advertising

To make potential users aware of our Internet presence, we use the Facebook advertising network, which includes conversion tracking, an analysis service from Facebook (Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA). Facebook will set a cookie on your computer ("conversion cookie") if you have been directed to our website via a Facebook ad. The cookie loses its validity at the end of 30 days. If you visit within this period certain pages of us, Facebook and we can recognize that the ad was clicked. Information obtained using the conversion cookie is used to create conversion statistics. We receive information about the total number of users who clicked on a particular ad and were redirected to a website associated with the conversion tracking network. Personal identification is not possible for us. If you do not wish to participate in the tracking procedure, you can also reject the required setting of a cookie, for example via a browser setting, which generally deactivates the automatic setting of cookies.

X

Functions of X (formally known as Twitter) service are integrated in our site. These functions are being offered by X, Inc. (795 Folsom St., Suite 600, San Francisco, CA 94107, USA). The use of X and the “Repost” (formerly “Retweet”) function links the websites you visit with your X account and makes this information available to other users. Data is transferred to X in the process.

We want to make you aware that we as a provider of the pages have no knowledge of the content of the transferred data or of its use by X. You can find more information about the data privacy declaration of X at twitter.com/privacy.

Please note, on this website, X is referred to by its former Twitter icon featuring a bird silhouette.

Youtube

Our website uses plugins from YouTube (YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA). When you visit one of our YouTube plug-in-enabled sites, you will be connected to the servers of YouTube. The Youtube server will be informed which of our pages you visited. If you're logged in to your YouTube account, YouTube allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account. For more information on how to handle user data, please refer to the YouTube Privacy Policy at https://www.google.com/intl/en/policies/privacy

Our lawful basis for placing cookies is your consent. You can withdraw your consent at any time.

LinkedIn

Our website uses plugins from LinkedIn (LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). When you visit one of our LinkedIn plug-in-enabled sites, you will be connected to the servers of LinkedIn. The LinkedIn server will be informed which of our pages you visited. If you're logged in to your LinkedIn account, LinkedIn allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your LinkedIn account. For more information on how to handle user data, please refer to the LinkedIn Privacy Policy at https://www.linkedin.com/legal/privacy-policy

TikTok

Our website uses plugins from TikTok (TikTok Inc., Attn: Privacy Policy Inquiry, 5800 Bristol Parkway, Suite 100, Culver City, CA 90230). When you visit one of our TikTok plug-in-enabled sites, you will be connected to the servers of TikTok. The TikTok server will be informed which of our pages you visited. If you're logged in to your TikTok account, LinkedIn allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your TikTok account. For more information on how TikTok handle user data, please refer to the TikTok Privacy Policy at https://www.tiktok.com/legal/page/global/partner-privacy-policy/en

Personal data collected by cookies is deleted after 30 days.

Cookies are small text files that are stored in the browser of your computer, tablet, or phone when you visit our websites or apps.

We use functional cookies and statistical and analytics cookies, to make our website more user-friendly, to facilitate navigation and the use of forms, to simplify logging in and registration, to provide certain functions, to compile statistics and to measure the activities on the website with the aim of improving our offering and make it more relevant to our customer’s needs, to store the consent or rejection of cookies and to ensure the security of our website and our systems. We call these ‘necessary cookies’ as they are essential to be able to fully use our website functionality. Our lawful basis for using necessary cookies is our legitimate interests in that it is legitimate for a business to seek to make its website as user friendly, safe and robust as possible. Cookies will remain on your device for differing amounts of time, in many cases only for so long as your browser session remains open, full details can be found in the cookie list on the cookie consent manager.

We also use cookies for tracking and targeting, this means that the cookies track your web surfing behaviour so that we can offer customised content, measure the effectiveness of and tailor advertising or offers. These are known as ‘optional cookies’ and our lawful basis for using these optional cookies is your consent. We will ask for your consent to optional cookies when you first visit our Website/apps and you can withdraw your consent at any time using the cookie consent manager. A full list of all cookies used on our websites can be found on the cookie consent manager (see additional section below).

How to manage cookies on popular browsers:

• Google Chrome

• Microsoft Edge

• Mozilla Firefox

• Microsoft Internet Explorer

• Opera

• Apple Safari

To find information relating to other browsers, visit the browser developer's website.

To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

You can use the Cookie Consent Management Tool integrated into our website to manage your individual settings for the use of cookies. There you will also find detailed information on the individual cookies.

We use the Consent Management Tool from Consentmanager AB (Håltegelvägen 1b, 72348 Västerås, Sweden) on our website. The tool enables you to give consent to data processing via the website, in particular the setting of cookies, as well as to make use of your right to withdraw consent already given. The processing of data and the use of cookies is necessary for the documentation and administration of your settings. The following data is collected and transmitted to the provider of the tool: Date and time of the page call, information on the browser you use and the device you use, anonymised IP address, opt-in and opt-out data relating to the respective cookies. This data is not passed on to other third parties.

For more information on the privacy terms of the cookie consent management tool used, please visit: https://www.consentmanager.net/privacy.php.

Personal data processed by us as the controller and, for the purpose of providing our website and services, is sometimes passed on to other entities within the Vaillant Group and certain third-parties who process the personal data on our behalf and strictly in accordance with our instructions (we have set out in the individual sections of this policy wherever that is the case).

We may also pass on your personal data to installers, service engineers or other third parties if this is necessary for the provision of our service e.g. service and repair etc.

Our lawful basis for this processing of your personal data would be to comply with a contract we have with you or another person, or our legitimate interests in providing our services as efficiently and professionally as possible.

In certain situations, and on your request we may provide your Vaillant product performance and settings data to third-parties you have chosen to provide you with additional or connected services relevant to your Vaillant product (the third parties are whoever you wish to provide you with the additional or connected services but are most likely to include your energy provider (e.g. Ovo, British Gas etc. or any new entrants to the energy market) and/or your independent Vaillant product installer. Our lawful basis for sharing your data with your chosen third-party(s) is your consent. You can withdraw your consent to this data sharing at any time by contacting our Data Protection Officer using the contact details in the relevant section below.

We may also disclose your personal data to other third parties such as:

• Gas Safe, other industry regulators, HM Revenue & Customs, the FCA, the Financial Ombudsman, the insurance Ombudsman and other authorities and regulators acting as controllers based in the United Kingdom who require us to disclose information in certain circumstances, and the health & safety executive wherever this is necessary, depending on the circumstances our lawful basis could be our legitimate interests, your vital interests, for a contract with you, or a legal obligation;
• Professional advisers acting as processors or controllers including lawyers, bankers, auditors and insurers based in the UK/EU who provide consultancy, banking, legal, insurance and accounting services strictly where there is a need to share personal data, our lawful basis here is usually our legitimate interests in that all of these disclosures are necessary for operating a compliant business in the UK;
• Service providers acting as processors based in the UK/EU who provide IT and system administration services including, but not limited to River Marketing Limited (RIPPL), our lawful basis for this is our legitimate interests in that it is legitimate for us to operate our business as we see fit provided this is within the law: and

Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If such a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice until you are notified of any changes. Our lawful basis for this is our legitimate interests in that it is legitimate to manage, merge or dispose of our business or parts of it as we see fit provided this is within the law.

We may also be required to transfer your personal data to domestic or foreign courts, law enforcement authorities or other governmental institutions where this is required and permitted by law an example might be the police or emergency services, insurance investigations and court orders. Our lawful basis for this is compliance with a legal obligation or the vital interests of our customers or others.

In some circumstances (as already set out in this privacy notice), data processing of your personal data is carried out on our behalf by our Head Office Vaillant GmbH in Germany or a third-party organisation based outside the UK. This is particularly so in connection with the use of analysis tools, tracking and targeting cookies and other technologies or the integration of social media offers. In such cases, unless there is an adequacy decision by the UK in relation to the recipient country (e.g., as with all EU member states), we will have agreed adequate safeguards for the protection of personal data by that organisation, in particular by agreeing the applicable UK International Data Transfer Agreement (IDTA) or the EU standard contractual clauses with the UK IDTA Addendum, to ensure the same standards of protection as UK data protection law requires.

Depending on the purpose of the transfer our lawful basis could be any of the bases set out in paragraph 3 above.

We apply technical and organisational security measures to protect the personal data we process against destruction, loss, alteration or unauthorised disclosure of, or access.

All personal data provided by you when using personalised services will be transmitted to us in encrypted form. Your data is password protected in the systems in which it is stored. The persons who have access to it are prohibited by strict security regulations from disclosing your data to third parties unless we have set out where a third party is used as part of the provision of any of our services in this policy.

In addition:

• Our system security is regularly audited internally and by an External Qualified Security Assessor
• We regularly update our firewalls and ensure that our systems are continually updated to protect against new cyber attacks
• We use a third-party web application firewall from WAF to help maintain the security and performance of our website. The service checks that traffic to the site is behaving as would be expected. The service will block traffic that is not using the site as expected. To provide this service, WAF processes site visitors’ IP addresses
• All our staff are required to undertake information security awareness training to spot spam, phishing and other malicious emails that could compromise the integrity of our systems
• Our call centre staff are trained in following caller identification practices to prevent disclosing personal data to third parties attempting to obtain personal data by deception
• All staff are required to comply with our group policies on information security, data protection, information classification etc.
• Our physical premises are secured so that only staff with company issued security passes can enter our buildings without prior authorisation, and guests are accompanied at all times. Closed-circuit television (CCTV) operates outside the building for security purposes. The information is viewed by us on a live feed and recorded on a 30 day loop.
• We have a robust disaster recovery and business continuity policy that follows a strategy that ensures that we can restore the availability and access to personal data in the event of a physical or technical incident in a ‘timely manner’
• Your personal data is password protected in all the systems in which it is stored and will only be accessed where there is a genuine reason to do so.
• The persons who have access to the systems where your personal data is held are prohibited by strict security regulations from disclosing your data to third parties unless we have set out where a third party is used as part of the provision of any of our services in this policy.
• Our data security measures are continuously reviewed, improved and we regularly employ penetration testing performed by a third party provider, to assess the strength of our technical defences.
• We ensure that any data processor we use also implements appropriate technical and organisational measures to comply with data protection law.

You have the right to request access to and rectification or erasure of personal data concerning you or restriction of processing, or to object to processing as well as the right to know and question any decisions made about you using automated means and data portability, in each case in accordance with data protection law.

The following links are to the ICO website where you can find additional information on your rights and ion what situations you can exercise them (please note that the ICO’s separate website Privacy Notice will apply to your use of their website):

Know about use of your personal data

Access to personal data

Correction of personal data

Erasure of personal data

Restrict the use of personal data

Object to processing of personal data

Portability of personal data

Use of automated decisions about you

Complaint

Where the lawfulness of our processing of personal data relies on your consent, you have the right to withdraw your consent at any time.

You can contact our data protection officer using the details in the section below, to assert your data protection rights above.

You will not be charged for exercising your rights and, once we receive your request, we have one-month to respond to you, unless we let you know otherwise.

Complaints

If You are unhappy with our website or the services available on it, or anything that Vaillant have done for you other than on the website, you can make a complaint by going to our ‘Contact Us’ page and filling in the complaint form (available here).

If You are unhappy with the way we are using your personal data, please contact our data protection officer and we will seek to resolve any issues. You also have the right to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of personal data concerning you is not lawful.

The competent supervisory authority in the UK is the Information Commissioners Office. You can find their current contact details at https://ico.org.uk/global/contact-us/

If you have any questions or suggestions on our use of your personal data, please feel free to send them by email or letter to our data protection officer, who can be reached at the following contact details:

By email: DataprotectionUK@vaillant-group.com

By post: The Data Protection Officer, Vaillant Group UK Limited, Nottingham Road, Belper, Derbyshire, DE56 1JT

We reserve the right to change this privacy policy at any time. Please also note the respective terms of use and the general terms and conditions when using our Website.

Status: Published July 2025

Previous Privacy Policies

January 2024

August 2023