Privacy Policy

Last updated: 25 August 2026

Who we are

Cavalli Ventilation Ltd is the data controller for the information described on this page.

• Registered company: Cavalli Ventilation Ltd, registered in England & Wales, company number 12092552
• Email: mail@cavalliventilation.co.uk
• WhatsApp: message us on WhatsApp
• Postal address: available on request, and on the public register at Companies House under company number 12092552

What we collect, and when

When you fill in a form

There are two forms on this site — the general enquiry form and the subcontractor layout audit form. Between them they ask for your name, email address, phone number, the postcode of the property or the area of the project, what kind of enquiry it is, and whatever you write in the message box. The enquiry form asks for a postcode rather than a full address on purpose: it is enough to tell you whether we cover the property and what the travel costs, which is all the form is for. The full address is taken when a survey is actually booked.

Only those fields are sent. Nothing is collected in the background, and the forms do not record anything about you before you press send.

When you use the ventilation simulator or the Part F check

Neither tool sends anything anywhere. The property type, the answers about condensation and mould, the room list and the results are all worked out in your own browser and are gone when you close the page. Nothing is stored and nothing is transmitted to us. If you then choose to send us an enquiry, only what you type into the form is sent.

When you contact us by WhatsApp, email or Instagram

We get whatever you send, plus whatever that service shows us — for WhatsApp, your phone number and profile name. Those conversations happen on Meta's and Microsoft's systems as well as ours, under their own privacy terms.

Server logs

Our host, Netlify, keeps short-term technical logs of requests to the site, which include IP addresses. These are Netlify's own logs, kept for security and troubleshooting. We do not use them to build any picture of who visits.

Why we use it, and our lawful basis

What for	Lawful basis (UK GDPR)
Replying to your enquiry, arranging a survey, preparing a quote	Taking steps at your request before entering into a contract — Article 6(1)(b)
Carrying out and commissioning the work, and keeping the job records that go with it	Performance of our contract with you — Article 6(1)(b)
Keeping invoices and accounting records	Legal obligation — Article 6(1)(c)
Keeping our site and our inbox secure, and dealing with spam	Our legitimate interests in running the business safely — Article 6(1)(f)
Using a review or a photograph of completed work in our marketing	Your consent — Article 6(1)(a). We ask first, and you can withdraw it at any time.

We do not need special category data (health, and so on) to quote for or carry out ventilation work, and we do not ask for it. If you mention something like that in a message — for example that damp is affecting someone's asthma — we only use it to understand the job.

Who else sees it

A form submission passes through the following before it reaches us. Each of them is a processor acting on our instructions, except where noted.

• Netlify — hosts this website and runs the small piece of code that receives the form.
• Resend — delivers the form as an email to our business mailbox.
• Microsoft 365 — our business mailbox, and where the message arrives.
• Supabase — the database behind our own engineer's job-management system, where an enquiry becomes a job record.
• Meta — if you contact us through WhatsApp or Instagram. Meta is a controller in its own right for those services, not our processor.

If your email app opens instead of the form sending directly — which happens if the form cannot reach our server — then your message goes to us by ordinary email through whichever provider you use.

We do not sell personal information, and we do not share it with anyone for their own marketing.

Where your information goes

Some of the providers above are based in, or store data in, the United States. Where personal information is transferred outside the UK it is protected by the UK's international data transfer agreement or the UK extension to the EU–US Data Privacy Framework, depending on the provider.

Third parties this page loads

None. This site does not run analytics, advertising or tracking scripts of any kind, and it does not fetch anything at all from anyone else's server. Every file your browser downloads to display this page — the text, the images, the stylesheet, the fonts and the animation library behind the simulator — comes from cavalliventilation.co.uk and from nowhere else.

That was not always true. The two typefaces used to be requested from Google and the animation library from Cloudflare, which told both companies your IP address and roughly where you were before you had read a word. Those files are now served from this domain, so that no longer happens. Nothing is lost by it: browsers stopped sharing a font cache between websites in 2020, so the only thing that arrangement ever achieved was the request itself.

Our Google reviews are not a third thing this page loads. They are fetched by our own server and passed on to you, so your browser never talks to Google to display them. That is also why you see reviewers’ names but not their profile photographs: the photographs are hosted by Google, and showing them would mean your browser fetching an image from Google on every visit. The name and the link to the review on Google are what let you check a review is real, which is the point of showing it at all.

Cookies and storage on your device

This site sets no cookies. It does not use local storage or any similar technique to remember you between visits, and there is nothing on it that follows you to another website.

The site does install a service worker, which keeps a copy of the pages and images in your browser so it still opens if you lose signal. That copy sits on your own device, contains nothing personal, is never sent anywhere, and clearing your browser data removes it.

How long we keep it

• An enquiry that does not become work: up to 12 months, then deleted.
• Job records, surveys, commissioning results and correspondence for work we carried out: 6 years after the work is completed. Ventilation work is covered by warranties and by Building Regulations compliance, and we may need the records to defend a claim or prove what was installed.
• Invoices and accounting records: 6 years from the end of the accounting period, as HMRC requires.
• Photographs and reviews used in marketing: until you withdraw consent, or until we stop using them.

YouTube API Services

Our internal engineering application, Cavalli Ventilation: Engineer’s Toolkit, uses YouTube API Services to publish our own video content to our own YouTube channel and to read back statistics for that channel.

By authorising that application you are agreeing to be bound by the YouTube Terms of Service. Google’s handling of any data it receives is governed by the Google Privacy Policy.

What we access, and what we keep. The application accesses only our own YouTube channel. It uploads video we have filmed ourselves, sets the title, description, tags and thumbnail on those uploads, and reads that channel’s own statistics and analytics. It also reads publicly available information about other creators’ videos in our trade — title, publication date, duration, view and like counts — which we keep only as aggregate benchmarks and never publish or share.

We do not access, store or process the personal data of any YouTube user. Only one person in our company is authorised to connect the application, and it is not distributed, sold or made available to anyone outside Cavalli Ventilation Ltd.

Revoking access. Authorisation can be withdrawn at any time through your Google account security settings, which list every third-party application with access and allow any of them to be removed. Our stored authorisation tokens are deleted when access is revoked, or when the connection is removed in the application.

Your rights

Under UK data protection law you have the right to:

• ask what we hold about you, and get a copy of it;
• have anything inaccurate corrected;
• ask us to delete it, where we do not have to keep it;
• ask us to restrict what we do with it, or object to us using it;
• receive it in a portable format, where we hold it on the basis of consent or a contract;
• withdraw consent at any time, where consent is what we relied on.

Ask by emailing mail@cavalliventilation.co.uk. There is no charge, and we will reply within one month.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.

Children

This site is aimed at homeowners, landlords and contractors. We do not knowingly collect information about children through it.

Changes to this policy

If what the site does changes, this page changes with it, and the date at the top is updated.