Privacy notice

Who holds it

Aston Domestic.

No contact address has been published here yet. Until one is, ask your landlord for the contractor’s details — they instructed the work and hold the same record.

Your landlord decides that the work happens and holds the resulting safety record; Aston Domestic carries it out and holds what it needs in order to. If you want a record removed and it is part of the safety history of your home, your landlord is the one who decides.

What is held

Every category, with the actual fields named. Nothing is held for advertising, nothing is sold, and nothing is used to make an automated decision about anybody.

• The occupier of a dwelling

  Erased on request

  To arrange access, and to tell somebody an engineer is coming. An engineer stood outside a door that has not opened has nothing else to work with.

  Kept

  Until the tenancy ends or the landlord sends a correction, whichever is first.

  Where

  sites.tenant_name, sites.tenant_phone, sites.tenant_email

• How to get into the property

  Erased on request

  A note from the landlord or from a previous visit — a key safe, a side gate, a dog in the garden, the hours somebody is in.

  Kept

  Until it stops being true. It is replaced rather than added to.

  Where

  sites.access_notes

• The dwelling itself

  Kept — see below

  It is where the work is. The UPRN is the identity, because addresses get typed six different ways and a compliance history split in half across two spellings is worse than no history at all.

  Kept

  While the landlord holds the contract, and after it as compliance history.

  Where

  sites.address_line1, sites.address_line2, sites.postcode, sites.uprn, sites.lat, sites.lng

• What was done at the property, and what was found

  Kept — see below

  The compliance record. This is the thing the landlord is legally obliged to hold, and the reason the work happened at all.

  Kept

  Until superseded by a later inspection, and then for as long as the landlord requires it. The report is retained and handed to the next tenant.

  Where

  jobs.description, job_events.note, job_reports.work_done, job_reports.found, job_reports.recommend, job_reports.unsafe_note, job_observations.description, job_observations.location, job_results.notes, job_results.certificate_number

• Photographs and filed documents

  Reviewed on request

  Evidence of the work. A written paragraph saying a consumer unit was replaced is worth a great deal less than the same paragraph with a picture of it.

  Kept

  With the job they belong to.

  Where

  job_photos.storage_path, job_photos.caption, job_documents.storage_path, job_documents.file_name

• The people who work here

  Kept — see below

  To run the diary, to pay them, and to greet them by the right name.

  Kept

  While they work here, and afterwards as far as employment records require.

  Where

  profiles.full_name, profiles.first_name, profiles.last_name, profiles.email, profiles.phone, profiles.birth_day, profiles.birth_month, engineers.payment_terms_days, engineers.employee_ref

• Where an engineer was, and when they were working

  Kept — see below

  Two things record this and both are asked for rather than taken. Pressing the safety button sends a position so the office can find somebody; starting and finishing a round is a button an engineer presses. Nothing follows a location continuously, and nothing records one unless a person has acted.

  Kept

  With the alert, or the day, it belongs to.

  Where

  safety_alerts.lat, safety_alerts.lng, safety_alerts.located_at, engineer_day_marks.started_at, engineer_day_marks.finished_at

What can be erased, and what cannot

Your name, telephone number, email address and any note about how to get into the property are held so that somebody can arrange a visit and tell you they are coming. Ask, and they go. That takes effect the same day and the office can show it was done.

The record of the inspection itself does not go, and this is worth being clear about. An EICR is a safety record your landlord is legally required to hold, to give to the next tenant, and to produce to the local authority on request. UK GDPR permits keeping personal information where it is needed to comply with a legal obligation, and that is what this is. The address stays, the result stays, and what an engineer found on the day stays.

Photographs and filed documents sit in between. They are evidence of the work, so they are not deleted automatically — but a photograph taken inside somebody’s home is not the same as a circuit reading, and any that name you or show your belongings are looked at by a person when a request comes in.

What you can ask for

• A copy of what is held about youFree, and within one month.
• A correctionA wrong telephone number is worth telling the office about anyway.
• Erasure of your contact detailsDone on request. The safety record stays, for the reason above.
• To object, or to restrict what is done with itSay so, and the office will explain what it can and cannot stop.
• To complainTo the office first, and to the Information Commissioner (ico.org.uk) if that does not settle it.

What protects it

Checkable statements about things that exist, rather than a paragraph of adjectives.

• Every table is row-level secured and scoped to one firm. Two firms sharing a database cannot read each other, and a test builds a second firm, tries to cross the boundary, and takes it down again.
• An engineer sees the properties they have work at and no others. What a client is invoiced is held in a separate table they cannot read at all, because row security cannot hide one column from somebody who can read the row.
• The engineer’s map is deliberately narrowed rather than widened: an address, what is due and when, and nothing else — no tenant name, no phone number, no access note.
• Uploaded files are private. Every link to one is signed and expires, and each store refuses any file type outside its own list.
• A job’s history cannot be rewritten by anybody, the database owner included. Changes to rates, clients, properties, engineers and invoice figures are recorded by the database itself, with who made them and what the value was before.
• Passwords are held by the authentication service and never by the application. There is no password field this software is able to read.
• Signing out clears everything held on the handset, because a cached page carries tenant names and telephone numbers and a phone gets lost.
• Every page, and every one of these boundaries, is checked by two sweeps that sign in and try it rather than by reading the code.