Privacy Policy

Norvera is a trading name of CSS International Ltd, registered in England and Wales under company number 16110027. Our registered office is at 85 Great Portland Street, First Floor, London, W1W 7LT.

CSS International Ltd is the data controller responsible for your personal data collected through the Norvera website at norvera.co.uk and any related services. In this policy, "we", "us" and "our" refers to CSS International Ltd trading as Norvera.

Norvera operates as an intermediary: we connect customers requiring boiler replacement or installation services with independent, Gas Safe registered engineers. We do not carry out any gas work, installation or maintenance ourselves.

Depending on how you interact with us, we may collect the following categories of personal data:

We collect this information when you submit an enquiry form, call our team, upload photos, or browse the website.

We use your personal data for the following purposes and on the following lawful bases:

We share your personal data only where it is strictly necessary:

• Appointed engineers: We pass relevant details (name, contact number, property address, system information) to the Gas Safe registered engineer arranged to carry out your installation. That engineer processes your data as an independent data controller and will have their own privacy policy.
• Service providers: We use carefully selected third-party tools for communications, CRM, cloud hosting and analytics. All processors are contractually bound by data processing agreements that require them to protect your data in accordance with UK GDPR.
• Legal & regulatory authorities: We may disclose information where required to do so by law, court order, or regulatory authority.
• Business transfers: In the event of a merger, acquisition or sale of all or part of our business, your data may be transferred to the new entity. We will notify you before any such transfer and ensure adequate protections are in place.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

You may request deletion of your data at any time (subject to our legal obligations to retain certain records). See Section 6 for how to exercise your rights.

As a data subject in the UK, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you (Subject Access Request).
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where there is no overriding legal reason to retain it.
• Right to restriction: Request that we pause processing of your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format where the processing is based on consent or contract.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@norvera.co.uk. We will respond within one calendar month in line with our legal obligations.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We primarily store and process your data within the United Kingdom and European Economic Area. Where we use third-party service providers based outside these areas (for example, cloud infrastructure providers), we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or equivalent standard contractual clauses.

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration or destruction. These include encrypted data transmission (HTTPS), restricted access controls, and secure cloud storage.

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, inform you directly without undue delay.

We use cookies and similar tracking technologies to improve your experience on our website. Please see our Cookie Policy for full details, including how to manage your preferences.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The most current version will always be posted on this page with the date of last update. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact our data controller: