Privacy & Cookie Policy
Privacy Policy
CB Heating Ltd (T/A EDF Heat Pumps) Privacy Notices
CB Heating Ltd (T/A EDF Heat Pumps) (“EDF Heat Pumps” , “we”, “us”, “our”) respects your privacy and values the trust you place in us when you share your personal data with us. To find out more about what personal data we collect, how we collect it and what we use it for, click on the relevant link below. These links take you to our Privacy Notices, which also provide details as the “controller” of your data and who to contact if you have any questions as to how we handle your information:
- If you are a customer who has procured, or is seeking to procure, products and/or services from us, please click here.
- If you are an employee of EDF Heat Pumps, please click here.
- If you are a third party, such as a visitor to our sites or a contractor working at or with us (including agency-supplied workers, managed service workers and embedded contractors), the below policy applies to you.
We may share, or require you to share, information about you with other members of our group of companies such as EDF Energy Customers Limited and EDF Energy Limited. This is so that we can provide the best service to you, for example to resolve any dispute or queries you have in relation to the processing by us of your personal data.
Third Party Privacy Policy – what we collect; how we collect and why we collect data about you
This notice applies to any third party who provides information to EDF Heat Pumps. This may include visitors to our sites and contractors working at or with us, including agency supplied workers, managed service workers and embedded contractors. It does not apply to employees.
This policy sets out how we, as controller, collect and use your personal information; why we use it, with whom we share it, the rights to which you may be entitled and your choices about our use of your personal information. This notice may change from time to time but if we change anything important (for example, the information we collect, how we use it or why) we will highlight those changes to you.
If you would like to make a complaint regarding our use of your personal data, please complete this complaint form.
For anything else, please contact dpo@edfenergy.com.
This policy was last updated on 02/06/2026
Summary – What we collect, how we collect and why we collect information about you
We collect certain types of information from and/or about you throughout our interaction with you, from third-party service providers or publicly available sources. This information may include your name, address, contact details, curriculum vitae, and medical information. We use this information for the activities we have listed in the table below, including in order for us to provide our services, comply with legal and regulatory obligations, for marketing and reporting purposes.
If you are a child or teenager, then please read the first box below which summarises what information we collect, how we collect it and why we collect it.
What we collect This category of information we collect about you may include: | How we use it We use this information for certain activities, including to: | Why we use it We use this information because: | |
| Information that we collect from children, teenagers, parents and teachers through our initiatives (such as work experience) and when visiting our sites | – Your contact details; – Your parent’s contact details; – Your email address; – The name of your school/college or university; – The address of your school/college or university; – Your phone number; – Your date of birth; | – So that we can send you email communications about attending our programmes, events and initiatives; – For the purposes of marketing/sending invitations to attend events; – So that we can invite you to apply for jobs in the future | – We have obtained your consent to use the data in this explicit way and we rely on that consent – We have a legitimate business interest in being able to promote diversity in STEM industries by engaging with children and young people |
| Information when you communicate with us whether as a third party, contractor or otherwise, whether in person, when visiting our sites, through our website or via email, over the telephone, through social media or via any other medium | – Identification information such as passports, driving licences etc; – Your vehicle registration number(s) – Your contact details; – The details of your communications with us; – The details of our messages to you; – Your marketing preferences; – Marketing information | – Identifying you – Answer any issues or concerns; – Monitor potential stakeholder communications for quality and training purposes; – Develop new services; – Improve our services; – Personalise our service; – Deal with any complaints; – For the purposes of marketing/sending invitations to events – To facilitate work-related travel, including vehicle parking and ensuring only safe and authorised vehicular access to our sites; | – We have a legitimate business interest in: – understanding public feedback and in responding to communications in a consistent manner; – ensuring that we are better able to personalise our service to the public; – Ensuring the safety and security at all of our sites; – In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent – For security purposes |
| Information that we collect incidentally from other sources or public sources |
– Information presented on our social media or wider media platforms such as Facebook; | – Maintain market awareness; – Build and maintain social media branding, and our branding in general; – Deal with complaints received; – Address subject access requests | – We have a legitimate business interest in: – providing security over our business; – maintaining a public profile within the media; – resolving complaints; – maintaining the accuracy of the data we hold; – In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent |
| Information we collect from third-party partners, including third-party contractor employers and corporate customers | – Potential stakeholder details, like name and email address, from: – Publicly available sources such as the electoral roll; Royal Mail – Public Liability insurance details
| – Provide our services; – Manage and administer our systems; – Statistical analysis and research into our clients; – to contact insurance providers where we may have a financial claim; | – We have a legitimate business interest in: – developing and maintaining relationships with third-party partners and other companies and dealing with individuals who work for them; – conducting research to improve our services – recover our costs and losses from the services that are provided by contractors; – In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent |
| Information that we collect from you or your employer in order to comply with all relevant laws, regulations, industry codes and government instructions, and to deal with complaints | Your contact details – Health and medical data; – Identification information such as passports, driving licences etc.; – Curriculum Vitae | – Report to the Department for Energy Security and Net Zero (DESNZ); – Respond to requests made by law enforcement or regulatory authorities, bodies or agencies, or in relation to a legal claim – To ensure personnel are suitably qualified and experienced for the work being carried out – To ensure specific risks are considered for those women who may be pregnant or breastfeeding | – We need to comply with legal obligations; – We have a legitimate business interest in: – resolving any complaints we may receive; – ensuring that we comply with our regulatory and legislative obligations; – maintaining appropriate records for in relation to potential legal claims; |
| Information obtained for third party contractors and other visitors to sites, as a result of a criminal records check, the security vetting process and ongoing security surveillance | – Criminal records information – Baseline Personnel Security Standard check information; – National Security Vetting application information; – Photographs and CCTV footage. | – To complete our security checks – To comply with our regulatory obligations – To assess your suitability to hold a Baseline Personnel Security Standard and/or National Security Vetting Clearance; – To ensure safety and security of sites and people including e.g. staff, third party contractors and visitors. | – It is necessary for compliance with a legal obligation to which we are subject to; – It is necessary for contractors to work on our sites; – It is necessary for the purposes of the legitimate interests of EDF Heat Pumps to: – Ensure the safety and security of sites; – Ensure the suitability of contracted staff in relation to relevant roles; – To maintain appropriate records in relation to potential legal claims; – And in all cases is carried out only under the control of an official authority |
| Information we need to contact you and provide benefits to you | – Your personal and work contact details including your name, address, email address; – Your date of birth – Your benefits’ information | – To contact you; -To provide you with benefits | – It is necessary to perform our duties under a contract with your employer; – It is necessary for the purposes of the legitimate interests of EDF Heat Pumps to: – Ensure appropriate records are kept of third parties on site; – To maintain appropriate records in relation to potential legal claims |
| Information about your third-party contractors’ role, training, workplace performance and progression | – Your National Insurance number; – Commercial data from your contracting employer; – Your training records; – Which member of our staff you report to; – Skills & Experience | – To evidence your qualifications and capability for carrying out work; – To manage our workforce and ensure you integrate into the team on the particular project on which you are working – For medical and health purposes e.g. pregnancy | – It is necessary for the purposes of the legitimate interests of EDF Heat Pumps to: – manage the performance of its contractors; – manage contractors’ attendance at work; – manage contractors’ health and safety at work; – To maintain appropriate records in relation to potential legal claims |
| Information about third-party contractors’ fitness for work | – Personal information that you may provide when completing the Health and Safety Policy & Risk Assessment, including: full name, date of birth, address, email address, mobile number, UTR Number/VAT Registration. | – to assess your fitness for work; – to provide appropriate support to contractors with health and wellbeing issues; – to comply with our legal obligations, such as the duty to make reasonable adjustments and provide a safe working environment; – to manage our workforce if you are sick or not well | – it is necessary for compliance with our legal obligations (such as health and safety obligations); – it is necessary for the purposes of the legitimate interests of EDF Heat Pumps to: – plan and manage its workforce; – to maintain appropriate records in relation to potential legal claims – it is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, or the provision of health or social care or treatment |
| Information required to allow you to access systems in order to effectively carry out your role | – Your contact details | – Monitoring of our services – To enable third-party contractors to view active/closed systems and therefore view data held on databases – To enable third-party contractors to log their work | – We have a legitimate business interest in: – Providing access to users to systems required for EDF Heat Pumps to properly carry out its business |
| Information that we collect from you or your employer and/or from our records, during any testing for a pandemic virus with which you take part | – Your contact details including your name, email address and mobile phone number – Your employee number or your national insurance number – the result of any pandemic virus test; – In the event of a positive test: | – Contact you to inform you of the results of your test; – Assess your fitness for work; – Fulfil our obligation to report to Public Health for England and/or Public Health for Scotland should you test positive a pandemic virus; – Inform people you have been in contact with or close to, should you test positive for a pandemic virus; – Provide a safe working environment by minimising the transmission of a pandemic virus. | – It is necessary for us to comply with its legal obligations (such as health and safety obligations); – It is necessary for the purposes of the legitimate interests of EDF Heat Pumps to: – It is necessary for reasons of public interest in the area of public health by helping to minimise the spread of a pandemic virus. |
Information we share and who we share it with
There are certain circumstances where we may transfer your personal data to employees, contractors and to other third parties. Some examples of when your personal information is transferred to other third party organisations are as follows:
- We may share information about you with other members of our group of companies so that we can provide the best service across our group.
- We may also share your information with certain contractors or service providers and they may process your personal data for us. They are always required to meet our standards on processing information and security. The information we provide them, including your information, will only be provided in connection with the performance of their function;
- If we’re discussing selling or transferring part or all of our business – the information may be transferred to prospective purchasers under suitable terms as to confidentiality – or if sold, to buyers who can continue to provide services to you;
- If we’re required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority – for example, the Police and OFGEM – or to defend any legal claims.
- Your personal data may be shared if it is made anonymous and aggregated, as in such circumstances the information will cease to be personal data
Where your information will be held
When we share your information, your information may be transferred outside the European Economic Area. We will only transfer data to jurisdictions outside the scope of the General Data Protection Regulation (GDPR) where the appropriate safeguards required by the GDPR are in place. We store our information on cloud servers and may engage vendors which do not always have equivalent data protection laws to those applicable in Europe. The transfer of this information is therefore governed by a contract including standard contractual clauses (SCCs) approved by the European Commission.
We will keep your information for as long as it is reasonably necessary. It will depend on factors such as whether you are working on our site or have attended one of our visitor centres recently. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
Your rights
You may have certain rights in relation to your information including a right to access or to correct the information we hold on you. Some of these rights will only apply in certain circumstances, however, such as the right to be forgotten or the right to request that we move your information to another company. They will generally not be available if there are outstanding contracts between us if you continue to be employed as a contractor on one of our sites, if we required by law to keep the information or if the information is relevant to a legal dispute.
- You can ask us to confirm if we are processing your information
- You can ask for access to your information
- You can ask to correct your information if it’s wrong
- You can ask us to delete your information (the right to be forgotten), but only in certain cases
- You can ask us to restrict how we use your information, but only in certain cases
- You can ask us to help you move your information to other companies, but only in certain cases
- You can object to us processing your information based on legitimate interests, but only in certain cases
- You can object to processing your information in relation to direct marketing
- You can ask us to stop using your personal information, but only in certain cases
- You have the right to complain to the relevant supervisory authority
If you would like to exercise or discuss any of these rights, please send the Data Protection Officer an email at dpo@edfenergy.com or a letter at EDF Energy, Nova North, 11 Bressenden Place, Victoria, London, SW1E 5BY.
Security and Accuracy
We are committed to keeping your personal information safe. We’ve got physical, technical and administrative measures in place to prevent unauthorised access or use of your information. We also require that our suppliers protect such information from unauthorised access use and disclosure. We will also routinely refresh our information to ensure we keep it up-to-date.
Website terms and conditions and cookies
Our website terms and conditions can be found on this page.
Cookie Policy
CB Heating (T/A EDF Heat Pumps) Cookies
This section tells you how we use cookies on all CB Heating (T/A EDF Heat Pumps) websites and how you can manage them
What are cookies?
Cookies are small text files that are stored on your computer by your web browser. We use them to identify how visitors arrive at our site and the subsequent path they take through it. This helps us to improve our service to you.
CB Heating (T/A EDF Heat Pumps) does not use cookies to collect or store Personally Identifiable Information (PII).
How to control the use of cookies
Manage my cookie preferences
If you wish to restrict or block cookies set by this Website or any other website, you can do this through your browser settings. The “Help” function within your browser should show how to do this. Alternatively, you can find more details on how to control or delete cookies at www.allaboutcookies.org
Please note that you may be unable to use many of the services on our Website Apps or other websites without cookies.
How CB Heating (T/A EDF Heat Pumps) uses cookies
Our website currently uses cookies, and some of our third-party suppliers use our Website to set cookies on our behalf for internet marketing and performance optimisation.
While on this Website, your web browser may interact with content from different servers, and therefore, cookies from other sources may be set on your computer during a visit to this site.
CookieYes cookies
CB Heating (T/A EDF Heat Pumps) uses CookieYes cookies to store information about your visit to our site, helping us understand how our site is being used. We use this information to show you different content that best fits your needs, as well as allow us to test what type of content is most popular, thus improving the user experience. All information is anonymous. These cookies do not identify you as an individual.
Use the tabs below to view a description of the types of cookies that are used, why they are used and details of the individual cookies.
CookieYes
We use CookieYes to understand if there are errors or load issues on our website or app so we can identify and fix any issues as quickly as possible.
These cookies are necessary for the Service to function and cannot be switched off in our systems. They are usually only set in response to actions made by you that amount to a request for services. Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, which may affect how the website functions.
These cookies’ are associated with software from CookieYes, an application performance management.
Cookie List
Cookie List
A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:
Strictly Necessary Cookies
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
Functional Cookies
These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
CB Heating (T/A EDF Heat Pumps) takes the protection of our customer’s information very seriously.
For security reasons, as with all organisations, it wouldn’t be appropriate to disclose specific details on how we protect information. We’ve taken a ‘defence in depth’ approach to Information Security, especially regarding our online services.
Our systems are kept up-to-date, and we test our online services to ensure they’re secure and prevent unauthorised access.
| gstatic.com | rc::c | Third party | Necessary | Session |
| gstatic.com | rc::f | Third party | Necessary | Session |
| .cbheating.co.uk | __hssrc | First party | Performance | Session |
| .cbheating.co.uk | pys_start_session | First party | Analytics | Session |
| .c.clarity.ms | SM | Third party | Analytics | Session |
| .cbheating.co.uk | _clsk | First party | Analytics | Session |
| googletagmanager.com | _gcl_ls | Third party | Marketing | Persistant |
| connect.facebook.net | lastExternalReferrer | First party | Marketing | Persistant |
| connect.facebook.net | lastExternalReferrerTime | First party | Marketing | Persistant |
| .cbheating.co.uk | __hssc | First party | Performance | A few minutes |
| .cbheating.co.uk | _hssc | First party | Performance | A few minutes |
| .cbheating.co.uk | pys_session_limit | First party | Analytics | A few minutes |
| analytics.freespee.com | AWSALB | Third party | Necessary | 7 days |
| analytics.freespee.com | AWSALBCORS | Third party | Necessary | 7 days |
| analytics.freespee.com | AWSALBTG | Third party | Necessary | 7 days |
| analytics.freespee.com | AWSALBTGCORS | Third party | Necessary | 7 days |
| .cbheating.co.uk | last_pysTrafficSource | First party | Analytics | 7 days |
| .cbheating.co.uk | pys_first_visit | First party | Analytics | 7 days |
| .cbheating.co.uk | pys_landing_page | First party | Analytics | 7 days |
| .cbheating.co.uk | pysTrafficSource | First party | Analytics | 7 days |
| .cbheating.co.uk | last_pys_landing_page | First party | Analytics | 7 days |
| .google.com | AEC | Third party | Security | 6 months |
| .google.com | __Secure-BUCKET | Third party | Marketing | 6 months |
| .cbheating.co.uk | _fbp | Third party | Marketing | 3 months |
| _gcl_au | Third party | Marketing | 3 months | |
| .cbheating.co.uk | _gcl_au | First party | Marketing | 3 months |
| .cbheating.co.uk | _fbp | First party | Marketing | 3 months |
| www.clarity.ms | CLID | Third party | Analytics | 2 years |
| www.clarity.ms | C | Third party | Necessary | 2 years |
| .cbheating.co.uk | _clck | First party | Performance | 2 years |
| .cbheating.co.uk | _ga_# | First party | Performance | 2 years |
| .cbheating.co.uk | _ga | First party | Analytics | 2 years |
| .google.com | NID | Third party | Marketing | 2 days |
| .cbheating.co.uk | hubspotutk | Third party | Analytics | 180 days |
| .cbheating.co.uk | __hstc | First party | Performance | 180 days |
| cbheating.co.uk | cookieyes-consent | First party | Necessary | 1 year |
| cbheating.co.uk | cookieyesID | First party | Necessary | 1 year |
| .hubspot.com, .hsforms.com, vimeo.com, glassdoor.co.uk | __cf_bm | Third party | Necessary | 1 day |
| .doubleclick.net | test_cookie | Third party | Marketing | 1 day |
If you have any concerns or complaints about our privacy activities, you can contact us on info@cbheating.co.uk. You can also contact the Information Commissioner’s Office on 0303 123 1113 (www.ico.org.uk).
Third parties EDF Heat Pumps may share data with / work alongside
| Third parties EDF Heat Pumps may share data with / work alongside |
| Acoole |
| BUS/OFGEM |
| Carno Heat Ltd |
| CITY PLUMBING |
| DAIKIN |
| Edinburgh Boiler company Ltd |
| GREENMILL |
| Haste |
| Heatable Ltd |
| HEIS Ltd |
| Homley Ltd |
| HPIN NETWORK |
| HubSpot |
| IDEAL |
| IWA Group Ltd |
| Job Watch/Big Change |
| Macbrook Gas Ltd |
| MCS – MPAN NUMBERS |
| MPX |
| NAPIT |
| PROPCERT |
| SECON |
| TRAVIS PERKINS |
| TRIANCO |
| UKPS |
| YESSS ELECTRICAL |
| Clivet |
| Midea |
| UK Power Networks |
| National Grid (electricity Distribution) |
| SP Energy networks (Scottish Power) |
| Northern Powergrid |
| Electricity Northwest |
| Scottish and Southern Electricity Networks |
| SP Energy networks |
| Nothern Powergrid |
| GTC |
| ESP Electricity |
| Last Mile Asset Management |
| N/A |
| Harlaxton |
| Peel Electricity |
| UK Power Distribution Limited |
| Energy Assets Networks |
| G2 Energy IDNO Limited |
| Murphy Power Distribution |
Third parties we receive personal information from
| EDF |
| Acoole |
| bus/ofgem |
| Carno Heat Ltd |
| Haste |
| HEIS Ltd |
| Homley Ltd |
| HPIN Network |
| HubSpot |
| Ideal |
| IWA Group Ltd |
| Job Watch/Big Change |
| mcs – mpan numbers |
| napit |
| propcert |
| Dakin |
| Clivet |
| Midea |
| Traianco |
| UK Power Networks |
| National Grid (electricity Distribution) |
| SP Energy networks (Scottish Power) |
| Northern Powergrid |
| Electricity Northwest |
| Scottish and Southern Electricity Networks |
| SP Energy networks |
| Nothern Powergrid |
| GTC |
| ESP Electricity |
| Last Mile Asset Management |
| N/A |
| Harlaxton |
| Peel Electricity |
| UK Power Distribution Limited |
| Energy Assets Networks |
| G2 Energy IDNO Limited |
| Murphy Power Distribution |
Contractors and service providers we share personal information with
| NAPIT |
| PROPCERT |
| TRIANCO |
| Ideal |
| Daikin |
| Midea |
| Trianco |
| Clivet |
| UK Power Networks |
| National Grid (electricity Distribution) |
| SP Energy networks (Scottish Power) |
| Northern Powergrid |
| Electricity Northwest |
| Scottish and Southern Electricity Networks |
| SP Energy networks |
| Nothern Powergrid |
| GTC |
| ESP Electricity |
| Last Mile Asset Management |
| N/A |
| Harlaxton |
| Peel Electricity |
| UK Power Distribution Limited |
| Energy Assets Networks |
| G2 Energy IDNO Limited |
| Murphy Power Distribution |
NOTES
Indicative pricing
1. The price above reflects the £7,500 government boiler upgrade scheme and is based on our lowest priced heat pump, cylinder and controls. The figure quoted does not reflect any radiator upgrades that may be required. Your individual quote will be specific to you and your requirements may rise depending on the system required to suit your home.
Boiler upgrade scheme
2. Eligibility checks apply. Visit the UK Government website for details.
A typical customer can save £164 per year versus the current single-rate price cap tariff. This is based on the following;
3. Savings are based on a customer using Ofgem’s typical domestic consumption of 2700 kWh electricity and with heating provided by an ASHP with COP of 3.1 providing equivalent heat to that from a 94% gas boiler using 11,500 kWh of gas.
Save £260 per year
4. The Energy Saving Trust: Figures are based on fuel prices as of July 2025. Find out more about how we made these calculations. The running cost you can expect will depend on the size of your home, any heating system upgrade and any saving will also depend on the fuel type being replaced. You can expect the saving to range between old and new, depending on the age of your current heating system.
Efficiencies
5. Heat Pump investment roadmap, UK Government
The Heat Pump Promise
6. With our Heat Pump Promise if your heat pump doesn’t perform as promised, we’ll give you a refund. Terms & Conditions apply