Privacy Notice
Last updated: June 2026
Towsty Privacy Notices
Correla understands the importance of protecting personal information and is committed to complying with the UK GDPR, UK Data Protection Act (DPA 2018) and any other data protection legislation applicable to the processing of personal data.
Please select the relevant Privacy Notice:
Customer Privacy Notice – for homeowners and tenants using the Towsty.co.uk website
Installer Privacy Notice – for installers using the Towsty.co.uk website and participating in the Towsty Partner Programme
This website is not intended for children, and we do not knowingly collect data relating to children.
Customer Privacy Notice
This notice applies to personal data processed in relation to the towsty.co.uk website (“our site”). Our site is operated by Correla Limited. We are registered in England and Wales under company number 13062055 and have our registered office at Lansdowne Gate, 65 New Road, Solihull, England, B91 3DL. Correla Limited is the controller and responsible for your personal data (collectively referred to as "Correla", "we", "us" or "our" in this privacy notice).
If you’re a homeowner or tenant using the Towsty.co.uk website, we may process your personal data in the following ways:
The personal information we collect and use:
In order to provide our services to you, we collect, use and are responsible for processing personal data to deliver those services. We collect that either directly from you or from third parties. Regardless of the source of data, Correla are committed to protecting your personal data and to ensuring that your personal information is used properly, lawfully and transparently. For more information on lawful basis, find guidance here
Purpose/Use | Type of Data | Lawful Basis |
To generate and provide you with an automated heat pump installation cost estimate and projected energy savings. | (a) Details you provide to us about you and your property (e.g., your name, email address, property address, number of radiators, information about your property and home ownership); (b) Details we obtain from third parties about your property (e.g., EPC data, floor area, current heating system, age of property). | Performance of a contract (to deliver the service you requested). |
To connect you with independent heat pump installers (if you ask us to) so they can contact you to arrange a quote. | (a) Name, email address, telephone number, address/postcode); (b) Relevant property and energy details (e.g., property type, size, current heating system). | Performance of a Contract (to provide you with the service you have requested) |
To contact you about our products and services for marketing purposes, by email, (depending on your preferences) | (a)Your name and email address); (b) Marketing preferences (record of your consent). | Consent (you will receive marketing only where you have provided your consent; you can withdraw your consent at any time). |
To improve the products and services we offer our customers, we may carry out data analysis. | (a) Homeowner/ tenant address, relevant property details (e.g. property type, number of rooms, current heating system, age of property, homeowner status) (b) We may receive updates from installers, with whom your information has been shared, regarding the status and outcome of your quote. | Legitimate interests – we process your data because we have a legitimate interest in doing so. |
To administer our website and improve user experience and the service we offer to our customers, we may analyse user behavior on our website. This includes troubleshooting issues, monitoring for fraud or security threats and data analysis. | (a) Technical and usage data about how you use our website (b) IP address (c)Name and email address | Legitimate interests – we process your data because we have a legitimate interest in doing so. Unless the law requires your consent to deploy cookies or tracking technology (see also our Cookie Policy). |
To comply with legal or regulatory obligations, and to establish or defend legal claims (including enforcing our terms). | (a) Your name, email address (b) Other information relevant to the specific obligation or claim (e.g., details of your request, communications, or use of our service). | Legal obligation (where processing is required by law); Legitimate interests (e.g., to enforce terms or defend claims). |
To contact you with service communications for customer service or administrative purposes by email. | Your name and email address | Legitimate interests – we process your data because we have a legitimate interest in doing so. |
To carry out market research and gather user experience feedback, to help us improve our products and services. We may contact you by email or via the website for this purpose. | Depending on the type of survey, we may collect your: name, email address, telephone number, responses to the questions, IP address. | Legitimate interests – we process your data because we have a legitimate interest in doing so. |
To remember the assessment you have started, so that you can return to the same browser and continue where you left off without losing your answers. | We do not use it for analytics, advertising, profiling, or to identify you as a person. | Legitimate interests. We use strictly necessary cookies for this purpose, which last for 24 hours. |
Sharing your data
Circumstance and provision of service sometimes require the sharing of your data with law enforcement, other data processors such as suppliers of technology, or other data controllers to provide you with a service you’ve requested. We only do this under strict protocols and where we have the correct and sufficient mechanisms and controls in place. We may share your data with:
- Advertising and analytics providers – when you consent to optional technologies, we use Google Ads, Meta Pixel and Hotjar as described in our Cookie Policy.
- EPC database - to obtain property specific insight that informs your estimate.
- Where you ask us to do so, we’ll share your contact details and relevant property information with independent heat pump installers so they can contact you to arrange a quote.
- IT support and infrastructure providers – who support us with the technology to run our business.
- CRM and communication platform providers – providing technology to support us manage customer relationships.
- Survey agencies – in the provision and aggregation of survey results.
- Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
Marketing
You may receive marketing communications by email if you have consented to receiving energy saving tips and Towsty updates from us.
Opting out of Marketing
You can ask us to stop sending you marketing communications at any time by following the unsubscribe links within any marketing communication sent to you or by contacting us at box.correla.privacy@correla.com
If you opt out of receiving marketing communications, you will still receive service-related communications for administrative or customer service purposes.
How long do we keep your information?
We will keep your personal information only as long as is necessary to achieve the processing purposes, or to meet legislative requirements. Personal information will be securely destroyed or put beyond use when it is no longer required, in accordance with our data retention and information management policy.
International Data Transfers
Providers of certain technologies or services may operate from different countries. We operate a UK/Adequate country first policy when undertaking or considering the transfer of your personal data outside of the UK. Where we transfer data outside the UK we rely on the following:
UK GDPR Adequacy decisions: Under the regulation, a number of countries have been deemed adequate in their data protection laws and mechanisms, meaning they have an equivalent level of protection as the UK. For example, the EU has adequate protection.
International Data Transfer Agreements (IDTAs): Where data is to be shared beyond an adequate country, Correla ensures that an IDTA is in place with that supplier, meaning an adequate contractual measure is in place to protect your data.
Your Rights
The UK GDPR facilitates a number of rights for you to access, rectify and delete your data. Your rights are:
- Right to be Informed: You have the right to ask us how and why we are processing your personal data. If we have provided this to you in the form of this privacy notice, we will inform you. Where processing has not been identified in this notice, we will provide you with details of what data we are processing, why we are processing it, where we are processing it, and how it is being processed.
- Right to Access: You have a right to access and have a copy of your information provided to you.
- Right to Rectification: You have the right to have your data updated where inaccuracies have occurred and for that data to be completed, where it remains incomplete.
- Right to erasure (Also known as the Right to be Forgotten): You have a right for your data to be deleted, but only if you meet a particular element of the following criteria:
- We don’t need the data anymore to provide the service or product,
- You have withdrawn your consent for us to process that data,
- If you have objected to the use of your data and we can no longer justify the reason for processing your data,
- You have objected to direct marketing we undertake,
- There is a legal obligation which requires us to erase the data,
- It is found that we have processed the data unlawfully,
- You wish us to erase the data based on it being processed.
- Right to restrict processing: You have the right to restrict us from processing your data if:
- You don’t believe the data we are processing about you is accurate,
- The data we are processing has been obtained without a lawful basis, and you wish to restrict the processing rather than delete it
- You wish us to retain the data when it is no longer needed by us to provide the service, in support of a legal claim
- Where you have objected to the processing of your data and we are in the process of considering the legitimate interest we have in processing it
- Right to data portability: Where you have provided data to us and Correla is the Data Controller, you have the right to be provided with your data in a format that enables you to transfer that data to another provider.
- Right to object to processing: You have the right to object to our processing of your personal data where:
- We are directly marketing to you – this is an absolute right.
- Where we are processing under legitimate interest. This is not an absolute right, and we may continue to process your data if our legitimate interest is compelling for the continuation of processing
- We are processing the data under the lawful basis of ‘Public Task’.
- Rights relating to automated decision making and profiling: Where we undertake automated decision making as part of our services or products (in which your personal data is or can be processed) you can request:
- Information on those automated decisions and profiling outputs,
- Human intervention where you are challenging a decision presented by the automated process,
- Information on the regularity of the checks we carry out to ensure the systems generating those decisions are working as intended.
Exercise Your Rights
To exercise any of the rights above, please email the Correla privacy team stating:
- The right(s) you wish to exercise
- Any specifics relating to the data that may help us identify and implement your request.
The email for the Correla Privacy team is: box.correla.privacy@correla.com
We reserve the right to request identification from you to verify your request and to ensure accuracy and security of any data provided under the exercising of your rights.
You can also exercise any of the rights above by writing to us. Please mark your letter: ‘FAO Correla Data Protection Officer.’
Our address is: Correla Ltd, Lansdowne Gate, 65 New Road, Solihull, B91 3DL
Personal Data Security
We are committed to making sure we keep your personal data confidential and implement and manage data security measures that are applicable to the processing we do. We adhere to, and are accredited against, the following standards:
- ISO27001: 2022
- NIST
The standards above are supplemented by a robust set of controls and policies that mean our Correla team are trained in data protection responsibilities and how to secure your personal data.
We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Making a complaint
If you are dissatisfied with the way we’ve handled your personal information, you should raise it with us before contacting the Information Commissioner’s Office (ICO).
We aim to handle all complaints promptly and fairly. Where issues are identified, we will take appropriate steps to resolve them and improve our processes.
We’ll acknowledge receipt of any complaint within 30 days, beginning from the date that the complaint is received. We’ll investigate your concerns and inform you of the outcome of your complaint without undue delay.
You can contact us with the details of your complaint by:
- Email at box.correla.privacy@correla.com or
- Post at Correla Ltd, Lansdowne Gate, 65 New Road, Solihull, B91 3DL and mark the envelope ‘FAO Correla Data Protection Officer’
If we do not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioners Office (ICO). To contact the ICO, visit their website https://ico.org.uk/concerns/
or
You can contact them directly on the ICO helpline: 0303 123 1113.
Changes to this privacy notice
You may request a copy of this privacy notice from us using the contact details set out above. We may modify or update this privacy notice from time to time.
Third-party links
This website may include links to third-party websites, plug-ins and applications.
Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.
Installer Privacy Notice
This notice applies to personal data processed in relation to you participation in the Towsty Partner Programme (the “Programme”) via the towsty.co.uk website (“our site”). Our site is operated by Correla Limited. We are registered in England and Wales under company number 13062055 and have our registered office at Lansdowne Gate, 65 New Road, Solihull, England, B91 3DL. Correla Limited is the controller and responsible for your personal data (collectively referred to as "Correla", "we", "us" or "our" in this privacy notice).
If you’re an installer using the Towsty.co.uk website to participate in the Towsty Partner Programme we may process your personal data in the following ways:
The personal information we collect and use:
In order to provide our services to you, we collect, use and are responsible for processing personal data to deliver those services. We collect that either directly from you or from third parties. Regardless of the source of data, Correla is committed to protecting your personal data and to ensuring that your personal information is used properly, lawfully and transparently. For more information on lawful basis, find guidance here
Purpose/Use | Type of Data | Legal Basis |
To verify that you hold a valid MCS certification. | Your MCS certificate number, certificate expiry date, certification body and the technology types certified for. | Performance of a Contract |
To register your participation within the Towsty Partner Programme and to administer the contract with you including billing and payments. | Your name, email address, telephone number, company name, job title, payment data including Stripe customer and subscription IDs and status (card details are processed by Stripe). | Performance of a contract |
To verify your identity when you register to join the Towsty Partner Programme. | (a) Valid passport or driving license and your image/selfie. (b) Biometric identifiers (distinctive physiological characteristics of your face). | Explicit consent to verify your identity using biometric identifiers. See also ‘Sharing your data’. (If you do not wish to provide your consent for biometric verification, we will be unable to process your application at this time). |
To analyse lead outcomes, to improve the products and services we offer our customers. | Information you provide us about the status and outcomes of any leads you claim. | Legitimate interests – we process your data because we have a legitimate interest in doing so. |
To contact you about our products and services for marketing purposes, by email, SMS or Whatsapp (depending on your preferences) | (a) Your name, company name and address, email address, telephone number, job title; (b) Your marketing preferences. | Consent, or Legitimate interests (where permitted to do so by law). You can opt out at any time – see also the ‘Marketing’ section below. |
To administer our website and improve user experience and the service we offer to our customers, we may analyse user behavior on our website. This includes troubleshooting issues, monitoring for fraud or security threats and data analysis. | (a) Technical and usage data about how you use our website (b) IP address (c) Name, email address | Legitimate interests – we process your data because we have a legitimate interest in doing so. Unless the law requires your consent to deploy cookies or tracking technology (see also our Cookie Policy). |
To comply with legal or regulatory obligations, and to establish or defend legal claims (including enforcing our terms). | (a) Your name, email address, telephone number; (b) Other information relevant to the specific obligation or claim (e.g., details of your request, communications, or use of our service). | Legal obligation (where processing is required by law); Legitimate interests (e.g. to enforce terms or defend claims). |
To respond to your queries via your requested contact method (email, telephone, SMS, Whatsapp). | Your name, email address, telephone number, and details you share with us regarding your query or request. | Legitimate Interests – we process your data because we have a legitimate interest in doing so. |
To contact you with service communications for customer service, relationship management or administrative purposes, by email, telephone, SMS or Whatsapp. | Your name, email address, telephone number | Legitimate interests – we process your data because we have a legitimate interest in doing so. |
To carry out market research and gather user experience feedback, to help us improve our products and services and include anonymous testimonials within our promotional materials. We may contact you by email, SMS, telephone, or in-app for this purpose. | Depending on the type of survey, we may collect your: name, email address, telephone number, responses to the questions, IP address. | Legitimate interests – we process your data because we have a legitimate interest in doing so. |
To use your identifiable testimonials within our promotional materials. | Your name, company name, job title, and testimonial. | Consent – we'll only publish details that identify you, if you provide us with your consent to do so (you can withdraw your consent at any time). |
To remember the assessment you have started, so that you can return to the same browser and continue where you left off without losing your answers. | We do not use analytics, advertising, profiling, or to identify you as a person. | Legitimate interests. We use strictly necessary cookies for this purpose, which last for 24 hours. |
Sharing your data
Circumstance and provision of service sometimes require the sharing of your data with law enforcement, other data processors such as suppliers of technology, or other data controllers to provide you with a service you’ve requested. We only do this under strict protocols and where we have the correct and sufficient mechanisms and controls in place. We may share your data with:
- Advertising and analytics providers – when you consent to optional technologies, we use Google Ads, Meta Pixel and Hotjar as described in our Cookie Policy.
- Payment provider - when you claim a lead via the Towsty Partner Programme, we use a third-party payment provider Stripe to facilitate card payments on our behalf. We may receive billing information such as your Stripe customer and subscription IDs but all card details are handled by Stripe.
- Risk and identity verification service provider – when you register with the Towsty Partner Programme we use a third-party Stripe to provide risk and verification services. Correla and Stripe are separate data controllers of personal data, and Stripe will process personal data in accordance with Stripe’s Privacy Policy to operate and improve the services it provides, in addition to acting as our service provider. You can learn more about Stripe and read its privacy policy here. Using the Stripe identity services may include transmitting data outside of the UK, including to the United States and may be submitted to third-party service providers, including Governmental Authorities, for the purpose of evaluating a Submitted Individual.
- IT support and infrastructure providers – who support us with the technology to run our business.
- CRM and communication platform providers – providing technology to support us manage customer relationships.
- Survey agencies – in the provision and aggregation of survey results.
- Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
Marketing
Depending on your preferences you may receive marketing communications by email, SMS, telephone about Correla’s products and services, if you have provided your consent or have not opted out of receiving marketing communications from us (where permitted to do so by law).
Opting out of Marketing
You can ask us to stop sending you marketing communications at any time by following the unsubscribe links or instructions within any marketing communication sent to you or by contacting us at box.correla.privacy@correla.com
If you opt out of receiving marketing communications, you will still receive service-related communications for administrative or customer service purposes.
How long do we keep your information?
We will keep your personal information only as long as is necessary to achieve the processing purposes, or to meet legislative requirements. Personal information will be securely destroyed or put beyond use when it is no longer required, in accordance with our data retention and information management policy.
International Data Transfers
Providers of certain technologies or services may operate from different countries. We operate a UK/Adequate country first policy when undertaking or considering the transfer of your personal data outside of the UK. Where we transfer data outside the UK we rely on the following:
UK GDPR Adequacy decisions: Under the regulation, a number of countries have been deemed adequate in their data protection laws and mechanisms, meaning they have an equivalent level of protection as the UK. For example, the EU has adequate protection.
International Data Transfer Agreements (IDTAs): Where data is to be shared beyond an adequate country, Correla ensures that an IDTA is in place with that supplier, meaning an adequate contractual measure is in place to protect your data.
Your Rights
The UK GDPR facilitates a number of rights for you to access, rectify and delete your data. Your rights are:
- Right to be Informed: You have the right to ask us how and why we are processing your personal data. If we have provided this to you in the form of this privacy notice, we will inform you. Where processing has not been identified in this notice, we will provide you with details of what data we are processing, why we are processing it, where we are processing it, and how it is being processed.
- Right to Access: You have a right to access and have a copy of your information provided to you.
- Right to Rectification: You have the right to have your data updated where inaccuracies have occurred and for that data to be completed, where it remains incomplete.
- Right to erasure (Also known as the Right to be Forgotten): You have a right for your data to be deleted, but only if you meet a particular element of the following criteria:
- We don’t need the data anymore to provide the service or product,
- You have withdrawn your consent for us to process that data,
- If you have objected to the use of your data and we can no longer justify the reason for processing your data,
- You have objected to direct marketing we undertake,
- There is a legal obligation which requires us to erase the data,
- It is found that we have processed the data unlawfully,
- You wish us to erase the data based on it being processed.
- Right to restrict processing: You have the right to restrict us from processing your data if:
- You don’t believe the data we are processing about you is accurate,
- The data we are processing has been obtained without a lawful basis, and you wish to restrict the processing rather than delete it
- You wish us to retain the data when it is no longer needed by us to provide the service, in support of a legal claim
- Where you have objected to the processing of your data and we are in the process of considering the legitimate interest we have in processing it
- Right to data portability: Where you have provided data to us and Correla is the Data Controller, you have the right to be provided with your data in a format that enables you to transfer that data to another provider.
- Right to object to processing: You have the right to object to our processing of your personal data where:
- We are directly marketing to you – this is an absolute right.
- Where we are processing under legitimate interest. This is not an absolute right, and we may continue to process your data if our legitimate interest is compelling for the continuation of processing
- We are processing the data under the lawful basis of ‘Public Task’.
- Rights relating to automated decision making and profiling: Where we undertake automated decision making as part of our services or products (in which your personal data is or can be processed) you can request:
- Information on those automated decisions and profiling outputs,
- Human intervention where you are challenging a decision presented by the automated process,
- Information on the regularity of the checks we carry out to ensure the systems generating those decisions are working as intended.
Exercise Your Rights
To exercise any of the rights above, please email the Correla privacy team stating:
- The right(s) you wish to exercise
- Any specifics relating to the data that may help us identify and implement your request.
The email for the Correla Privacy team is: box.correla.privacy@correla.com
We reserve the right to request identification from you to verify your request and to ensure accuracy and security of any data provided under the exercising of your rights.
- You can also exercise any of the rights above by writing to us and marking the envelope ‘FAO Correla Data Protection Officer’
Our address is: Correla Ltd, Lansdowne Gate, 65 New Road, Solihull, B91 3DL
Personal Data Security
We are committed to making sure we keep your personal data confidential and implement and manage data security measures that are applicable to the processing we do. We adhere to, and are accredited against, the following standards:
- ISO27001: 2022
- NIST
The standards above are supplemented by a robust set of controls and policies that mean our Correla team are trained in data protection responsibilities and how to secure your personal data.
We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Making a complaint
If you are dissatisfied with the way we’ve handled your personal information you should raise it with us before contacting the Information Commissioner’s Office (ICO).
We aim to handle all complaints promptly and fairly. Where issues are identified, we will take appropriate steps to resolve them and improve our processes.
We’ll acknowledge receipt of any complaint within 30 days, beginning from the date that the complaint is received. We’ll investigate your concerns and inform you of the outcome of your complaint without undue delay.
You can contact us with the details of your complaint by:
- Email at box.correla.privacy@correla.com or
- Post at Correla Ltd, Lansdowne Gate, 65 New Road, Solihull, B91 3DL and mark the envelope ‘FAO Correla Data Protection Officer’
If we do not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioners Office (ICO). To contact the ICO, visit their website https://ico.org.uk/concerns/
or
You can contact them directly on the ICO helpline: 0303 123 1113.
Changes to this privacy notice
You may request a copy of this privacy notice from us using the contact details set out above. We may modify or update this privacy notice from time to time.
Third-party links
This website may include links to third-party websites, plug-ins and applications.
Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.