Privacy policy
This notice explains how we use personal information when you use LegionellaSampling.co.uk, buy a sampling kit, subscribe to testing, or contact us.
1. Who we are
We are Legionella Sampling (“we”, “us”, “our”). We operate the website LegionellaSampling.co.uk and provide water sampling kits, arrange analysis by UKAS-accredited laboratories, and supply reports and practical guidance to organisations managing water systems.
- Website: https://legionellasampling.co.uk
- Email: hello@legionellasampling.co.uk
We are the controller of personal data used to run this website and to supply those services. The laboratory is a separate controller or processor for sample analysis, depending on the contract in place. Site duty holders remain responsible for their own water-hygiene records.
2. How to contact us about your data
For privacy questions or to use your rights, email hello@legionellasampling.co.uk with the subject “Data protection”. We do not currently have a statutory data protection officer. If that changes, we will publish the contact details here.
3. The information we collect
Information you give us
- Identity and role: name, job title, and organisation.
- Contact details: email address, telephone number, billing address, and delivery address.
- Order and account details: kits or bundles ordered, subscription preferences, purchase history, and correspondence about an order.
- Site information needed to interpret a sample: premises name and address, outlet or system description, sample date and time, and any notes you add to the chain-of-custody form. This is usually business information. It can be personal data if it identifies a sole trader, a domestic customer, or a named individual at a small site.
- Enquiry and support messages, including anything you type into a contact form.
- Payment references. Card payments are taken by our payment provider. We do not store full card numbers or security codes.
Information collected automatically
- Technical data such as IP address, browser type, device type, referring URL, and pages viewed.
- Cookie and similar-technology data, as described in our cookie policy.
We do not ask for special-category data (such as health information) or information about children. Please do not send us patient, resident, or employee health details. If an outbreak or incident is mentioned in correspondence, we will use only what is needed to handle the sample or enquiry and will not use it for marketing.
The website and services are aimed at businesses and organisations, not at children.
4. Why we use personal information, and the lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Take and fulfil orders, dispatch kits, arrange courier return, and send reports | Identity, contact, order, site and sample details | Contract (UK GDPR Art. 6(1)(b)) |
| Run subscriptions, reminders, and repeat deliveries you have asked for | Identity, contact, order and preference data | Contract |
| Take payment, prevent fraud, and keep accounting records | Identity, contact, transaction references | Contract; legal obligation (tax and accounting); legitimate interests in preventing fraud |
| Customer service, complaints, and technical support | Contact and correspondence | Contract, or legitimate interests in running a responsible service |
| Send service messages about an order, a delayed sample, or a result that needs action | Contact and order data | Contract, or legitimate interests in delivering the service you bought |
| Send optional product updates or offers | Name, email, organisation, and message preferences | Consent, or the soft-opt-in under PECR where the law allows it for similar products bought from us. You can opt out at any time. |
| Improve the website, measure traffic, and keep it secure | Technical and cookie data | Legitimate interests for strictly necessary security and operation. Consent for optional Google Analytics, Google Ads and Mailchimp popup cookies and browser storage. |
| Meet legal, regulatory, or insurance requests | Records we are required to keep | Legal obligation, or legitimate interests in establishing or defending a claim |
Where we rely on legitimate interests, those interests are running a water-sampling business, keeping the site secure, recovering debts, and improving the service. We balance these against your rights and will not use legitimate interests for unsolicited marketing where consent or a PECR exception is required.
You do not have to provide data, but we cannot supply a kit, take payment, or issue a report without the details needed for that order.
5. Who we share information with
We share personal information only where it is needed:
- UKAS-accredited laboratories that analyse samples and produce certificates. They receive sample and site identifiers, and contact details if needed to report a result or a sample problem.
- Couriers and postal providers for kit delivery and prepaid sample return.
- Payment providers to take card or other electronic payments.
- Website, hosting, email, and shop-platform suppliers who process data on our instructions.
- Professional advisers such as accountants, insurers, and lawyers, where necessary.
- Regulators, law enforcement, or a court if we are required to disclose information, including the Health and Safety Executive or a local authority where the law requires it.
- A buyer of the business, if we sell or restructure the company, under appropriate confidentiality terms.
We do not sell personal information. We do not use it to build advertising profiles for third parties.
6. International transfers
We aim to keep personal information in the United Kingdom. Some suppliers (for example email, hosting, or payment tools) may process data in the UK, the European Economic Area, or a country covered by UK adequacy regulations. If a transfer is made to a country without an adequacy decision, we use an approved safeguard such as the UK International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses, plus a transfer risk assessment where required.
7. How long we keep information
- Order, invoice, and payment records: 6 years from the end of the financial year, to meet tax and accounting duties.
- Sample reports and chain-of-custody records: 6 years from the report date, because clients and regulators may need them for water-hygiene compliance. We can delete them sooner if you ask and we have no duty to keep them.
- Enquiry emails that do not lead to an order: 24 months.
- Marketing preferences: until you withdraw consent or opt out, then a short suppression record so we do not contact you again.
- Website server logs: normally up to 12 months.
We may keep information for longer if it is needed for a legal claim.
8. Security
We use appropriate technical and organisational measures, including access controls, encrypted connections (HTTPS), and suppliers that are required to protect the data they process for us. No online service is completely secure. Please use a business email address you control for reports.
9. Your rights
Under UK data protection law you may have the right to:
- access the personal information we hold about you;
- correct inaccurate information;
- erase information, in some cases;
- restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
- receive portable information you provided to us, where processing is by automated means and based on contract or consent;
- withdraw consent at any time, without affecting processing already carried out;
- complain to the Information Commissioner’s Office (ICO).
To use these rights, email hello@legionellasampling.co.uk. We may need to confirm your identity. We aim to respond within one month.
You can complain to the ICO at ico.org.uk/make-a-complaint, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would like the chance to put things right first.
10. Changes
We will update this notice if our services or the law change. The date at the top will change. If a change is significant, we will also tell active customers by email where we have an address for them.