HeatLens installer terms: schedules

Version 2026-09-28. These schedules form part of the HeatLens terms of service for installers.

Schedule A: Processing customer data for installers

1. Who does what

1.1 When you use HeatLens to manage jobs for your customers, you are the controller of your customers' personal data: you decide why and how it is used.

1.2 Building Energy Consultants Ltd, trading as HeatLens ("we"), processes that data on your behalf as your processor. This schedule sets out the terms of that processing.

1.3 Where we use your account data for our own purposes (billing you, supporting you, keeping the service secure), we are a controller of that data under our own privacy notice. This schedule does not cover that.

2. What we process, and why

• Subject matter: hosting and processing the job records you create or receive in HeatLens.
• Duration: for as long as you use HeatLens, then as set out in section 8.
• Nature and purpose: storing, displaying and organising job records; sending messages you ask us to send; receiving enquiries through your enquiry form; producing documents you ask for (reports, submission packs, invoices).
• Personal data: names, email addresses, phone numbers, property addresses and postcodes, property and heating details, meter point numbers (MPAN) and electrical supply details, messages you write, visit dates and notes, invoice and payment records.
• Data subjects: your customers and prospective customers (homeowners, landlords, tenants), and your suppliers' contacts.
• Special category data: none is requested. Please do not record health or other special category information in job notes.

3. Our commitments

We will:

1. process the data only on your documented instructions, which are your use of HeatLens and these terms, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it);
2. make sure everyone we authorise to process it is under a duty of confidentiality;
3. keep appropriate technical and organisational security measures in place, including access controls that limit your records to your account or company, encrypted transport, and server-side checks on anything sent from the platform;
4. use sub-processors only as set out in section 4;
5. help you, as far as reasonably possible, to respond to your customers' requests to exercise their rights, including by letting you find, export and delete a customer's records;
6. help you meet your obligations on security, breach notification and, where relevant, data protection impact assessments;
7. tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data;
8. at the end of the service, delete or return your data as set out in section 8;
9. make available the information you reasonably need to show we meet these commitments, and allow for audits by you or an auditor you appoint, on reasonable notice and no more than once a year unless a breach or regulator requires it.

4. Sub-processors

4.1 You give general authorisation for us to use these sub-processors:

• Base44 (application hosting, database and email), under Base44's data processing agreement, including its safeguards for any transfer outside the UK.
• Google (Gmail) or Microsoft (Microsoft 365), only if you connect your own mailbox, to send messages from it.
• Meta Platforms (WhatsApp Business Platform), only if you turn on WhatsApp alerts, to send alerts to your own phone.

4.2 We will tell you at least 30 days before adding or replacing a sub-processor, so you can object. If you object on reasonable data protection grounds and we cannot resolve it, you may end the service.

4.3 We will put terms on each sub-processor that give your data at least the protection in this schedule, and we remain responsible to you for them.

5. International transfers

Where a sub-processor processes data outside the UK, we will make sure a lawful transfer mechanism is in place, such as UK adequacy regulations or the UK International Data Transfer Addendum.

6. Your commitments

You will:

1. have a lawful basis for the personal data you put into HeatLens and the messages you send;
2. give your customers the privacy information the law requires, including that you use HeatLens to manage their job (the enquiry form links to our notice, which names you as controller);
3. not send marketing through HeatLens without the recipient's consent where the law requires it;
4. review and take responsibility for any message wording you change from our standard templates.

7. Your enquiry form

7.1 If you switch on your enquiry form, enquiries submitted through it are your customers' data under this schedule from the moment they are submitted.

7.2 We show a short notice on the form and link to a fuller notice. You are responsible for your own privacy notice covering how you use enquiries after you receive them.

8. Retention and the end of the service

8.1 Enquiries you do not turn into a job are deleted automatically 12 months after they arrive. Job records are kept for as long as you keep the job. Issued invoices are kept for 6 years after the end of the financial year in which they were issued, even if the job is deleted, so you do not lose records you must keep.

8.2 You can export your job records at any time.

8.3 Within 30 days after your account closes, we will delete your customers' personal data, except where the law requires us to keep it, and from backups on their normal cycle (no longer than 90 days). Export issued invoices before you close your account.

Schedule B: Customer invoices

1. What the feature is

1.1 HeatLens lets you create, issue and print invoices and credit notes to your customers, and record payments you receive. It is a record-keeping and document tool, available on paid plans.

2. You are the supplier

2.1 Every invoice you issue through HeatLens is your invoice, from your business to your customer. HeatLens (Building Energy Consultants Ltd) is not a party to your contract with your customer, or to any invoice, payment, dispute, refund or claim between you.

2.2 HeatLens never takes payment from your customers or holds money for you. Payments are made directly to you, and you record them in HeatLens yourself.

3. VAT and content

3.1 You decide the price and the VAT rate on every line, and any VAT wording on the invoice. HeatLens does not choose a VAT rate, and nothing in HeatLens is tax advice. For VAT on energy-saving materials such as heat pumps, see HMRC's guidance (VAT Notice 708/6) or your adviser.

3.2 HeatLens will not let you charge VAT unless you have entered a VAT registration number, and it records the details legally required on a VAT invoice from the information you provide. You are responsible for that information being correct.

3.3 Grant amounts, deposits and discounts appear only as you enter them.

4. Numbering and records

4.1 HeatLens numbers your invoices in your own sequence (one sequence per company). Once an invoice is issued it cannot be edited or deleted; correct it by issuing a credit note.

4.2 You are responsible for keeping your invoice records for as long as the law requires. You can export them at any time.

5. Disputes and support

5.1 Questions or disputes about an invoice are between you and your customer. If a customer contacts HeatLens, we will direct them to you.

5.2 If you think HeatLens has calculated a total wrongly, contact support@heatlens.co.uk; our liability is as set out in the main terms.

6. Availability

6.1 We may change or withdraw customer invoicing with reasonable notice, and you will always be able to export invoices already issued.