My Test Certs Gas: Privacy Policy

Last updated: 5 November 2026.

The short version: we keep your account and your records safe, we only use them to run the service you pay for, we never sell them, and you can take them or delete them at any time.

1. Who we are

This policy is for the My Test Certs Gas app and website, run by My Test Certificates Limited, trading as My Test Certs Gas, a company registered in England and Wales (company number 17556814), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“we”, “us”). You can contact us about your data at support@mytestcertsgas.co.uk. We are registered with the Information Commissioner's Office (registration reference ZC291481).

There are two kinds of personal data here, and our role is different for each:

Your own details (you, the engineer, and the people you add to your account): we are the controller. We decide why and how it is used. This policy explains that.
Your customers' details that you put into the app (names, addresses, phone numbers, emails, signatures, photos, notes, and the certificates and quotes about them): you are the controller and we are your processor. We only handle it to provide the service, on your instructions. Section 8 explains what that means. If you are a customer of an engineer, that engineer's own privacy notice applies to you, and you should ask them about your data.

2. What we collect

Account details: name, email address, Gas Safe ID, business name, address and contact details, qualifications you choose to show (and, if you ask for expiry reminders, the ACS expiry dates you type in), your logo, and your password (we store only a one-way scrambled version, never the password itself).
Your business settings: bank details, company and VAT numbers, labour rate and invoice settings that you choose to add so they print on your documents.
Your records: certificates, quotes, invoices, job notes and customer lists, including your customers' names, addresses, phone numbers and emails, signatures drawn on screen, and job photos.
Payment and billing details: handled by Stripe. We never see or store your card number. We keep your Stripe customer reference, plan and subscription status.
Technical data: basic server records such as IP address, time, browser type and errors, kept to keep the service secure and to fix faults.
Messages to us: emails you send to our support address, messages sent through the contact forms on our websites (your name, email address and message, and which of our websites you used), and what we reply.

We do not collect your GPS location. We do not knowingly collect sensitive personal information about your customers, such as health details. Please do not type that kind of information into notes. We do not use your data for automated decisions about you.

3. Why we use it, and our legal basis

What we do	Legal basis
Create and run your account, and provide the app, including storing and sending your documents	Contract (you asked us to provide the service)
Take payment and keep accounting records	Contract, and legal obligation
Send service emails: password resets, trial and billing notices, warnings before records are deleted, invitations to join a team	Contract
Keep the service secure, prevent misuse (including repeat free trials), fix faults and improve it	Legitimate interests (running a safe and reliable service)
Answer your questions and complaints	Contract and legitimate interests
Meet legal duties, and respond to lawful requests from authorities	Legal obligation

We do not sell your data. We do not send marketing emails unless you have asked for them, and you can stop them at any time. We do not use advertising or tracking cookies.

4. Who we share it with

We only share data with companies that help us run the service, and only what they need:

Provider	What they do	Where
Render	Hosts our servers and stores the data	Frankfurt, Germany
Stripe	Takes card payments and manages subscriptions	UK, EU and US
Resend	Sends emails for us, including certificates, quotes and invoices you choose to send to your customers	US

Other engineers on your company account can see the company's shared records. We may also share data with our accountants, lawyers and insurers where needed, with HMRC and other authorities where the law requires it, and with a buyer if the business is ever sold, in which case this policy would carry on to apply. We do not allow any of these to use your data for their own purposes.

5. Transfers outside the UK

Germany is covered by the UK's decision that the EU gives adequate protection. Stripe and Resend can handle data in the United States. Where that happens we rely on the safeguards the UK law allows, such as the UK–US data bridge for certified companies or the approved standard contract terms. Ask us if you would like to know which applies to a particular provider.

6. How we keep it safe

Connections to the app are encrypted. Passwords are stored in scrambled form. Access to the servers and data is limited to what the work needs, and your account only shows your own company's records. No system is perfect. If there is a breach that puts people at risk, we will tell you without undue delay, and tell the Information Commissioner's Office where the law says we must.

7. How long we keep it

Data	How long
Your account and records	While your account is open, and for 24 months after it ends. We email you about 60 and 30 days before they are deleted. If you start a paid plan again before then, nothing is lost.
If you delete your account in the app	Your records are deleted straight away. Copies in our backups are overwritten within 30 days.
Invoices and payment records	For as long as the law requires for tax, currently 6 years.
Server records (logs)	Only as long as needed for security and to fix faults.
Emails to our support address	For as long as needed to help you and to keep a record of what was agreed.

If we ever close the service, we will give you at least 90 days' notice so you can download your records first.

8. Your customers' details: our role as your processor

When you put your customers' details into the app, you decide what goes in and why, and we handle it for you. You must have a lawful reason to hold it and must tell your customers how you use it. By using the service you instruct us to handle it as follows, and we agree to:

use it only to provide the service to you, and in line with your instructions, including sending the certificates, quotes and invoices that you ask the app to send;
keep it confidential, and make sure only people who need it to run the service can see it;
keep it secure, as set out in section 6;
use only the providers listed in section 4, and tell you before adding a new one that handles your customers' data, so you can object;
help you respond to a customer who asks to see, correct or delete their data, and help you with breaches and with data protection checks, so far as it concerns the data we hold;
tell you without undue delay if we become aware of a breach affecting it;
when your account ends, keep it for the period in section 7 so you can download it, then delete it, or delete it sooner if you ask us to;
give you the information you reasonably need to show that we are doing all this.

These words are the processing agreement between you and us and form part of our Terms of Service.

9. Your rights

You have the right to: see the data we hold about you; have it corrected; have it deleted; ask us to limit how we use it; take a copy of it in a usable format; object to us using it; and withdraw consent where we rely on it. Most of this you can do yourself in the app, including downloading and deleting your records. For anything else email support@mytestcertsgas.co.uk. We will reply within one month, and we do not charge for this unless a request is clearly unfounded or excessive.

If you are not happy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10. Cookies and storage on your device

We use one essential cookie to keep you logged in. The app also saves your records, drafts and job photos in your browser's storage on your device, and keeps a copy of its own pages, so that it works with no signal and your work is not lost. This storage stays on your device until you clear it. We use no advertising, social media or analytics cookies. Because we only use what is essential, no cookie banner is needed.

11. Children

The service is for Gas Safe registered engineers and is not for anyone under 18. We do not knowingly collect data from children.

12. Links to other sites

The app and website may link to other sites, such as the Gas Safe Register. We are not responsible for their privacy practices, so please read theirs.

13. Changes to this policy

We may change this policy. If the change matters, we will tell you by email or in the app before it takes effect. The date at the top shows when it was last updated.