Privacy and cookie notice

Under data protection law, we must have a legal basis to process your personal data, and generally speaking we process under one of the following:

1. CONSENT
e.g., usually, we rely on your consent to process your personal data in relation to marketing, market surveys, advertising our products and services and cookies. You can withdraw your consent to this processing at any time.

2. THE INITIATION OR PERFORMANCE OF A CONTRACT WITH YOU OR THE STEPS TAKEN PRIOR TO ENTERING INTO A CONTRACT
e.g., Where you are an existing myREWARDS member, we will be processing your personal data in performing our obligations under the contract with you or if we have not been contacted by you before, many of our services require us to process your personal data prior to entering a contract with you, in both cases, we process your information to enable us to provide our services.

3. LEGITIMATE INTERESTS PURSUED BY US OR BY A THIRD PARTY
We rely on the legal basis of legitimate interests where we process your personal data for our own business purposes, e.g., product monitoring, service quality, handling complaints, statistical use etc. this is being processed for the purposes of the legitimate interests pursued by us or by a third party.

4. COMPLIANCE WITH A LEGAL OBLIGATION
We may need to process your personal data where we have a legal obligation that we are required to comply with, an example might be the police or emergency services, insurance investigations and court orders.

5. VITAL INTERESTS
We will process your personal data when it is necessary to protect your vital interests or the vital interests of a third party.

In particular, we process your personal data in order to identify you on the web app or phone app, and to ensure data security of the homeowner. To provide you with our product performance data on your installations. To receive any help and feedback you wish to give. Specific details of the legal basis we rely on for each of our products and services can be found in the relevant product and service sections to follow.

Most of the personal data that is used in myVaillant Pro Service will come from you and/or your myREWARDS membership account. For full details of the processing of your personal data in your myREWARDS account, see the separate privacy and cookie notice HERE

We may also collect personal data from third parties that provide us with services for the operation of myVaillant Pro Service including cookies.

To register for phone or web App we will ask for your name, company address, delivery address (optional), gas safe registration number, email and phone contact details (if you are an energy provider you should email the digital product team that support you to set up your app account).
For each Vaillant appliance you wish to record in myVaillant Pro Service we will collect and process details of those appliances, date and location of install etc.

We also collect various device, location, and web or phone app journey data using cookies, please see more details of how we use cookies in the Cookies, analysis tools, tracking and targeting section.

Registration
To use our web or phone app you will need to register as a myREWARDS member first if you haven’t already and then register for myVaillant Pro Service. The web and phone app content is not accessible to anyone without a registration; this means that every time you access the web and phone app you will need to log-in with your personal log-in details. Your registration data is saved into our Salesforce database hosted by our head office Vaillant GmbH in Germany.

Add Appliance and Monitoring
Each time you install a Vaillant appliance and add it to your myVaillant Pro Service account, you can access and adjust time programmes, set-back temperatures, and the heating curve. You will receive personal data of the customer through the myVaillant app connection to your App, but you will be unable to change any of this personal data or your registration details.

MCS Umbrella Scheme
For installers of our product who are not MCS approved. By providing your contact name, company name, contact email, and postcode in the MCS Umbrella enquiry form, Vaillant will assist you with identifying an MCS approved installer who may be able to support you in completing an installation of one of our Heat Pumps to MCS requirements for the Boiler Upgrade Scheme to apply to your installation. The MCS approval Scheme can also enable you to obtain an MCS approved installer to assist you in installing a Vaillant Heat Pump at your own home and support you to obtain the Boiler Upgrade Scheme Grant, this is under the myVaillant Install service. Once you submit your enquiry form for either of the above services, the enquiry data is held by the Vaillant Sales Team who will provide it to your nearest Vaillant MCS Umbrella Partner who will contact you to discuss further. From there any arrangements will remain between you and the MCS approved installer.

Our lawful basis for processing your personal data in the enquiry data as set out above is for the purposes of a contract between us or the steps required to enter a contract, we will retain your enquiry data for a maximum of 12 months from receipt of your enquiry.

Contact Us
If you contact us via the in-App support function, we will need to ask you to provide us with the information necessary to process your enquiry and reply to you. The data requested includes name, company address and phone or email contact details, where applicable, details of the Vaillant product, and details describing your query. The App form that you fill in (Jira form) will be sent to our technical support team. Alternatively, you can email your query directly to our App Support Team at app.support@vaillant-group.com.

We may also supplement the information collected from you with further information we hold (e.g., existing myREWARDS account data such as membership number, installations, products, geodata of the device location you use) in order to be able to respond to your enquiry and have a auditable record of all our communications.

Our lawful basis for collecting your personal data when you Register, Add an appliance or Contact Us, is the performance of a contract or the steps required prior to entering into a contract between us to provide the myVaillant Pro Services (see Terms and Conditions of Use). In addition, we may also process Contact-Us data for our legitimate interests, in as far as we need to have a record of appliance registrations to enable us to deliver the services to the correct accounts and to monitor installations, sales and other aspects of the web and phone app services.

We retain your personal data collected through the web and phone app until the App account is deleted, we may also retain installation details and Contact-Us forms from the App in your myREWARDS account for as long as you have a myREWARDS account and for 6 years afterwards for accounting, complaint and claim management purposes. Deleting the App from your device does not delete the data in the App. To remove all data from the App, you will need to contact us as set out in this section of the notice and we will delete your account for you.

Internal Reporting and Statistics
We will use your account data, including company name, and the number of installations you record in MVP for our own internal business purposes of reporting and statistical analysis. The reporting is created by our data and reporting team and is made available to our senior management, your local Vaillant Regional Business Manager, and in some instances our head office in Germany or our Board of Directors or shareholders. In most instances the reporting uses aggregated data of all loyalty accounts or all that meet certain criteria, this means that the reporting does not identify any individual account or account holder.

Our lawful basis for this processing of your personal data for our own internal business purposes is our Legitimate Interests, in that it is legitimate for a business to understand key data from across its customer base; where it is successful and where it is not, where cost saving can be made or investment is needed, to improve sales and stock management, and to ensure the brand is offering the right products to the market etc. The reports are retained only for as long as the data is relevant (no more than 12 months) and they are regularly refreshed to ensure we only make decisions based on the latest and most accurate and complete data we hold.

Cookies, analysis tools, tracking and targeting
Cookies are small text files that are stored in the browser of your computer, tablet or phone when you first visit our web or phone apps. We use functional, analytical and tracking cookies. These ensure that the web and phone apps works properly and that, for example, your preferred settings are remembered. In addition, cookies are stored and processed by us that track your web and phone app surfing behaviour so that we can offer customised content, measure the effectiveness of and tailor internet advertising, to ensure the security of our web and phone app pages, to compile statistics and to measure the activities on the web and phone app with the aim of improving our offer and making it appropriate for your needs. This involves collection of information that can be classified as personal data, about you, your devices and your use of our services, as follows:

We use our own cookies, in particular functional cookies, to make our web and phone app more user-friendly, to facilitate navigation and the use of forms, to simplify logging in and registration, to provide certain functions, to store your consent or rejection of cookies and to ensure the security of our web and phone app and our systems. We call these ‘necessary cookies’ as they need to be accepted to be able to fully use our web and phone app functionality.

We also use cookies provided by third parties such as Google (“third-party cookies”), particularly in connection with the use of analytics tools, tracking and targeting technologies, these are known as ‘optional cookies’ that you can accept or reject using our cookieconsentmanager function:

Google Analytics
Our web and phone apps uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses cookies to help us analyse how you use the web and phone app. The information generated by the cookie regarding your use of this web and phone app (including your IP-address) will be transmitted and stored on a Google server in the United States of America. Google will use such information to evaluate your use of the web and phone app, to compile reports on the web and phone app activities for website operators as well as to provide other services in connection with web and phone app usage. Google may also transfer such information to third parties, provided this is required by law, or where third parties process such data on behalf of Google. Google will not associate your IP-address with any other Google data. You may refuse the generation of cookies by selecting the appropriate settings on your browser; however, please note that in refusing cookies you may not be able to make full use of all web and phone app functions. Please use the Google deactivation add-on "http://tools.google.com/dlpage/gaoptout?hl=en" if you do not want your personal data to be transmitted to the web analytics service of Google Inc. You can object to the creation of user profiles via pseudonyms at any time. In addition, you can withdraw your consent to advertising at any time. In view of the discussion on the use of analysis tools with full IP-addresses, please note that this web and phone app uses Google Analytics with the extension/add-on "_anonymizeIp()" and that thus IP-addresses are processed only in an abbreviated form in order to rule out any direct relation to persons.

DoubleClick
Our web and phone app uses “Doubleclick”, a service provided by of Google Inc., 1600 Amphitheatre Parkway, Mountain View, California, 94043 USA, (hereinafter referred to as “Google”). Doubleclick by Google uses cookies to show you advertisements that are relevant to you. Your browser will be assigned a pseudonymous identification number (ID) to check which ads have appeared in your browser and which ads have been viewed. Using the DoubleClick cookie allows Google and its affiliate websites only to serve ads based on previous visits to our or other web and phone apps on the Internet. The information generated by the cookies is transmitted by Google for evaluation to a server in the USA and stored there. A transfer of the data by Google to third parties takes place only due to legal regulations or in the context of data processing relationships. You can choose your browser settings so that you are informed about the setting of cookies and individually decide on their acceptance, or exclude the acceptance of cookies for specific cases or in general. If you do not accept cookies, you may not be able to use certain or all features of our web and phone apps. You may also prevent the collection by Google of the data generated by the cookies and related to your use of the web and phone app and the processing of such data by Google by downloading and installing the browser plug-in available under the DoubleClick Deactivation Extension link (https://support.google.com/ads/answer/7395996?hl=en). Alternatively, you can opt out of DoubleClick cookies via Advertising Settings on Google (https://adssettings.google.com) or on the Digital Advertising Alliance website (http://www.youronlinechoices.com).

Google AdWords Conversion Tracking
Our web and phone app uses conversion tracking. When you reach this site through a Google ad, Google AdWords will set a cookie on your computer as soon as you click on a Google-enabled ad. The validity of this cookie is 30 days and is not for personal identification. If you visit certain pages of our web and phone app and the cookie has not expired, we and Google can see that you have clicked on the ad. Each Google AdWords customer receives a different cookie and thus cannot be tracked through the web and phone apps of other advertisers. The information obtained using the conversion cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. Such customers experience the total number of users who clicked on an ad and were directed to a site that was tagged with a conversion tracking tag. Information that can personally identify users is not transmitted.
If you do not want to participate in the tracking, you can reject the required setting of a cookie in your browser setting by disabling the automatic setting of cookies or by blocking your browser cookies of the domain. You may not delete the opt-out cookie as long as you do not wish to record the data.

Measurement and analysis tools are used to better understand the use of our web and phone apps and to optimise it accordingly. With the corresponding cookies, we collect information about how you interact with our web and phone apps and which pages you have visited. The information we collect or store with these cookies is aggregated and not linked to you personally. Such cookies are activated with your consent, and you can withdraw your consent at any time.

Tracking and targeting technologies are used to optimise the delivery of advertising and other marketing on the internet. These cookies track and collect information about your online activities to help advertisers deliver more relevant advertising to you according to your interests. These cookies may share this information with other organisations or advertisers. Such cookies are activated with your consent, and you can withdraw your consent at any time.

In principle, you can also view our web and phone app without cookies. However, most browsers automatically accept cookies as the default setting. However, you can prevent or restrict the storage of cookies on your end device. Please refer to the instructions of your browser manufacturer for details of how this works. You can also delete cookies that have already been set at any time via your browser. You can also use the "Do Not Track" settings of your browser to manage cookies. You can also deactivate cookies from certain third-party providers on the page of the "Digital Advertising Alliance" at http://www.aboutads.info/choices/ or on the page "Your Online Choices" at https://www.youronlinechoices.com. If you do not accept necessary cookies, this may lead to functional restrictions of our offers.

When using cookies from other providers ("third party cookies"), it is possible that the collected data may be transferred by the respective cookie provider to a country outside the UK that does not offer an adequate level of data protection and in these circumstances, we will take all reasonable steps to ensure adequate safeguards are in place that meet the standards of UK data protection law.

Our lawful basis for collecting your data via cookies is your consent, you can withdraw your consent at any time by de-selecting them (see the cookie consent management tool section below). We only collect data via cookies for as long as the cookie retention period.

Please see the table of cookies in this notice for full details of these periods.

You can use the Cookie Consent Management Tool integrated into our web and phone app to manage your individual settings for the use of all ‘optional cookies’. This is usually found in the bottom left of the homepage in a round icon.
We use the Consent Management Tool from Consentmanager AB (Håltegelvägen 1b, 72348 Västerås, Sweden) on our web and phone app. The tool enables you to give consent to data processing via the web and phone app, in particular the setting of cookies, as well as to make use of your right to withdraw consent already given. The processing of data and the use of cookies is necessary for the documentation and administration of your settings. The following data is collected and transmitted to the provider of the tool: Date and time of the page call, information on the browser you use and the device you use, anonymised IP address, opt-in and opt-out data relating to the respective cookies. This data is not passed on to other third parties.
For more information on the privacy terms of the cookie consent management tool used, please visit: https://www.consentmanager.net/privacy.php.

Personal data is processed by us as the controller and, for the purpose of providing our web and phone app, is sometimes passed on to other entities within the Vaillant Group and certain third parties who process the personal data on our behalf and strictly in accordance with our instructions (we have set out in the individual sections of this notice wherever that is the case).

We may also disclose your personal data to other third parties such as:

• Professional advisers including lawyers, bankers, auditors and insurers based in the UK/EU who provide services to us in relation to the web and phone app; and
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If such a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

In some circumstances (as we set out in this notice), data processing of your personal data is carried out on our behalf by our Head Office Vaillant GmbH in Germany or a third-party organisation based outside the UK. This is particularly so in connection with the use of analysis tools, tracking and targeting cookies and other technologies or the integration of social media offers. In such cases, unless there is an adequacy decision by the UK in relation to the recipient country (e.g., as with all EU member states), we will have agreed adequate safeguards for the protection of personal data by that organisation, in particular by agreeing the applicable UK International Data Transfer Agreement, or the EU standard contractual clauses with UK IDTA Addendum, to ensure the same standards of protection as UK data protection law requires.

Depending on the purpose of the transfer our lawful basis could be any of the bases set out in paragraph 3 above.

We apply technical and organisational security measures to protect the personal data we process against destruction, loss, alteration or unauthorised disclosure of, or access.

All personal data provided by you when using the web or phone App will be transmitted to us in encrypted form. Your data is password protected in the systems in which it is stored. The persons who have access to it are prohibited by strict security regulations from disclosing your data to third parties unless we have set out where a third party is used as part of the provision of any of our services in this policy.

You have a number of rights under data protection law in respect of your personal data, these are called Data Subject Rights. The ICO website https://ico.org.uk/for-the-public/ explains your data subject rights and in what situations you can exercise them (please note that the ICO’s separate website Privacy Notice will apply to your use of their website):
Data Subject Rights:
1. Access to your personal data
2. Correct any errors in your personal data
3. Deletion of your personal data in certain circumstances
4. Restrict how we use your personal data in certain circumstances
5. Object to how we process your personal data in certain circumstances
6. Portability of your personal data
7. To make a complaint about the use of your personal data (see complaint section below)

Where the lawfulness of our processing of personal data relies on your consent, you also have the right to withdraw your consent at any time.

You can contact our data protection officer by emailing DataProtectionUK@Vaillant-Group.com to assert any of your data protection rights above.

You will not be charged for exercising your rights and, once we receive your request, we have one-month to respond to you, unless we let you know otherwise.

Complaints
If You are unhappy with the way we are using your personal data, please contact our data protection officer and we will seek to resolve any issues. You also have the right to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of personal data concerning you is not lawful. For this purpose, you may in particular contact the competent supervisory authority in the country where you reside or of the place of the alleged infringement.

The competent supervisory authority in the UK is the Information Commissioners Office. You can find their current contact details at www.ico.org.uk.

If you have any questions or suggestions on our use of your personal data, please feel free to send them by email or letter to our data protection officer, who can be reached at the following contact details:

By email: DataprotectionUK@vaillant-group.com

By post: The Data Protection Officer, Vaillant Group UK Limited, Nottingham Road, Belper, Derbyshire, DE56 1JT

We reserve the right to change this Privacy & Cookie Notice at any time. Please also note the respective terms of use and the general terms and conditions when using our Web and Phone app.

Status: Published 17 April 2026 (some brand names amended, added in MCS Umbrella section)

Previous Versions
February 2025
April 2024
September 2021