Our privacy policy can be found on our website here.
Gas Engineer Software has passed an independent 3rd-party audit, and we now have the Cyber Essentials and the IASME Consortium logos on our website to state that we are GDPR compliant.
Here is a useful link from the Information Commissioner's Office website with a lot of info that makes it clearer:
What about your own customers' data?
Gas engineers have a legal obligation to keep any gas safety certificates they issue for 2 years. Therefore, the lawful basis for processing your customers' data is a legal obligation.
You need to include information about your lawful basis (or bases, if more than one applies) in your privacy notice.
Under the transparency provisions of the GDPR, the information you need to give people includes your intended purposes for processing the personal data and the lawful basis for the processing.