Privacy Policy

Effective date: 19 October 2026

Last updated: 19 October 2026

1. Who we are

Home 1st Group Ltd (company number 15503200), trading as Guardian 1st, of 74 Woodside Green, London SE25 5EU, is responsible for the personal data described in this Privacy Policy.

Guardian 1st provides residential home security, home safety and family-reassurance services. The same company also operates Battery 1st, a separate residential energy-services brand, using shared Home 1st OS technology.

This notice applies to people who visit our website, contact us, request a home assessment, become Guardian 1st customers, are nominated as authorised contacts by a customer, or live at a property protected by our services.

2. Which information applies to me?

This policy covers different relationships with us. To find the parts that apply to you:

- Website visitor or enquirer: read sections 1 to 5 and 14 to 19.

- Guardian 1st customer: read the full policy.

- Resident at a protected property who is not the account holder: read sections 3 to 6, 8, 10, 11, 13 and 14.

- Family member or authorised contact: read sections 3 to 5, 7, 10, 11, 13 and 14.

If you are unsure which parts apply to you, contact us using the details in section 19.

3. Personal data we collect

Depending on your relationship with us and the services involved, we may collect:

- Identity and contact information: name, address, telephone number and email address.

- Property and assessment information: property type, layout, relevant access information and details needed to assess a proposed installation.

- Installation and equipment information: equipment configuration, device identifiers, installation records, system status, faults and service history.

- Account information: login and account details, permissions, preferences and authorised-contact settings.

- Customer and transaction information: assessments, quotations, orders, payments, customer correspondence and service records.

- Technical and usage information: device, browser, app and platform information, security logs, diagnostics and website usage data.

- Safety and security events: sensor activity, alarm events, device status, event timestamps, notifications, acknowledgements and response records generated by the services you use.

- Communications information: correspondence with us and records of communications through service channels.

- Voice and audio information: audio processed when supported two-way voice communication is used, as described in section 6.

- Health-related information: information you choose to provide, or information that may be revealed by a safety event, where it is necessary to deliver the service or respond appropriately.

We collect only information that is relevant to the purposes for which it is used.

4. How we collect information

We collect information directly from you when you contact us, request an assessment, provide information during a home visit, enter into a contract or communicate with our team — including through the contact forms, appointment-booking tools and chat widget on our website. If you use the chat widget or a booking tool, the information you provide through it is used to handle your enquiry and arrange what you have asked for.

Calls to our support, escalation and customer-service lines are recorded for quality assurance, staff training and record-keeping. This recording is separate from two-way voice communication through installed equipment, which is described in section 6.

We may also collect information from equipment installed at your property, your Home 1st OS account, connected devices, installation and maintenance partners, and technology providers supporting the service.

Website and platform technologies may collect technical information automatically. Cookie-related collection is explained in our Cookie Policy.

5. How we use personal data

We use personal data for the following purposes:

- Enquiries and assessments. To respond to enquiries, arrange home visits, assess requirements and prepare quotations. Our lawful bases are taking steps at your request before entering a contract, and our legitimate interests in handling enquiries effectively.

- Customer services and installation. To supply agreed equipment and services, arrange installation, configure systems, maintain records and provide support. Our lawful bases are performance of a contract and, where applicable, compliance with legal obligations.

- Account and platform operation. To provide secure account access, permissions, service information, notifications and technical support. Our lawful bases are performance of a contract and our legitimate interests in operating and securing the platform — specifically, keeping accounts and systems secure and reliable.

- Security and safety event handling. To process events generated by installed systems, assess and prioritise alerts, communicate with nominated contacts and support the agreed response arrangements. Our lawful bases are performance of a contract, our legitimate interests in operating the agreed service, and — only in specific emergencies where someone's life or wellbeing may be at risk and the legal conditions for that basis are met — vital interests.

- Human review and escalation. To enable our authorised team to review relevant events and follow the configured response plan where the service includes this function. Our lawful bases are performance of a contract and, only in specific emergencies where someone's life or wellbeing may be at risk and the legal conditions for that basis are met, vital interests. We do not rely on vital interests as a blanket basis for safety monitoring, call recording or AI-supported processing.

- Calls to our support lines. Calls to our support, escalation and customer-service lines are recorded for quality assurance, staff training and record-keeping. Recordings are kept for 90 days and then deleted, unless a recording must be kept longer to investigate a complaint, safeguarding incident, dispute or legal matter — any such extension is documented. Access to recordings is restricted to authorised staff, and callers hear a recording announcement before recording begins. Our lawful basis is legitimate interests — specifically, maintaining service quality, training our team and keeping accurate records.

- Service improvement and security. To investigate faults, improve reliability, detect misuse, maintain system security and understand service performance, subject to applicable law.

- Customer communications. To send appointment details, service notifications, fault information, contractual communications and relevant support messages.

- Marketing. To send marketing communications only where permitted by applicable law. You can opt out of direct marketing at any time.

- Legal and regulatory requirements. To maintain required records, handle complaints and disputes, and comply with applicable legal obligations.

We do not use safety-event data for unrelated marketing simply because it is technically available to our systems.

6. Voice communication, AI and monitoring

Guardian 1st is designed to combine home security and home-safety functions with communication and reassurance for customers and their nominated contacts.

Depending on the system installed and the services selected, processing may include sensor events, room or device status, alarm events, event timestamps, communications and voice interaction.

AI-assisted processing. AI-supported functions may help interpret available events, identify patterns, prioritise notifications, present an event timeline and coordinate communications. Security-alarm functions and safety-monitoring functions operate as independent systems; AI-supported features correlate, prioritise and explain information and help coordinate communications, but do not silently override alarm decisions. These functions support the service; they do not guarantee that an event will be detected or correctly interpreted.

Two-way voice. Where the installed equipment supports two-way voice communication, audio is processed to allow communication through the system. The system may use the relevant device and communications infrastructure to route that interaction. Audio is not treated as a general-purpose recording of a customer's private life, and support-line call recording (section 4) does not mean that room-based two-way voice conversations are recorded.

Audio recording, where a particular product or configuration provides it, must be disclosed as part of the relevant service information before that feature is activated.

Human escalation. Depending on the service and event, notifications may be sent to authorised contacts and relevant events may be escalated to Guardian 1st's own team under the configured response plan. The precise response available depends on the service purchased, system configuration, communications availability and the agreed arrangements.

Guardian 1st does not represent itself through this Privacy Policy as an accredited Alarm Receiving Centre and does not promise ARC-based police response. Any emergency-service involvement must reflect the actual arrangements applicable to the customer's system.

No medical diagnosis. AI-assisted safety functions are not a substitute for medical assessment, personal care or emergency services.

7. Authorised contacts and family communications

Customers may nominate family members, friends, neighbours or other people as authorised contacts where the service supports it.

The information shared with each contact depends on the customer's settings, the permissions available and the purpose of the notification. This may include relevant alerts, event details, status information or communications needed to support the agreed response plan.

Customers should nominate people who understand their role and are willing to receive relevant communications. Customers should keep contact details and permissions up to date.

Authorised contacts may receive personal data about the customer and may themselves have personal data processed by us. We handle that information in accordance with applicable data-protection law.

8. Information for residents

Where the person living at the property is not the account holder — for example, where a family member arranges a service for a parent — we still treat the resident's information fairly and transparently.

Before the system is put into use, we will explain the relevant functions, what information it processes, how voice communication works, who may receive notifications and how the arrangements can be changed or ended.

Written privacy information will be provided with the installation documentation.

Where we obtain a resident's information indirectly — for example from the account holder who arranged the service, or from the installed system — we will give the resident this privacy information within a reasonable time, covering what is collected, from whom, for what purposes, on what lawful bases, who it is shared with, how long it is kept and how to exercise their rights.

Residents can contact us directly to exercise their data-protection rights (section 14). An account holder's arrangements do not replace the resident's own rights or any other applicable legal requirement.

9. Health and special-category information

A safety event or information provided by a customer may reveal information about a person's health. Some information may therefore be special-category personal data under UK data-protection law.

We do not assume that all sensor data is health data, nor that every safety event creates a medical record. We assess the nature and purpose of the information actually processed.

Where special-category data is processed, we rely on a specific condition from Article 9 UK GDPR for each purpose: your explicit consent, where you choose to give us health information to tailor your service (Article 9(2)(a)); vital interests, in an emergency where someone's life or wellbeing may be at risk and they cannot give consent (Article 9(2)(c)); and the establishment, exercise or defence of legal claims, where needed to handle complaints, safeguarding incidents or disputes (Article 9(2)(f)). We do not treat ordinary safety monitoring as automatically justified by vital interests, and we will tell you which condition applies if you ask.

10. Who may receive personal data

Depending on the service and the circumstances, information may be accessed by:

- The customer and the people they authorise.

- Relevant Guardian 1st installation, support, technical and monitoring staff whose duties require access.

- Contractors and service providers supporting installation, maintenance, hosting, communications, platform operation or customer support.

- Technology providers required to deliver the relevant features.

- Professional advisers and insurers where appropriate.

- Regulators, courts, law-enforcement bodies or public authorities where disclosure is required or legally justified.

We do not disclose personal data indiscriminately. Access is restricted according to operational need, permissions and applicable law.

11. Sharing across Guardian 1st and Battery 1st

Guardian 1st and Battery 1st are trading names of the same company and use shared Home 1st OS infrastructure. This does not give all staff or systems unrestricted access to all customer information.

Some information may be used across the brands where necessary for account administration, customer support, platform security, legal compliance or another clearly identified and lawful purpose.

For example, shared identity or account information may be needed to administer an account used across both services. Guardian safety-event information is not automatically made available to Battery 1st personnel for energy-service purposes.

Access must be restricted according to role, service and legitimate need. We do not treat shared technology as permission for unrestricted cross-brand marketing or access.

12. International transfers

Some technology or hosting providers may process information outside the United Kingdom. Where personal data is transferred internationally, we will use a lawful transfer mechanism and appropriate safeguards where required by law.

Information about relevant transfers and safeguards can be requested through our privacy contact.

13. How long we retain information

We retain personal data for as long as reasonably necessary for the purposes described in this notice, taking account of the nature of the information, the service provided, applicable legal requirements, warranty and support needs, security, and the handling of complaints or disputes.

Different information may have different retention periods. For example, customer and contractual records may need to be retained for longer than routine technical logs.

Safety-event, notification and response records may be retained where reasonably necessary for service delivery, investigation, safety, legal obligations or dispute resolution.

Call recordings are kept for 90 days and then deleted, unless a recording must be kept longer to investigate a complaint, safeguarding incident, dispute or legal matter; any such extension is documented.

We delete or anonymise information when it is no longer reasonably required, subject to lawful retention requirements.

14. Your data-protection rights

Subject to applicable law, you may have the right to:

- Request access to personal data we hold about you.

- Ask us to correct inaccurate or incomplete information.

- Request erasure of personal data.

- Request restriction of processing.

- Object to certain processing.

- Request transfer of certain data to you or another organisation.

- Withdraw consent where processing is based on consent.

- Object to direct marketing at any time.

These rights are subject to legal conditions and exceptions. We may need to verify your identity before responding.

Authorised contacts may exercise rights relating to their own personal data. They may also ask us to update or end their authorisation, subject to any necessary checks. Residents who are not the account holder have the same rights in respect of their own information (section 8).

15. Complaints

If you have a concern about how we handle personal data, contact us first so we can investigate.

You also have the right to complain to the UK Information Commissioner's Office: https://ico.org.uk/

16. Cookies and website technologies

Our Guardian 1st Cookie Policy explains how we use cookies and similar technologies on our website and, where applicable, our digital services.

17. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

No internet-connected system can be guaranteed to be completely secure. Customers should protect their login details, devices and authorised-contact settings and tell us promptly about suspected account compromise.

18. Changes to this notice

We may update this Privacy Policy to reflect changes in our services, systems or legal obligations. The current version will be published on our website with its effective or updated date.

19. Contact

For privacy enquiries or requests, contact our privacy team at [email protected], or write to us at our registered office.