1. Who We Are
This Privacy Policy explains how [Legal Company Name] Ltd, trading as Urban EPC (“we”, “us”, “our”), collects, uses, and protects your personal data when you use our website or book our services. We are the data controller for the purposes of the UK GDPR and the Data Protection Act 2018.
Registered address: [Registered Address] Contact: [Contact Email]
2. What Information We Collect
We may collect the following personal data:
- Contact details — name, email address, phone number, postal/property address
- Property information — postcode, property type, size, and access details relevant to your booking
- Payment information — processed securely via our third-party payment provider; we do not store full card details
- Communications — records of enquiries, emails, or calls with our team
- Technical data — IP address, browser type, and usage data collected via cookies (see our Cookie Policy)
3. How We Use Your Information
We use your personal data to:
- Arrange and manage your EPC or certification booking
- Match you with an appropriate accredited Assessor
- Process payments for services booked
- Lodge your certificate on the relevant official register, where required by law
- Communicate with you about your booking, including confirmations and reminders
- Improve our website and services
- Send you marketing communications, where you have opted in (you can opt out at any time)
- Comply with our legal and regulatory obligations
4. Our Legal Basis for Processing
We process your data on the following bases:
- Contract — to fulfil a booking you have made with us
- Legal obligation — where certificate lodgement or record-keeping is required by law
- Legitimate interests — to operate and improve our business, and to prevent fraud
- Consent — for marketing communications, which you can withdraw at any time
5. Sharing Your Information
We may share your data with:
- The independent Assessor carrying out your assessment (necessary to complete the booking)
- The official EPC Register / relevant government body, as required for certificate lodgement
- Payment processors, to handle transactions securely
- IT and website service providers, who process data on our behalf under contract
- Regulators or law enforcement, where required by law
We do not sell your personal data to third parties.
6. International Transfers
Where any of our service providers process data outside the UK/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, in line with UK GDPR requirements.
7. How Long We Keep Your Data
We retain personal data only as long as necessary to fulfil the purposes outlined in this policy, including any legal or regulatory retention requirements (for example, certificate and booking records may be retained for [X years] to meet EPC regulatory obligations). We will securely delete or anonymise data once it is no longer required.
8. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data, where applicable
- Object to or restrict certain processing
- Request data portability
- Withdraw consent for marketing at any time
- Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk
To exercise any of these rights, contact us at [Contact Email].
9. Security
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse.
10. Cookies
Our website uses cookies to improve your browsing experience. Full details are set out in our separate Cookie Policy.
11. Changes to This Policy
We may update this Privacy Policy periodically. Any changes will be posted on this page with an updated “Last Updated” date.
12. Contact Us
For any questions about this Privacy Policy or how we handle your data, contact us at [Contact Email] or [Registered Address].
