Privacy policy

Who we are

[Legal business name] (trading as Ready EPC) is the controller of the personal data described here. We're registered with the Information Commissioner's Office, registration number [ICO registration number]. Contact us about your data using the details on our contact page.

What we collect

• Your name, email address and phone number.
• The property address, and any access details you give us: a tenant or agent's name and number, a key safe code, notes.
• Your booking, payment status and messages about it. We never see or store your card details; Stripe handles them.
• If you arrived from one of our letters, the code on that letter, so we know which mailing worked.

How we use it

• To provide your EPC (to perform our contract with you): arranging the assessor, keeping you updated and sending your receipt.
• WhatsApp booking updates, if you ticked the box at checkout. Reply STOP at any time to turn them off.
• To keep accounts and meet our legal obligations, such as tax records.
• To run and improve the business (our legitimate interests): preventing fraud, handling complaints and measuring which marketing works.

We don't sell your data, and we don't send you marketing unless you've agreed to it.

Who we share it with

• Your assessor, who needs your contact and access details to visit and produce the certificate.
• The government EPC register: the assessor lodges the certificate, which publishes the address, rating and property details (not your name).
• Service providers who process data for us: Stripe (payments), Twilio and Meta (WhatsApp messages), Resend (email), Ideal Postcodes (address lookup) and Hetzner (hosting, in Germany). [Check this list is complete]

Some of these providers may process data outside the UK. Where they do, they use safeguards approved under UK law, such as adequacy decisions or standard contractual clauses.

How long we keep it

• Booking and payment records: 6 years after the booking, for accounting and tax.
• Access details such as key safe codes: [retention period, e.g. deleted 30 days after the visit].
• WhatsApp and email message logs: [retention period].

Cookies

We only use cookies the site needs to work: one that remembers which of our letters brought you here (for 30 days) and, for agents and staff, a sign-in cookie. Stripe sets its own cookies on the payment page to prevent fraud. We don't use advertising or analytics cookies.

We count visits to this site ourselves, without cookies or anything stored on your device: which page you viewed, the site or advert that sent you here, and whether you're on a phone or computer. We don't keep your IP address. To count you once per day we use an anonymous code made from your IP address and browser with a random value that we replace and delete every day, so you can't be identified or followed from one day to the next. These visit records are kept for 25 months.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it or ask us to restrict it. Contact us and we'll respond within one month. Some records (for example, accounting records) we must keep even if you ask us to delete them.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.