Case-focused information
Booking, property, access, appointment, communication and report details are used to manage the requested service.
UK data protection information
A privacy policy written around the service you actually use.
From an initial postcode check to secure report delivery, this policy explains how personal information supports each stage of your CertifyEPC case.
Effective and last reviewed 24 August 2026Privacy in practical terms
We collect information to quote, schedule and deliver property services—not to collect data without a clear reason.
No card data stored here
Stripe hosts card checkout. We retain payment method, status and transaction references, not your full card number or security code.
Your rights remain accessible
You can ask about your information, request corrections and exercise applicable UK data-protection rights.
This policy applies to customers, prospective customers, property contacts, account users, assessors, applicants, reviewers and other people who interact with CertifyEPC online or in connection with a service.
01
Who controls your personal information
Sachman Global Ltd, trading as CertifyEPC, is the controller for the booking platform, customer relationship, order administration, account and dashboard records, payment-status records, enquiries, reviews and assessor applications described here.
An assigned accredited assessor, electrician, gas engineer or other professional may also have independent legal or professional duties concerning inspection records, certificate lodgement, safety reporting, insurance, accreditation and regulatory evidence. Where they decide how information must be used for those duties, they may act as a separate controller for that limited processing.
Questions and rights requests can be sent to info@certifyepc.co.uk.
02
Information we collect
The information depends on how you use the website and may include:
- Identity and contact details: name, email, telephone number, company name and billing name.
- Property and access details: address, postcode, property type and size, number of bedrooms, floors, appliances, consumer units or circuits, access contact, parking, occupancy and other visit instructions.
- Booking and case details: service selected, quote, appointment date and slot, congestion-zone answer, order reference, messages, remarks and case status.
- Invoice and payment records: billing address, amount, payment method, payment status, Stripe Checkout Session reference, payment date and invoice. We do not receive or store your complete card number, expiry date or CVC.
- Reports and attachments: certificates, report files, external report links, photographs or documents uploaded to a case and remark attachments.
- Account and security data: email, role, password hash, session identifier, password-reset record, login and security information. We do not store readable account passwords.
- Assessor information: home address and postcode, contact details, company, role, accreditation, experience, coverage, availability, application statement, CV and account profile.
- Contact and review information: enquiry content, review name, town, service, star rating and review text. Approved reviews are intentionally made public.
- Technical information: IP address and request information that may be processed in hosting, security, rate-limiting and operational logs, together with cookie and device information described in our Cookie Policy.
03
Where information comes from
Most information comes directly from you through quote, booking, contact, account, review, dashboard or Join Us forms; by email or telephone; or during a property visit.
We may also receive information from a landlord, tenant, property owner, agent, employer, colleague or other person arranging access or acting on your behalf. The assigned professional supplies visit notes, payment updates, report files, certificate links and case messages.
We use Postcodes.io to help identify outward-postcode coverage and to approximate distance when an administrator ranks available assessors for a job. A quote check may send the outward part of a postcode from the browser; assessor ranking may send relevant property and assessor postcodes from our server. We do not send a customer’s name, email, messages or certificate to Postcodes.io.
04
Why we use information and our lawful bases
| Purpose | Typical information | Lawful basis |
|---|---|---|
| Provide quotes, form a booking, schedule access, deliver the inspection and release reports | Contact, property, appointment, case and report information | Steps at your request before a contract and performance of a contract |
| Take payment, issue invoices and maintain financial records | Billing details, amount, method, status and transaction reference | Contract and legal obligations relating to accounting, tax and records |
| Allocate a competent professional and manage service quality | Service, postcode, assessor competence, location, availability and case history | Contract and legitimate interests in efficient, safe service delivery |
| Operate accounts, dashboards, messaging, anti-spam controls and security | Account, session, message, attachment, IP and request information | Contract and legitimate interests in security, fraud prevention and reliable administration |
| Handle enquiries, complaints, disputes, insurance matters and legal claims | Correspondence, case records, reports and relevant evidence | Contract, legal obligation and legitimate interests in protecting rights |
| Review assessor applications and manage approved professionals | Application, accreditation, CV, location and availability | Steps before contract and legitimate interests in building a competent network |
| Publish moderated customer reviews | Name, town, service, rating and review | Your affirmative submission and our legitimate interests in genuine customer feedback; you can ask us to remove it |
| Send optional marketing | Email or telephone preference | Consent where required, or another lawful route permitted for existing customers with a clear opt-out |
Providing core identity, contact, property, access and payment information is necessary to form and perform the booking. If it is not provided, we may be unable to quote, attend, identify the correct case or deliver the report.
No forced marketing consentYou do not have to agree to unrelated marketing to request a quote or purchase a service. Every marketing message will provide an appropriate way to opt out.
05
Who we share information with
We share only what is reasonably required with relevant recipients, which may include:
- the assigned assessor, engineer, electrician or other professional and, where necessary, their business or accreditation body;
- Stripe for hosted card checkout, payment verification, fraud prevention and transaction records;
- our hosting, database, email, document-storage, IT security and support providers;
- Postcodes.io for the limited postcode uses described above;
- certificate lodgement systems, accreditation schemes, statutory registers, property owners, landlords, agents, tenants or local authorities where required for the service or by law;
- professional advisers, insurers, auditors, debt-recovery providers or prospective business purchasers where necessary and appropriately protected; and
- courts, regulators, police, tax authorities or other public bodies where disclosure is legally required or necessary to protect rights and safety.
We do not sell personal information. If a recipient uses information for its own independent purpose, its own privacy information also applies.
06
Payments and international transfers
When you select card payment, you are redirected to Stripe-hosted Checkout. Stripe collects card and payment-authentication details directly. CertifyEPC receives the Checkout Session reference and payment outcome required to update the order, generate the invoice and send confirmation.
Some technology providers may process information outside the United Kingdom. Where a restricted transfer occurs, we expect an applicable UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard to be used. You may contact us for more information about the safeguard relevant to a particular transfer.
07
How long we keep information
| Record | Typical retention approach |
|---|---|
| Enquiries and incomplete orders that do not become a booking | Normally up to 12 months for follow-up, service administration and complaint handling, unless a longer period is justified |
| Completed order, invoice, payment and core case records | Normally six years after the service or relevant accounting period to support tax, contract, insurance and legal records |
| Certificates, reports and case attachments | For the case lifecycle and normally alongside the core order record; scheme or safety requirements may justify longer retention |
| Secure login session | Up to eight hours unless ended earlier by logout or expiry |
| Password-reset and assessor setup links | Reset links expire after one hour; initial assessor setup links expire after 24 hours. Used records may be retained briefly for security evidence |
| Unsuccessful assessor application | Normally up to 12 months after the decision, unless the applicant agrees to longer consideration or a dispute requires retention |
| Approved assessor account and professional records | During the working relationship and then as needed for contract, compliance, insurance and legal records |
| Approved public review | While relevant and accurate, unless removed earlier following a justified request or moderation decision |
Actual periods may be shortened or extended where required by law, accreditation rules, a complaint, fraud concern, safety issue, legal claim or preservation request. When information is no longer needed, we delete it, anonymise it or securely restrict it from routine use.
08
How we protect information
Measures used by the service include encrypted HTTPS connections, protected server environment variables, password hashing, role-based access, secure and HTTP-only session cookies, login and submission rate limits, anti-spam controls, restricted certificate access, file-type and size checks, database-backed sessions and webhook signature verification for Stripe notifications.
Access is limited according to user role and operational need. No internet service can guarantee absolute security, so please use a unique password, keep login details private and avoid sending unnecessary sensitive information through messages or forms. Tell us promptly if you suspect unauthorised access.
09
Your data-protection rights
Depending on the circumstances and lawful basis, you may have the right to:
- be informed about processing and receive a copy of your personal information;
- correct inaccurate or incomplete information;
- request erasure or restriction of processing;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time where processing relies on consent; and
- challenge a solely automated decision with legal or similarly significant effects.
Your right to objectYou can object at any time to direct marketing. You may also object to processing based on legitimate interests; we will stop unless there are compelling legitimate grounds or the information is needed for legal claims.
Send requests to info@certifyepc.co.uk. We may request proportionate identification before releasing or changing information. We normally respond within one month, although UK law permits an extension for complex or multiple requests. Rights can be limited by exemptions and may not override records we must keep by law.
10
Rules-based quotations and assessor ranking
The instant quote applies published pricing rules to the selected service, property-size option and Congestion Charge Zone answer. Coverage logic may use the outward postcode. This provides a price or referral message but does not make a solely automated decision with legal or similarly significant effects.
For job allocation, the admin dashboard may rank available assessors by approximate postcode distance. An administrator makes the assignment and can consider competence, availability and practical requirements; the ranking does not make the final decision.
11
Children, other people and public reviews
The website and property services are intended for adults and organisations. We do not knowingly offer accounts or booking services directly to children. If information about a child or vulnerable person is relevant to safe access, provide only what is necessary and use a parent, guardian or responsible adult as the contact where appropriate.
If you provide another person’s details—for example a tenant, access contact or invoice contact—you must have a lawful reason to do so and should make this policy available to them.
An approved review displays the submitted customer name, town, service, rating and text. Do not include an address, order number, telephone number, email or other unnecessary personal information in review text.
12
Contact, complaints and policy changes
Please contact us first so we have the opportunity to address a privacy concern. You also have the right to complain to the Information Commissioner’s Office. Current contact routes are available at ico.org.uk/make-a-complaint, or by calling the ICO on 0303 123 1113.
We may update this policy when the website, service providers or legal requirements change. The revised date will appear at the top. Material changes will be communicated where appropriate rather than being applied secretly to an incompatible new use.
Ask about your information
Use the contact page or email our privacy contact. Include enough detail for us to locate the relevant case.
13
Assessor application verification documents
Applicants to the CertifyEPC assessor network are asked to provide qualification certificates, current professional indemnity insurance evidence and an address-verification document, such as a driving licence showing the current address. A CV or another supporting file may also be provided voluntarily.
We use these documents to assess professional eligibility, insurance and identity or address consistency before creating an assessor account, and to manage the approved professional relationship. They are stored as private application records, are not published, and can be downloaded only by authorised administrators. Applicants should provide only the information needed for verification and should not include unrelated financial, medical or other sensitive information.
These records are processed for steps before entering a working arrangement and our legitimate interests in maintaining a competent, appropriately insured network. Unsuccessful application documents are normally retained for no longer than the unsuccessful-application period described above unless a dispute or legal requirement justifies longer retention.