Privacy Policy

EPC Certificates Online is the data controller for personal data processed through epccertificatesonline.co.uk. For any privacy question or request, email info@epccertificatesonline.co.uk.

• Search information — the postcode and property you look up. This is not linked to your identity.
• Order information — your email address, the certificate reference and address ordered, the amount paid, and the payment status returned by Stripe.
• Technical information — basic server and error logs needed to keep the site secure and working.

We do not receive or store your card number, expiry date or security code. Card data is handled entirely by Stripe.

• To fulfil your order, produce your PDF and email it to you — performance of a contract.
• To keep records of sales, respond to queries and prevent fraud — legitimate interests.
• To meet accounting and tax obligations — legal obligation.

We do not sell your data and we do not send marketing emails unless you have asked us to.

We use a small number of processors to run the service: Stripe (payment processing), our cloud hosting and database provider (order records and secure PDF storage), and our email delivery provider (sending your certificate). Each processes data on our instructions under a data-processing agreement.

Certificate content itself comes from the public EPC register, which is open data published by government.

Order records and the generated PDF are retained for six years to meet UK accounting requirements, then deleted. Error and access logs are kept for a short period only.

You have the right to access, correct, erase, restrict or object to our processing of your personal data, and the right to data portability. Email us and we will respond within one month. If you are unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk.

We use only the cookies needed to run the site: a secure session cookie for the admin area and cookies set by Stripe during checkout to process your payment and prevent fraud. We do not use advertising or tracking cookies.