Legal
Privacy policy
We keep this short and honest. This policy explains what personal data we collect when you use our website or services, why we collect it, how long we keep it and the rights you have over it.
Last updated: 1 September 2026
1. Who we are
EPCExpress Ltd (“EPCExpress”, “we”, “us”) provides Energy Performance Certificate assessments and related services in England and Wales. We are the data controller for the personal data described in this policy.
Contact: info@epcexpress.uk · 07777 414411 · 17 Nugent Road, Bolton BL3 3DE. Our data protection lead can be reached at the same email address with “Data protection” in the subject line.
2. What we collect and why
| When | Data | Purpose & lawful basis |
|---|---|---|
| You send an enquiry or book online | Name, email, phone, property address and postcode, property details, preferred dates, access notes | To respond, quote and carry out the assessment you have asked for (performance of a contract / steps prior to a contract). |
| We carry out an assessment | Measurements, construction and heating details, photographs of the property (never of people), documents you provide as evidence | Required to produce and lodge the EPC under the Energy Performance of Buildings Regulations (legal obligation; contract). |
| We lodge the certificate | Property address, assessment data and the certificate itself | Lodged on the Government's public EPC register via our accreditation scheme (legal obligation). The register is public and the certificate is visible to anyone searching the address. |
| You pay | Billing name and address; payment is processed by our card provider — we do not store card numbers | Accounting and tax records (legal obligation). |
| You visit this website | Server logs (IP address, browser, pages requested) held briefly by our hosting provider | Security and performance (legitimate interests). See the cookies section below. |
4. How long we keep it
- Assessment records and evidence: 15 years, in line with accreditation scheme audit requirements.
- Booking, invoicing and payment records: 6 years after the end of the tax year, for HMRC.
- Enquiries that do not lead to a booking: 12 months.
- Website server logs: typically 30 days.
6. Your rights
Under UK GDPR you can ask us to:
- provide a copy of the personal data we hold about you;
- correct inaccurate data;
- erase data we no longer need to keep (subject to the legal retention periods above);
- restrict or object to certain processing;
- provide your data in a portable format.
Email info@epcexpress.uk and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, although we would welcome the chance to resolve any concern first.
7. Security
Assessment data is captured on encrypted devices and synced to secure, access-controlled systems. Website forms are transmitted over HTTPS. Only staff who need access to carry out your booking can see your details, and every assessor has an enhanced DBS check.
8. Changes to this policy
We will post any changes on this page and update the date at the top. Material changes affecting how we use your data will be highlighted on the website.
Questions about this policy?
We're happy to explain anything in plain English.
Email or call the office and ask for the data protection lead.