Privacy Policy

UK GDPR Compliant

Last updated: 20 November 2025

Energy Performance Direct ("we", "us", "our") is committed to protecting your personal information in accordance with UK GDPR, the Data Protection Act 2018, and all relevant UK privacy legislation.

We collect and process personal data solely for delivering our services, fulfilling legal obligations, and supporting customers. We will never sell, rent, or trade your data.

1. Who We Are (Data Controller)

Energy Performance Direct Ltd

Company No: 08296332

Registered Office:

10 Manston Terrace
Exeter
EX2 4NP
United Kingdom

Contact:

Email: info@energyperformancedirect.co.uk
Telephone: 01392 980077

Data Protection Contact:

Zak Henning – Managing Director
Email: zak@energyperformancedirect.co.uk

2. Lawful Bases for Processing

We process personal data under:

2.1 Contract

For delivering EPCs, energy surveys, calculations, reports, and booking confirmations.

2.2 Legitimate Interest

For customer support, record keeping, analytics, fraud prevention, and review requests.

2.3 Legal Obligation

For EPC lodgements and HMRC financial retention requirements.

2.4 Consent

For newsletters and cookie-based analytics.

3. What Personal Data We Collect

3.1 Service Delivery & Bookings

  • Name
  • Email
  • Telephone
  • Property address
  • Property details (rooms, heating type, measurements, photos)
  • Payment preferences (BACS, PayPal, cash, cheque)

3.2 EPC Lodgement Requirements

Shared with Elmhurst or Quidos, as legally required.

3.3 Contact Forms / Emails

Any personal information supplied in your enquiry.

3.4 Analytics & Cookies

  • IP address (masked where possible)
  • Browser and device details
  • Pages viewed
  • Site interactions

3.5 Reviews

Submitted through FreeIndex, Google, or Buy With Confidence.

4. Why We Collect Personal Data

We collect and process your data to:

  • Process bookings
  • Provide energy assessments and EPCs
  • Deliver calculations and reports
  • Issue invoices and receipts
  • Comply with legal requirements
  • Improve website performance
  • Respond to enquiries

No automated decision-making is used.

5. Data Retention

  • EPC data: 6 years
  • Financial records: 6 years
  • Enquiries: 12-24 months
  • Analytics data: 12-26 months
  • Emails: Up to 6 years
  • Newsletter emails: Until unsubscribed

6. Sharing Your Data

We share data only when necessary with:

  • Elmhurst Energy (EPC lodgement)
  • Quidos (EPC lodgement)
  • Nexcess (website hosting provider)
  • PayPal (payments)
  • Google Analytics (analytics)
  • Campaign Monitor (newsletter subscribers only)

We do not sell or trade data.

6.1 Payment processing – PayPal

When you pay for a booking online we use PayPal (Europe) S.à r.l. et Cie, S.C.A. as our payment processor. If you choose to pay by card or PayPal balance, your full card number, CVV and PayPal account credentials are entered directly on PayPal’s own secure checkout — we never see, store or process raw card numbers. PayPal returns to us only the transaction ID, amount, currency and order status. PayPal acts as an independent data controller for the card data it processes; their privacy notice is available at paypal.com/uk/legalhub/privacy-full.

If you choose to pay by BACS, cash or cheque after the survey, no card data is collected at booking time.

7. International Data Transfers

Where data is transferred outside the UK, we use:

  • UK GDPR Standard Contractual Clauses (SCCs)
  • UK International Data Transfer Addendum (IDTA)
  • Appropriate safeguards

8. Cookies

We provide a cookie consent banner allowing you to accept, reject, or customise cookies.

Full details are available in our Cookie Policy.

9. Your Rights

Under UK GDPR, you have the right to:

  • Access your data
  • Correct inaccuracies
  • Request deletion
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent

To exercise your rights, contact:
Email: info@energyperformancedirect.co.uk

To lodge a complaint with the ICO:
https://ico.org.uk

10. Data Security

We use HTTPS encryption, secure UK hosting via Nexcess, and industry-standard security measures.

Any applicable breach will be reported to the ICO within 72 hours.

11. Changes to This Policy

We may update this policy. A new revision date will appear at the top of this page.

Cookie & data consent

We use essential cookies so the booking engine and PayPal checkout work correctly — these cannot be switched off. Analytics and functional cookies are optional and help us improve the site. Privacy policy · Cookie policy