Privacy policy

Who we are

Ready EPC Ltd (trading as SwiftCerts) is the controller of the personal data described here. Company no. 17565152, registered in England and Wales. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Contact us about your data using the details on our contact page.

What we collect

• Your name, email address and phone number.
• The property address, and any access details you give us: a tenant or agent's name and number, a key safe code, notes.
• Your booking, payment status and messages about it. We never see or store your card details; Stripe handles them.
• If you arrived from one of our letters, the code on that letter, so we know which mailing worked.
• If you arrived from a Google ad and ticked the box to say so, the code Google added to the ad link.

How we use it

• To provide your EPC (to perform our contract with you): arranging the assessor, keeping you updated and sending your receipt.
• EPC expiry reminders, only if you ask for one (your consent): by ticking the box when you book, or from our landlord rating check, where we email you first to confirm. We keep your email, the property's address, certificate number, rating and expiry date, and email you 3 months before it expires and once more a month before. Stop them from any reminder email and we delete it. Unconfirmed requests are deleted after a week, and the rest a month after the certificate expires.
• Emailing you a quote you didn't finish (our legitimate interests): when you enter your details on the booking form we keep your quote, and if you don't finish booking we email it to you an hour later and once more the next day, with a link that fills the form in again. You can tick “Don't email me about this quote” on the form, or stop them from either email. Saved quotes are deleted 30 days after you last used them.
• Asking for a review (our legitimate interests): the day after your certificate is lodged we email you once to ask for a Google review, with one reminder a few days later if you haven't left one. We ask at most once a year, and every email has a link to stop them. We only record whether you clicked the link, not what you wrote.
• WhatsApp booking updates, if you ticked the box at checkout. Reply STOP at any time to turn them off.
• Telling Google Ads your booking came from an ad, only if you arrived from one of our Google ads and ticked the box when booking (your consent). Once you've paid we send Google the code from the ad link, your booking reference, the amount and when you paid, and update it if you're refunded. We don't send your name, contact details or address. Google uses this to report which ads lead to bookings, so we can stop paying for ones that don't. Nothing is stored on your device: the code is read from the page address when you book. To withdraw consent, contact us.
• To keep accounts and meet our legal obligations, such as tax records.
• To run and improve the business (our legitimate interests): preventing fraud, handling complaints and measuring which marketing works.

We don't sell your data, and we don't send you marketing unless you've agreed to it.

Who we share it with

• Your assessor, who needs your contact and access details to visit and produce the certificate.
• The government EPC register: the assessor lodges the certificate, which publishes the address, rating and property details (not your name).
• Service providers who process data for us: Stripe (payments), Twilio and Meta (texts and WhatsApp messages), Resend (email), Ideal Postcodes and Ordnance Survey (address lookup), Stannp (printing and posting our letters), Hetzner (hosting, in Germany) and Google: for ad measurement, only if you agreed to it when booking.

Some of these providers may process data outside the UK. Where they do, they use safeguards approved under UK law, such as adequacy decisions or standard contractual clauses.

How long we keep it

• Booking and payment records: 6 years after the booking, for accounting and tax.
• Key safe codes: deleted as soon as the certificate is lodged or the booking is cancelled.
• A booking request you send while online payment isn't open yet (so we can call you back): deleted 6 months after you send it. If it becomes a booking, the booking is kept as above.
• Other access details (a tenant or agent's name and number, access notes): deleted 6 months after the certificate is lodged or the booking is cancelled, once any complaint or card dispute would have been raised.
• The text of WhatsApp messages, texts and emails: deleted after 12 months. We keep a record that a message was sent, when and whether it arrived, with the booking.

Cookies

We only use cookies the site needs to work: one that remembers which of our letters brought you here (for 30 days) and, for agents and staff, a sign-in cookie. Stripe sets its own cookies on the payment page to prevent fraud. We don't use advertising cookies.

We don't use analytics cookies.

We count visits to this site ourselves, without cookies or anything stored on your device: which page you viewed, the site or advert that sent you here, and whether you're on a phone or computer. We don't keep your IP address. To count you once per day we use an anonymous code made from your IP address and browser with a random value that we replace and delete every day, so you can't be identified or followed from one day to the next. These visit records are kept for 25 months.

EPC assessors we contact about work

This part is for domestic energy assessors. We look for accredited assessors who might take EPC bookings in the areas we cover, and may contact you about paid work.

• Where we got your details: from the public EPC register. Lodged certificates show the assessor's name, accreditation scheme, assessor ID and contact details, and the government's “Find an energy assessor” service lists accredited assessors near a postcode.
• What we keep: your name, assessor ID and scheme, the email address and phone number shown there, the towns and postcode districts of certificates you've lodged and when, and a record of when we contacted you and any reply.
• Why (our legitimate interests): to offer EPC work near where you already work. We use how many certificates you've lodged recently, and where, to decide who to contact first about work in an area. This only affects who hears from us first; it doesn't make any decision about you.
• How we contact you: by email, text or phone. Texts are sent through Twilio and emails through Resend.
• Stopping it: reply STOP to a text, use the “Don't contact me again” link in an email, or contact us. You can object at any time and we'll stop. We keep a short note of your name, assessor ID and contact details only so we never contact you again.
• How long: if you don't sign up, we delete your details 12 months after we last contacted you (or found them, if we never did). If you asked us to stop, we keep the short note above instead. If you sign up to take jobs, your details are then used to offer you bookings and pay you.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it or ask us to restrict it. Contact us and we'll respond within one month. Some records (for example, accounting records) we must keep even if you ask us to delete them.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.