Legal
Privacy Policy
Renewobuild respects your privacy. This policy explains what personal data we collect when you use our website or our services, why we collect it, how we look after it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Renewobuild is the data controller responsible for your personal data. In this policy, "we", "us" and "our" mean Renewobuild.
- Legal name
- Jack Castley, trading as Renewobuild
- Business type
- Sole trader, based in England
- Address
- Carlisle, Cumbria (full postal address available on request)
- Contact
- [Email address] · [Phone number]
We are not required to appoint a Data Protection Officer, but questions about this policy or your data can be sent to us using the details above.
2. The personal data we collect
Information you give us
- Enquiry and call-back requests: your name, phone number, email address, the service you're interested in, the property postcode, whether you are a homeowner, landlord, agent, developer, housing provider or architect, your preferred contact time and any message you send.
- Booking and service delivery: the property address, access arrangements, the names and contact details of the owner, occupier, landlord or agent, and correspondence with you.
- Billing: billing name and address, invoices and payment records. We do not store full card details; any card payments are handled by our payment provider.
Information we collect during a survey or assessment
- Details about the property, such as its construction, dimensions, insulation, heating, glazing and ventilation, together with photographs, measurements, floor plans and supporting evidence (for example documents you provide about improvements).
- Photographs are of the building and its features. We take care not to photograph people or personal belongings, but incidental details may sometimes appear.
Information collected when you visit our website
- Technical data: like any website, our hosting provider's servers record basic technical information such as your IP address, browser type and the pages requested, to keep the site running and secure.
- We do not currently use analytics, advertising or tracking cookies. See our Cookie Policy.
We do not intentionally collect any special category data (such as health information). Please don't include sensitive information in messages unless it is relevant, for example if you need us to make access adjustments during a visit, in which case we will use it only for that purpose.
3. How and why we use your data
We only use your personal data where the law allows us to. The table below explains our purposes and the lawful basis we rely on for each.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Responding to your enquiry or call-back request, and providing quotes and appointment times | Steps taken at your request before entering into a contract (6(1)(b)); our legitimate interest in responding to enquiries (6(1)(f)) |
| Carrying out surveys, assessments and calculations, and producing EPCs, floor plans, SAP calculations, retrofit plans and technical reports | Performance of a contract (6(1)(b)) |
| Lodging EPCs on the government register and keeping assessment records required by our accreditation scheme | Legal obligation (6(1)(c)), and our legitimate interest in maintaining our accreditation (6(1)(f)) |
| Invoicing, payments and keeping financial records | Performance of a contract (6(1)(b)); legal obligation under tax law (6(1)(c)) |
| Running our business: scheduling, quality checks, IT and security, and improving our services | Legitimate interests (6(1)(f)) |
| Handling complaints and establishing, exercising or defending legal claims | Legitimate interests (6(1)(f)); legal obligation where applicable (6(1)(c)) |
| Sending you news or offers (only if you have asked to receive them) | Consent (6(1)(a)), which you can withdraw at any time |
Where we rely on legitimate interests, we have considered your interests and rights and concluded that they are not overridden. You can ask us for more information about this balancing test.
Where we need personal data to provide a service (for example, the property address to carry out an EPC), we may not be able to provide that service if you don't give it to us.
We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
4. EPCs and the government register
By law, Energy Performance Certificates must be lodged on the official EPC register for England and Wales, operated on behalf of the government. When we lodge an EPC, the register records the property address, the energy ratings and recommendations, and our assessor details. It does not contain the owner's or occupier's name.
EPC information on the register is publicly searchable and is published as open data by the government. If you own or occupy a property, you can ask for its EPC to be opted out of public disclosure. It is then removed from the public register search and left out of future open data releases. To do this, contact the register's helpdesk using the details on the government's EPC opt-out guidance. We can help you with this request.
Our accreditation scheme may audit a sample of our assessments for quality assurance, which can include reviewing the evidence (such as photographs and site notes) we collected at your property.
5. Who we share your data with
We never sell your personal data. We share it only where necessary, with:
- The EPC register operator, when we lodge an EPC (see section 4).
- Our accreditation scheme, Elmhurst Energy, for lodgement, quality audits and compliance.
- People you ask us to work with, such as your estate or letting agent, landlord, architect, developer or contractor, where you instruct us to send reports to them, or where they instructed us on your behalf.
- Service providers who support our business, such as website hosting, email, form handling (our enquiry form is processed by Formspree), cloud storage, scheduling, accounting and payment providers. They act on our instructions under contracts that require them to protect your data.
- Professional advisers, such as accountants, insurers and lawyers, where needed.
- Authorities, such as HMRC, regulators, the police or courts, where we are required by law.
- A buyer or successor, if our business is ever sold or restructured, in which case your data would remain protected under this policy.
6. International transfers
Some of our service providers may store or process data outside the UK. When that happens, we make sure appropriate safeguards are in place. This means the destination is covered by UK "adequacy regulations", or we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about these safeguards.
7. How long we keep your data
We keep personal data only for as long as we need it for the purposes above, including to meet legal, accounting, regulatory and accreditation requirements.
| Type of data | How long we keep it |
|---|---|
| Enquiries that don't lead to work | Up to 12 months after our last contact |
| Survey and assessment records (site notes, photographs, calculations, reports) | For as long as our accreditation scheme, Elmhurst Energy, requires us to keep them, measured from the date of assessment |
| Client contracts, invoices and financial records | 6 years after the end of the financial year they relate to |
| Complaints and legal claims | Until the matter is resolved, plus 6 years |
| Marketing preferences | Until you unsubscribe or withdraw consent (we keep a record of your opt-out) |
When data is no longer needed, we securely delete or anonymise it.
8. How we protect your data
We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. These include encrypted connections to our website (HTTPS), password-protected and access-controlled systems, secure storage of survey evidence, and limiting access to people who need it. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the Information Commissioner's Office where required.
9. Your rights
Under UK data protection law you have the right to:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct data that is inaccurate or incomplete.
- Erasure: ask us to delete your data where there is no good reason for us to keep it. This doesn't apply to records we must keep by law or for our accreditation, or to EPCs already lodged on the register.
- Restriction: ask us to pause using your data in certain circumstances.
- Object: object to us using your data on the basis of legitimate interests, and to direct marketing at any time.
- Data portability: ask for data you provided to us in a commonly used electronic format, where processing is based on consent or contract and carried out by automated means.
- Withdraw consent: where we rely on consent, you can withdraw it at any time. This won't affect anything we did before you withdrew it.
To exercise any of these rights, contact us using the details in section 12. We will respond within one month, which can be extended by two further months for complex requests (we'll tell you if so). There is usually no charge. We may need to confirm your identity before acting on a request.
10. Cookies
Our website currently does not set any cookies or use analytics, advertising or tracking technologies. It does load fonts from Google Fonts, which means your browser connects to Google's servers. Full details, including how to control cookies, are in our Cookie Policy.
11. Other important information
- Third-party websites: our website may link to other websites, such as the EPC register or government guidance. We are not responsible for their privacy practices, so please read their policies.
- Children: our services are aimed at adults. We do not knowingly collect personal data from children under 18 through our website.
- Changes to this policy: we may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.
12. Contact us and complaints
If you have any questions about this policy or how we use your personal data, or you'd like to exercise your rights, please contact us:
- [Email address]
- Phone
- [Phone number]
- Post
- Please email or phone us for our postal address
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection: ico.org.uk/make-a-complaint, or call 0303 123 1113.