1. Who we are
CrierData is a trading name of a company in formation in England and Wales, correspondence address 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom. Registration and ICO details will be published here on incorporation, which is expected shortly.
We are the data controller for the personal data described in this notice. Contact for anything here, including objections and requests: privacy@crierdata.com, or by post to the registered office above.
2. What this notice covers
This notice covers three groups of people, and the position is different for each.
| You are | Read |
|---|---|
| A property owner whose property appears in our data | Section 3 |
| A visitor to this site, or someone we have contacted | Section 4 |
| A customer or prospective customer | Section 5 |
3. Property owners — data from the EPC register
This is the section that matters most, and it applies to people who have never heard of us.
What we hold
We compile information from the Energy Performance Certificate register for England and Wales, published by the Ministry of Housing, Communities and Local Government (MHCLG).
For each property this includes the address and postcode, the Unique Property Reference Number, the certificate number, the energy efficiency rating and score, certificate lodgement and inspection dates, the tenure recorded at assessment, and physical characteristics of the building such as property type, floor area, construction age, heating system, fuel type, and the condition of walls, roof, windows and floors. Where available it also includes the improvement measures the assessor recommended, their indicative cost and estimated saving.
We do not hold, seek, buy or infer: owner or occupier names, telephone numbers, email addresses, correspondence addresses, ownership records, company ownership data, mortgage or financial information, or occupancy details.
Why this is personal data at all
The register records physical facts about buildings. But because a property owner may be identifiable from the address of a property they own, this information can be personal data about them. MHCLG takes that position and the ICO has agreed with that characterisation. We treat all address-level EPC data as personal data and apply UK GDPR to it in full, rather than rely on an argument that it falls outside.
Where we got it
Directly from the MHCLG published register. We did not obtain it from you, and we have not combined it with data from any other source about you or your property.
What we do with it
We filter the register to identify private rental properties whose latest certificate indicates that energy efficiency improvement work is likely to be required, and supply region-filtered lists of those properties, by monthly subscription, to certified energy assessors and to insulation and heat pump installers.
Our lawful basis
Legitimate interests — Article 6(1)(f) UK GDPR. The interests pursued are our commercial interest in operating this service, the commercial interests of the trades we supply, and the public interest in improving the energy efficiency of rented housing ahead of statutory deadlines.
We have carried out a Legitimate Interests Assessment weighing those interests against the rights of property owners. In summary, we consider the balance is met because:
- the information is already published by government on a public register, expressly for re-use;
- it concerns the physical characteristics of a building rather than the personal circumstances of its owner;
- it contains no names, no contact details and no financial information;
- the properties are subject to a statutory minimum standard, so there is a genuine benefit to an owner in learning what work is required; and
- the use we permit is narrowly defined and contractually enforced against our customers.
We also record the arguments against: owners have not chosen to be contacted, and onward commercial supply may sit outside what a person expects when their property is entered on a public register. We keep the assessment under annual review, and you can object at any time under section 6. A copy is available on request.
Why we have not contacted you individually
Article 14 UK GDPR normally requires us to tell you directly that we hold your data. The register covers millions of properties and contains no contact details for any owner. Writing individually to every owner would require us to obtain contact information we have deliberately chosen not to hold, and would be disproportionate to the limited privacy impact of the processing.
We therefore rely on the disproportionate effort exemption in Article 14(5)(b), and publish this notice as the substitute measure the exemption requires. Our written reasoning is available on request.
Who we share it with
Two categories of recipient: certified energy assessors, who use it to identify properties requiring reassessment, and insulation and heat pump installers, who use it to identify properties requiring improvement work.
Every recipient accepts binding end-user terms before receiving any data. Those terms restrict what they may use it for, prohibit resale or republication, require deletion when their subscription ends, and require them to honour any objection we have received.
We do not sell or supply data to list brokers, marketing agencies, lead generation companies, credit reference agencies or data aggregators.
How long we keep it
We keep the compiled register data for as long as we operate the service, refreshing it monthly from the current published release so that what we hold reflects what government currently publishes.
If a property is removed from the source register, or if we receive an objection, we record it on a permanent suppression list. That list is retained indefinitely and deliberately — it is the only way we can guarantee that a property, once withdrawn, stays withdrawn from every future file. It holds the property identifiers and the date, and nothing further.
4. Website visitors and business contacts
Website visitors
This site sets no cookies and runs no analytics. We do not use tracking pixels, advertising tags, session recording or fingerprinting, and we do not build a profile of your visit. There is no cookie banner because there is nothing to consent to.
Our hosting provider, Cloudflare, processes standard server request data (IP address, timestamp, page requested, browser user-agent) to deliver the site and to protect it from attack and abuse. That is a security necessity rather than a choice, and the data is not used to identify or track individual visitors.
Typefaces are currently served by Google Fonts, which means your browser requests them from Google and your IP address is disclosed to Google in the process. We are moving these files onto our own servers to remove that third party, and this notice will be updated when we do.
If we ever add analytics, we will choose a cookieless, privacy-preserving option and say so here before switching it on.
Enquiries
If you email us or submit a form we process the name, company, trade, postcode area and email address you provide, in order to respond and to send what you asked for. Lawful basis: legitimate interests, or steps taken at your request before entering a contract. Retained for 24 months from your last contact.
Business contacts we approach
We contact incorporated businesses about our service using publicly available business contact information, including the Companies House register and published trade directories. Lawful basis: legitimate interests. Every message identifies us, gives our postal address and includes a means of opting out.
If you ask us to stop, we stop permanently. We keep a suppression record containing your email address and the date, indefinitely, for the sole purpose of ensuring you are never contacted again. Reply "no" to any message, or email privacy@crierdata.com.
5. Customers
For customers and prospective customers we process contact details, company details, subscription and billing records, records of the files we have sent, and the version of the end-user terms accepted and when.
Lawful basis: performance of a contract, and legal obligation for financial records. Payment card details are handled entirely by Stripe and never reach our systems. Retained for the life of the subscription and six years afterwards, to meet HMRC record-keeping requirements.
6. Your rights
Under UK GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict processing, and — where we rely on legitimate interests, as we do for the register data in section 3 — to object to processing at any time.
To object to a property appearing in our data, email privacy@crierdata.com with the address and postcode. We will add it to our permanent suppression list, remove it from all future files, and notify current customers that it must not be used further. We respond within one month. You do not need to give a reason.
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would prefer the chance to put things right first, but you do not have to come to us before going to the ICO.
7. Where your data is held
We keep this list current rather than generic, because a vague answer here is not much of an answer.
| Provider | What it handles |
|---|---|
| Cloudflare | Website hosting, DNS and protection against attack. Serves this site from edge locations worldwide, including the UK. |
| Google Workspace | Our email. Anything you send us is held here. |
| Google Fonts | Typefaces for this site, as described in section 4. |
That is the complete list at the date of this version. The data product described in section 3 is not yet in service, so the systems that will process the register — our database, payment processing and file delivery — are not yet in use. This section and the retention periods above will be updated, with a new version number, before the first file is supplied to anyone.
Where a provider transfers personal data outside the UK, that transfer is covered by the UK International Data Transfer Addendum or equivalent safeguards. We select UK or EU hosting regions where a provider offers the choice.
8. Automated decision-making
We apply a priority score to properties so that lists arrive sorted. This is a ranking applied to properties, not a decision about a person, and it produces no legal or similarly significant effect on anyone. We carry out no automated decision-making or profiling within the meaning of Article 22.
9. Changes to this notice
We update this notice when our processing changes, and publish the version number and effective date at the top. Material changes affecting property owners are summarised here for at least 12 months.