Privacy & Legal

Last updated: April 2026 · Version 1.0

1. Who we are

EcoCredentials is operated by Oak Wooldand Limited, trading as EcoCredentials (info@ecocredentials.co.uk). We provide territory-based lead intelligence for private retrofit installers, drawing on publicly available EPC, Land Registry, and ONS data.

We are currently in early pilot phase. If you have received access to a pilot page or PDF report, you are participating in a commercial proof-of-concept, not a live subscription service.

2. What data we process and why

EPC records (Energy Performance Certificates)

EPC data is published by the Department for Levelling Up, Housing and Communities (DLUHC, now MHCLG) under the Open Government Licence v3.0. It is public information. The records include property addresses, energy ratings, construction details, and heating fuel type.

Land Registry Price Paid data

Published by HM Land Registry under the Open Government Licence v3.0. Contains transaction prices for residential property. We use this to estimate the affordability of retrofit investment at the property level. No names or buyer details are retained.

ONS Indices of Multiple Deprivation (IMD 2025)

Published by the Office for National Statistics under the Open Government Licence v3.0. We use income deprivation deciles at LSOA level to refine affordability scoring. This is area-level data, not individual-level data.

OS Open UPRN

Published by Ordnance Survey under the Open Government Licence v3.0. Used to assign accurate coordinates to EPC records.

Legal basis for processing: Legitimate interests (UK GDPR Article 6(1)(f)). We process publicly available property data to provide a commercial intelligence service to retrofit professionals, who have a legitimate need to identify potential customers for energy efficiency work. The data is already in the public domain. Property addresses do not constitute special category data.

We do not process data about identified individuals beyond what is inherent in a property address. We hold no names, contact details, or other personal information about property occupants or owners.

3. Information we collect from you

When you submit a form on this website (early access signup, contact, or pilot questionnaire), we collect:

Your name and email address
Your company name and trade type (where provided)
Your message or questionnaire responses

This information is processed by Formspree (formspree.io) and delivered to our inbox. We do not use it for marketing without your consent. We use it solely to respond to your enquiry or to follow up on your pilot participation.

We do not use tracking pixels, third-party analytics, or advertising cookies on this site. Mapbox GL JS (the map library) communicates with Mapbox servers to render map tiles; Mapbox's own privacy policy applies to that interaction.

4. How long we keep data

Contact and questionnaire responses are retained for the duration of the pilot phase and up to 12 months thereafter, unless you ask us to delete them sooner.

EPC, Land Registry, and IMD data is refreshed from public sources on a rolling basis. No historical property data is deleted — it reflects the publicly available record.

5. Your rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:

Access the personal information we hold about you
Rectification of inaccurate data
Erasure ("right to be forgotten") — where we have no overriding legitimate interest in retaining the data
Restriction of processing
Object to processing based on legitimate interests
Portability of data you have provided to us

To exercise any of these rights, email us at info@ecocredentials.co.uk. We will respond within one calendar month.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

6. ICO registration

We are in the process of registering with the ICO as a data controller under the Data Protection Act 2018. Registration is required because we process personal data (property addresses constitute personal data where the occupant or owner could be identified) in the course of a commercial activity.

7. Pilot participant responsibilities — data guardianship

This section applies to anyone who has received a pilot page URL, PDF report, or any lead data from EcoCredentials.

The lead data provided to pilot participants — including property addresses and associated EPC, Land Registry, and income data — constitutes personal data under UK GDPR where it enables a living individual to be identified (e.g. the occupant or owner of a specific address).

By accessing a pilot page or receiving a PDF report, you agree to the following:

7.1 Permitted use

You may use the lead data solely for the purpose of identifying and contacting potential customers for your legitimate retrofit trade
You may share the data internally within your business on a need-to-know basis
You may use the data to generate quotations, letters, or canvassing materials directed at the property address

7.2 Prohibited use

You must not sell, transfer, or otherwise provide the lead data to any third party
You must not use the data for any purpose other than retrofit lead generation
You must not retain the data beyond the period for which it is commercially relevant to you (we recommend no longer than 12 months from receipt)
You must not combine the data with other datasets in a way that creates a profile of a specific individual beyond what is necessary for legitimate contact

7.3 Contacting property occupants or owners

When contacting individuals at addresses from this data, you must:

Identify your business clearly and explain how you found their address (e.g. "your property appears on the public EPC register as below EPC C")
Respect any request not to be contacted again (suppress that address from future contact attempts)
Comply with the Privacy and Electronic Communications Regulations (PECR) if contacting by telephone or email
Comply with the Telephone Preference Service (TPS) for unsolicited calls
Register with the Mailing Preference Service (MPS) if conducting postal campaigns

7.4 Data retention

Pilot participants must delete or destroy all lead data received from EcoCredentials within 30 days of:

The end of the pilot period (if they do not become a subscriber), or
Any request from EcoCredentials to return or destroy the data

7.5 Your own data controller obligations

When you use this data to contact individuals, you become an independent data controller in your own right. You are responsible for:

Having a lawful basis for your own processing (typically legitimate interests for direct marketing of relevant services)
Maintaining your own record of processing activities where required
Registering with the ICO if you are not already registered
Providing a privacy notice to any individual who contacts you in response to your outreach

EcoCredentials cannot be held liable for how pilot participants handle or use the lead data. Each participant is solely responsible for their own compliance with UK GDPR, the Data Protection Act 2018, PECR, and any other applicable law.

8. Cookies

This website does not use cookies for tracking or analytics. Mapbox GL JS may set cookies or use local storage as part of its map tile caching. No cookie consent banner is currently displayed because we do not set non-essential cookies.

9. Changes to this notice

We will update this page as EcoCredentials moves from pilot to live service. Material changes will be communicated by email to registered contacts. The date at the top of this page indicates when it was last updated.

10. Contact

EcoCredentials
info@ecocredentials.co.uk
ecocredentials.co.uk