Privacy notice
Last updated 15 May 2026.
This notice explains how UK EPC Check handles visitor data and what we do with the EPC records that we mirror from the public register.
1. Who we are
UK EPC Check is operated by Digital Signet, a sole-trader business based in the United Kingdom. For the purposes of UK GDPR we are the data controller for personal data processed on this site.
Contact: [email protected]
We are not the Department for Levelling Up, Housing and Communities. The official UK Energy Performance Certificate record is at find-energy-certificate.service.gov.uk.
2. The data we display is property-level, but addresses are public
The records on this site describe UK properties, not natural persons. They list the address, property type, energy rating, and inspection details. They do not list owners, occupants, or tenants.
That said, an address is a piece of information capable of identifying a household, so under UK GDPR property-level address records can sometimes be personal data even when no individual is named. We rely on two lawful bases for publishing them:
- Legitimate interest (Article 6(1)(f)) in providing a free, fast view over the EPC register, mirroring data MHCLG already publishes openly.
- Public task (Article 6(1)(e)) under the Energy Performance of Buildings (England and Wales) Regulations 2012, which require EPC certificate data to be public. MHCLG publishes addresses on the official register and so do we.
3. We aggregate, we don't browse
We deliberately do not publish browseable lists of every property in a postcode, local authority, constituency, or rating band. Our area pages show aggregate statistics (counts, rating distributions, average efficiency) only. Individual certificates are accessible via direct search and via direct URL if you already know the certificate key, but you cannot enumerate them from this site.
This mirrors the official register's privacy-by-design choice: find-energy-certificate.service.gov.ukrequires an address to look up a specific certificate; it doesn't expose a per-area browse. We follow the same principle.
If you live at a property listed on this site and want its individual certificate page removed from our index (the underlying register is outside our control), email [email protected] with the address or certificate key. We process verified requests within 30 days.
4. What we do collect about visitors
- Server access logs. IP address and user-agent, retained for up to 30 days for security and abuse detection.
- Aggregate analytics via Google Analytics 4 with IP-anonymisation enabled (see section 6).
We do not use advertising cookies, do not sell visitor data, and do not build behavioural profiles of identified individuals.
5. Visitor rights
Under UK GDPR you have the standard data-subject rights regarding the limited personal data we hold about you (server logs, GA4 cookies):
- Right of access (Art. 15) - ask us what we hold
- Right to erasure (Art. 17) - ask us to delete it
- Right to object (Art. 21) - ask us to stop processing
- Right to complain to the ICO at ico.org.uk or 0303 123 1113
Email [email protected] to exercise any of these.
6. Where the data comes from
All EPC data shown on this site is sourced directly from:
- The EPC Open Data Communities register (quarterly bulk pull, per-LA CSV downloads)
This data is made available by DLUHC under the Open Government Licence v3.0, which permits free use including for commercial purposes.
DLUHC, as the publisher of this dataset, is the data controller for the source record. We mirror it.
7. Cookies and tracking
Google Analytics 4. We use Google Analytics 4 to understand which pages are popular and how the site is performing. GA4 sets two first-party cookies (_ga, _ga_RB859J7NV3) which contain a randomly generated client identifier, used to distinguish unique sessions. We have enabled IP-anonymisation, so the last octet of your IP is dropped before Google stores any data. We do not use Google Signals, ad personalisation, or remarketing audiences. Data is processed under our legitimate interest (Article 6(1)(f) UK GDPR) in understanding site usage at an aggregate level. You can opt out by installing the official Google Analytics opt-out browser add-on or by blocking googletagmanager.com in your browser settings.
Cloudflare. Cloudflare sits in front of the site for DDoS protection, caching, and TLS termination. Cloudflare may set operational cookies (e.g. __cf_bm bot-management) that do not personally identify you and are not used for tracking.
No advertising or third-party trackers. We do not run advertising on this site, do not embed third-party social widgets, and do not sell or share visitor data with brokers.
8. Changes to this notice
We may update this notice from time to time. The “last updated” date at the top of this page will change accordingly.