ECO4 Assessments is the data controller for the information described in this notice. That means we decide why and how your personal data is used, and we are responsible to you for it.
ECO4 Assessments
5 Brayford Square, London, E1 0SG
info@eco4assessments.com · 0330 1331 788
ICO registration number: [TO CONFIRM]
When you complete the eligibility check we collect:
Some of your answers concern health conditions in your household. Under UK GDPR that is special category data, and we rely on your explicit consent to process it. You do not have to answer those questions, and there is a "none of the above" option throughout.
When you enter your postcode, we search the government's Energy Performance of Buildings register and show you the addresses it holds so you can pick yours. We then read that property's EPC band, because ECO4 funding depends on it.
This happens through the official developer API operated by the Ministry of Housing, Communities and Local Government. We do not scrape it, and we do not use a third-party address service.
We only ever keep the one property you select. The other addresses returned for your postcode are shown to you so you can find yours, and are then discarded — they are never stored, and never sent to anyone.
The information we keep about the property you select is: the address and postcode, its UPRN (a property reference number), its current EPC band, and its certificate number.
MHCLG's guidance is that address-level EPC data is personal data. We treat it that way, which is why it is covered by this notice even though it comes from a public register rather than from you.
If your home has no EPC certificate, that does not disqualify you — an unassessed property is often exactly the one that needs an assessment — and we record it as unverified rather than guessing a rating.
| What | Lawful basis |
|---|---|
| Checking whether you qualify, and contacting you about it | Consent (UK GDPR Art. 6(1)(a)) — given when you tick the box before submitting |
| Health and vulnerability answers | Explicit consent (Art. 9(2)(a)) |
| Marketing calls, texts and emails | Consent under PECR, recorded with the exact wording shown to you |
| Keeping records of consent and of assessments carried out | Legal obligation and legitimate interests in being able to evidence compliance |
Consent means you can withdraw it at any time, and doing so is as easy as giving it — email us and we will stop. Withdrawing consent does not affect anything done before you withdrew it.
If you qualify, we pass your assessment and contact details to an installer so they can arrange a survey. Under the ECO4 scheme installers must be TrustMark registered and work to PAS 2035.
Our installer partners: [TO CONFIRM — named list]
We also use service providers who process data on our behalf under contract: our CRM (GoHighLevel), our database host (Supabase) and our website host (Vercel). They act on our instructions and may not use your data for their own purposes.
This page uses the Meta Pixel, a small piece of code from Meta Platforms Ireland Ltd. It tells Meta that you visited the page and, if you submit the check, that an enquiry was completed. We use this to measure and improve our Facebook and Instagram adverts. Meta may set cookies and link this to your Meta account.
We do not send Meta your answers, any health or benefit information, or your contact details. You can control this through your browser's cookie settings and your Meta ad preferences.
We do not sell your data, and we do not pass it to anyone not listed here.
We keep your assessment for 12 months from the date you submit it, after which it is reviewed and deleted unless you have become a customer or there is a legal reason to keep it longer. Every record carries its own review date so this is applied in practice rather than promised in principle.
The ECO4 scheme closes on 31 December 2026, and assessments have little value after that.
Under UK data protection law you have the right to:
Email info@eco4assessments.com and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office — ico.org.uk/make-a-complaint, or 0303 123 1113. We would rather you came to us first so we can put it right.
Property and energy data shown by this service comes from the government's Energy Performance of Buildings register, published by MHCLG. We are required to reproduce the following notice alongside it:
Ordnance Survey and Royal Mail copyright and database right notice
This data contains address data (address 1, address 2, address 3, postcode) processed against Ordnance Survey's AddressBase Premium product, which incorporates Royal Mail's PAF® database. MHCLG has published the address data with the consent of Ordnance Survey and Royal Mail Group Limited; Ordnance Survey and Royal Mail Group Limited reserve all their respective copyright, database rights, trademarks and other intellectual property rights.
Ordnance Survey and Royal Mail Group Limited permit the use of address data solely for specific purposes related to the energy performance of buildings. This service uses it for one of those permitted purposes: promoting and marketing energy efficiency improvements that may be made through a government energy efficiency programme or initiative.
Any use of address data not specified in that notice, or not covered by a copyright exception, requires an appropriate licence from Ordnance Survey (PricingLicensing@os.uk) and/or Royal Mail Group Limited (address.management@royalmail.com). The full notice is published at get-energy-performance-data.communities.gov.uk.
All fields other than the address data, including UPRNs, are licensed under the Open Government Licence v3.0.
If we change how we use your data we will update this page and change the date at the top. Where the change is significant and we are relying on your consent, we will ask you again.