1. Who we are
CrierData is the trading name of CrierData Limited, a company registered in England and Wales, company number 17363206, incorporated on 27 July 2026. Registered office: 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom.
We paid the ICO data protection fee on 27 July 2026, and our registration is effective from that date. Our ICO registration reference will be published here as soon as the ICO issues its confirmation.
We are the data controller for the personal data described in this notice. Contact for anything here, including objections and requests: privacy@crierdata.com. Email is the route we monitor daily and the fastest way to have a request actioned.
2. What this notice covers
This notice covers three groups of people, and the position is different for each.
| You are | Read |
|---|---|
| A property owner whose property appears in our data | Section 3 |
| A visitor to this site, or someone we have contacted | Section 4 |
| A customer or prospective customer | Section 5 |
3. Property owners — data from the EPC register
This is the section that matters most, and it applies to people who have never heard of us.
What we hold
We compile information from the Energy Performance Certificate register for England and Wales, published by the Ministry of Housing, Communities and Local Government (MHCLG).
For each property this includes the address and postcode, the Unique Property Reference Number, the certificate number, the energy efficiency rating and score, certificate lodgement and inspection dates, the tenure recorded at assessment, and physical characteristics of the building such as property type, floor area, construction age, heating system, fuel type, and the condition of walls, roof, windows and floors. Where available it also includes the improvement measures the assessor recommended, their indicative cost and estimated saving.
We do not hold, seek, buy or infer: owner or occupier names, telephone numbers, email addresses, correspondence addresses, ownership records, company ownership data, mortgage or financial information, or occupancy details.
Why this is personal data at all
The register records physical facts about buildings. But because a property owner may be identifiable from the address of a property they own, this information can be personal data about them. MHCLG takes that position, and an ICO case officer has agreed with that characterisation; the point is genuinely contested rather than settled. We treat all address-level EPC data as personal data and apply UK GDPR to it in full, rather than rely on an argument that it falls outside.
Where we got it
Directly from the MHCLG published register. We did not obtain it from you. We combine it only with open geographic reference data — Ordnance Survey Open UPRN coordinates and the ONS postcode directory — to derive each property’s location and region. We never combine it with data about you, the owner, from any source.
What we do with it
We filter the register to identify private rental properties whose latest certificate indicates that energy efficiency improvement work is likely to be required, and supply region-filtered lists of those properties, by monthly subscription, to certified energy assessors and to insulation and heat pump installers.
Our lawful basis
Legitimate interests — Article 6(1)(f) UK GDPR. The interests pursued are our commercial interest in operating this service, the commercial interests of the trades we supply, and the public interest in improving the energy efficiency of rented housing ahead of statutory deadlines.
We have carried out a Legitimate Interests Assessment weighing those interests against the rights of property owners. In summary, we consider the balance is met because:
- the information is already published by government on a public register, expressly for re-use;
- it concerns the physical characteristics of a building rather than the personal circumstances of its owner;
- it contains no names, no contact details and no financial information;
- the properties are subject to a statutory minimum standard, so there is a genuine benefit to an owner in learning what work is required; and
- the use we permit is narrowly defined and contractually enforced against our customers.
We also record the arguments against: owners have not chosen to be contacted, and onward commercial supply may sit outside what a person expects when their property is entered on a public register. We keep the assessment under annual review, and you can object at any time under section 6. A copy is available on request.
Why we have not contacted you individually
Article 14 UK GDPR normally requires us to tell you directly that we hold your data. The register covers millions of properties and contains no contact details for any owner. Writing individually to every owner would require us to obtain contact information we have deliberately chosen not to hold, and would be disproportionate to the limited privacy impact of the processing.
We therefore rely on the disproportionate effort exemption in Article 14(5)(b), and publish this notice as the substitute measure the exemption requires. Our written reasoning is available on request.
Who we share it with
Two categories of recipient: certified energy assessors, who use it to identify properties requiring reassessment, and insulation and heat pump installers, who use it to identify properties requiring improvement work.
Every recipient accepts binding end-user terms before receiving any data. Those terms restrict what they may use it for, prohibit resale or republication, require deletion when their subscription ends, and require them to honour any objection we have received.
We do not sell or supply data to list brokers, marketing agencies, lead generation companies, credit reference agencies or data aggregators.
How long we keep it
We keep the compiled register data for as long as we operate the service, refreshing it monthly from the current published release so that what we hold reflects what government currently publishes.
If a property is removed from the source register, or if we receive an objection, we record it on a permanent suppression list. That list is retained indefinitely and deliberately — it is the only way we can guarantee that a property, once withdrawn, stays withdrawn from every future file. It holds the property identifiers and the date, and nothing further.
4. Website visitors and business contacts
Website visitors
This website sets no cookies. There is no analytics, no tracking, no advertising technology and no third-party content of any kind: every font, stylesheet, image and script is served from this domain, so loading a page sends nothing about you to anyone else.
The site is hosted by Cloudflare, which processes visitors’ IP addresses transiently in order to deliver pages and to protect the site from attack. We see only aggregate counts — requests and unique visitors per day — with no visitor-level detail, and we cannot identify you from a visit.
Enquiries
If you email us or submit a form we process the name, company, trade, postcode area and email address you provide, in order to respond and to send what you asked for. Lawful basis: legitimate interests, or steps taken at your request before entering a contract. Retained for 24 months from your last contact.
Business contacts we approach
We contact incorporated businesses about our service using publicly available business contact information, including the Companies House register and published trade directories. Lawful basis: legitimate interests. Every message identifies us, gives our postal address and includes a means of opting out.
If you ask us to stop, we stop permanently. We keep a suppression record containing your email address and the date, indefinitely, for the sole purpose of ensuring you are never contacted again. Reply "no" to any message, or email privacy@crierdata.com.
5. Customers
For customers and prospective customers we process contact details, company details, subscription and billing records, records of the files we have sent, and the version of the end-user terms accepted and when.
Lawful basis: performance of a contract, and legal obligation for financial records. Payment card details are handled entirely by Stripe and never reach our systems. Retained for the life of the subscription and six years afterwards, to meet HMRC record-keeping requirements.
6. Your rights
Under UK GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict processing, and — where we rely on legitimate interests, as we do for the register data in section 3 — to object to processing at any time.
To object to a property appearing in our data, email privacy@crierdata.com with the address and postcode. We will add it to our permanent suppression list, remove it from all future files, and notify current customers that it must not be used further. We respond within one month. You do not need to give a reason.
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would prefer the chance to put things right first, but you do not have to come to us before going to the ICO.
7. Where your data is held
Our website and DNS are provided by Cloudflare and pages are served from its edge network. Company email is provided by Google Workspace. Post is handled by our registered office provider in Suffolk. Each acts as our processor under its standard written terms.
Cloudflare and Google are US-headquartered and operate globally. Where personal data is transferred outside the UK, the transfer is covered by the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, which both providers incorporate into their terms.
Cold outreach to prospective business customers is sequenced and sent through Instantly, which acts as our processor and handles only the business contact details of the incorporated businesses we approach (section 4). Instantly is also US-based; where it transfers personal data outside the UK, the transfer is covered by the same UK International Data Transfer Addendum arrangement described above. Our dispatch automation runs on n8n.
The subscription data product is not yet in service. No Energy Performance Certificate register data has been obtained or processed at the date of this version. When the product goes into service this section will be updated — naming each provider and its hosting region, and preferring UK or EU regions where they are offered — before any file is supplied to anyone. Payments will be handled by Stripe; card details are processed on Stripe’s own systems and never reach ours.
8. Automated decision-making
We apply a priority score to properties so that lists arrive sorted. This is a ranking applied to properties, not a decision about a person, and it produces no legal or similarly significant effect on anyone. We carry out no automated decision-making or profiling within the meaning of Article 22.
9. Changes to this notice
We update this notice when our processing changes, and publish the version number and effective date at the top. Material changes affecting property owners are summarised here for at least 12 months.
Changes in version 1.1 (27 July 2026): company registration details added following incorporation on 27 July 2026, with the ICO registration reference to follow on confirmation; section 3 now states precisely which open geographic reference data we combine with the register, and that we never combine it with data about owners; section 3’s description of the regulator’s view was corrected from “the ICO has agreed” to “an ICO case officer has agreed”; objections and requests are now handled by email, which is the route we monitor daily; and section 7 now names our cold-outreach sequencing provider (Instantly) and dispatch automation (n8n).