Privacy Notice
This notice explains how Property Kickstart uses personal information when you use our websites, investor services and tools, including the Property Kickstart EPC Checker.
1. Who we are
Property Kickstart is the controller for personal information processed through Property Kickstart services where we decide why and how that information is used. For privacy enquiries, contact hello@propertykickstart.co.uk.
2. Information we may process
Depending on how you use Property Kickstart, we may process information you provide to us, service and communication information, and technical information generated when you use our websites.
For the EPC Checker, you enter a postcode and select a property address. The service may process the postcode, address, UPRN and EPC certificate information needed to complete the lookup and return the result.
3. EPC Checker data source and purpose
The EPC Checker uses the official Ministry of Housing, Communities and Local Government (MHCLG) Energy Performance Certificate data service for England and Wales. The service is used to help users retrieve official EPC information for property research and due diligence.
Property Kickstart does not use the EPC Checker to create a permanent public history of searches.
4. Our lawful basis
Where UK data-protection law applies to EPC lookup information, we rely on our legitimate interests in providing a user-requested property due-diligence tool, operating and securing the service, and diagnosing technical problems. We consider the information used, the necessity of the processing and the impact on individuals when relying on this basis.
5. Data minimisation and retention
We aim to use only the information needed to provide and secure the service. We do not intentionally store EPC postcode, UPRN or selected-address searches in a separate permanent Property Kickstart search-history database.
Our hosting provider may retain operational logs for a limited period. Where Property Kickstart deliberately creates an identifiable diagnostic copy to investigate a technical issue, we will delete it when the issue is resolved and, unless a longer period is legally required, no later than seven days after creation.
6. Service providers and recipients
We use service providers where necessary to operate Property Kickstart. For the EPC Checker this includes Netlify for website hosting and serverless functions, and the official MHCLG EPC data service as the source of certificate data. We may also use other providers for wider Property Kickstart services where stated at the relevant point of collection.
7. International processing
Some service providers may process information outside the UK. Where this happens, we require an appropriate lawful transfer mechanism or safeguard where required by UK data-protection law.
8. Analytics and cookies
The EPC Checker currently does not use visitor analytics, advertising trackers or non-essential cookies. Essential technical processing by hosting infrastructure may still occur. If we introduce analytics or other non-essential tracking, we will review and update this notice and any cookie information before enabling it.
9. Accuracy of official EPC information
EPC information is sourced from the official government dataset. Property Kickstart does not create the underlying certificate record and cannot guarantee that an official record reflects the current condition of a property. Users should verify important information against the official certificate and wider due-diligence evidence.
10. Your data-protection rights
Depending on the circumstances, you may have rights including access, rectification, erasure, restriction, objection and data portability. You may also have the right to complain to the Information Commissioner's Office (ICO).
To exercise a right, contact hello@propertykickstart.co.uk. We may need enough information to identify the relevant data and verify your identity where appropriate.
11. Security
We use proportionate technical and organisational measures designed to protect information against unauthorised access, loss, misuse or alteration. EPC API credentials and bearer tokens are kept server-side and are not intentionally exposed in browser code.
12. Changes to this notice
We review this notice when our services, legal obligations or data-processing arrangements change. The review date above shows when this version was last checked.