Privacy Policy

The data controller responsible for your personal data is:

If you have any questions about how we handle your personal data, please contact us using the details above.

We collect and process the following categories of personal data:

Agency and business contacts

• Full name and job title of the instructing coordinator or branch manager.
• Business email address and direct telephone number.
• Agency name, branch address, and 4-digit branch authorisation code.

Tenant and occupier data

• Tenant phone numbers: Provided by the instructing agency to allow our assessor to arrange access. We use these solely to contact the tenant to confirm the appointment and gain entry to the property. Tenant phone numbers are not retained after the visit is complete.
• Tenant name (first name only, where provided by the agency).

Property access details

• Full property address including postcode.
• Key safe codes, alarm codes, or other access instructions provided by the agency.
• Details of any access restrictions or special instructions.

Important: Access codes (key safe codes, alarm codes) are treated as strictly confidential. They are used only during the scheduled visit and are permanently deleted from our records within 24 hours of the visit being completed.

Data lodged on the government register

• For Energy Performance Certificates (EPCs), the following data is lodged on the Domestic Energy Performance Certificate Register maintained by Elmhurst Energy on behalf of the Department for Energy Security and Net Zero: property address, property characteristics (floor area, construction type, heating system, etc.), and the EPC rating. This register is publicly accessible.
• For PAS 2035 Retrofit Assessments, data is lodged in accordance with the requirements of TrustMark and the relevant scheme operator. This may include property address, occupancy details, and assessment findings.
• For BS 5839-6 Fire & Carbon Monoxide Safety Audits (Launching January 2027): System compliance metrics, sensor manufacturing dates, and alarm grading data are logged and archived locally for corporate account management and professional indemnity insurance verification purposes.
• Tenant names and personal contact details are not lodged on any government register.

Website and enquiry data

• Name, email address, phone number, and message content submitted via our contact or booking forms.
• IP address and browser information collected automatically when you visit our website (used for security and analytics purposes only).

We process personal data on the following legal bases under UK GDPR Article 6:

• Contract performance (Article 6(1)(b)): Processing tenant phone numbers and property access details is necessary to perform the service you have instructed us to carry out.
• Legal obligation (Article 6(1)(c)): Lodging EPC and retrofit assessment data on the government register is a statutory requirement under the Energy Performance of Buildings (England and Wales) Regulations 2012 and related legislation.
• Legitimate interests (Article 6(1)(f)): Processing business contact details for invoicing, account management, and service communications is necessary for our legitimate business interests.
• Consent (Article 6(1)(a)): Where you submit an enquiry via our website contact form and tick the consent checkbox, we process your data on the basis of your consent. You may withdraw consent at any time by contacting us.

We use personal data for the following purposes:

• Scheduling and confirming property assessment appointments.
• Contacting tenants or key holders to arrange access on the day of the visit.
• Delivering completed certificates, reports, and assessments to the instructing agency.
• Lodging certificates on the relevant government register as required by law.
• Issuing invoices and managing corporate account billing.
• Responding to enquiries submitted via our website or by telephone.
• Maintaining records for professional indemnity and compliance purposes.

We do not use personal data for automated decision-making or profiling. We do not sell, rent, or share personal data with third parties for marketing purposes.

We share personal data only where necessary and with appropriate safeguards in place:

• Elmhurst Energy: EPC data is lodged on the national register via Elmhurst Energy's accreditation platform. Elmhurst Energy acts as a data processor on our behalf and is bound by its own data protection obligations.
• TrustMark: Retrofit assessment data is shared with TrustMark as required by the PAS 2035 scheme.
• Website platform: Enquiry form submissions are processed by our website hosting and messaging platform (GoDaddy Airo). Data is processed in accordance with GoDaddy's privacy policy.
• Legal requirements: We may disclose personal data to law enforcement or regulatory authorities where required by law.

We do not transfer personal data outside the United Kingdom or the European Economic Area.

We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure:

• All data transmitted via our website is encrypted using HTTPS/TLS.
• Access codes and sensitive access details are stored only in encrypted, access-controlled systems and are deleted promptly after use.
• Our website and data systems are hosted on secure, UK-based infrastructure.
• We limit access to personal data to those members of our team who need it to perform their role.
• We review our security practices regularly and update them as necessary.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and will inform affected individuals without undue delay.

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may ask us to correct inaccurate or incomplete data.
• Right to erasure: You may ask us to delete your personal data where there is no longer a lawful basis for processing it.
• Right to restriction: You may ask us to restrict processing of your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at cody@slatecompliance.co.uk. To exercise any of these rights, please contact us at We will respond within one calendar month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at or by calling 0303 123 1113. ico.org.uk or by calling 0303 123 1113.

Our website uses cookies to ensure it functions correctly and, with your consent, to collect anonymous analytics data to help us improve the site.

• Essential cookies: Required for the site to function. These cannot be disabled.
• Analytics cookies: Used to understand how visitors use the site (e.g. Google Analytics). These are only set if you click "Accept all" on our cookie banner.

You can manage your cookie preferences at any time by clearing your browser cookies and revisiting the site, which will re-display the cookie consent banner.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version will always be published at with the date of the most recent update shown at the top of the page. slatecompliance.co.uk/privacy-policy with the date of the most recent update shown at the top of the page.

We encourage you to review this policy periodically. Where changes are material, we will take reasonable steps to notify affected individuals.