Legal and transparency

Privacy notice

This notice explains, in plain English, what data is and is not handled when you use EPC Benchmark. It describes how this site actually works today rather than a generic template. It is clear information, not legal advice.

Last reviewed: 23 August 2026

Who this notice covers

EPC Benchmark is an independent site and brand that publishes an England and Wales domestic EPC comparison service. It is not the official EPC register or an accredited assessor. EPC Benchmark is a site and brand name; no claim is made here that it is a registered company.

For any privacy question or request, contact info@epcbenchmark.co.uk. We publish a contact address rather than personal details of individuals working on the site.

What this service does not collect

The site itself has no account system, no database, no payments, no advertising, no newsletter, no contact form, no address lookup and no user-submitted property form.

It does not ask for, and does not intentionally receive, a real address, UPRN, certificate number or other property identifier.
It does not ask for a name, email address, phone number or payment details.
The comparison runs entirely in your browser against published aggregate files. Nothing you choose or enter is stored or submitted anywhere.

Technical data that is processed when you visit

Two things do involve data about your visit. Both come from the platform that hosts and delivers this site, and both are described honestly below.

Hosting, delivery and security log data

Production delivery currently uses Cloudflare and Lovable infrastructure. As part of normal delivery and protection, hosting providers may process routine connection and server-log data such as your IP address, the time of the request, the URL requested and browser information. A bot-management cookie named __cf_bm may be set, typically lasting around 30 minutes, and is HTTP-only.

Aggregate page-hit analytics

The production hosting platform injects its own telemetry (/~flock.js posting to /~api/analytics) which records page hits. It sets a first-party cookie named session-id lasting about 30 minutes, and sends a timestamp, the route or full URL, the referrer, your browser user-agent, your language or locale, and an approximate country inferred from your browser timezone.

This is used to produce aggregate site statistics: visitors and pageviews, device, source and country breakdowns, bounce rate and session duration. We are not claiming this site has no analytics — it does, through the hosting platform, and the detail above is what it involves.

You can object to this statistical use at any time, free of charge, using the analytics preferences control on the cookies page. When analytics is switched off, the page-hit request is blocked before it is sent and the session-id cookie is deleted and not set again in that browser.

Full cookie-by-cookie detail, including names, sources and durations, is on the cookies page.

Why this data is processed

To deliver the site and keep it available.
To protect it against abuse, bots and other security risks.
To diagnose faults and errors.
To understand aggregate usage and improve the site’s content and design.

We do not sell personal information. We do not build advertising or marketing profiles. We do not make automated decisions about visitors.

Service providers

Hosting, content delivery, security and page-hit measurement are provided by the platform and infrastructure described above, which process technical data on our behalf to host, protect and measure the service. We do not state a processing jurisdiction here, because that is determined by those providers rather than by this site.

How long data is kept

The two cookies described above last approximately 30 minutes each. Retention of server logs and aggregate analytics records is controlled by the hosting provider; this site does not set or record a retention period for them, and we will not invent one.

Your data-protection rights

Under UK data-protection law you have rights over personal data about you, which can include asking for access, correction, erasure, restriction or objection, depending on the circumstances. If you want to raise a request or a concern, email info@epcbenchmark.co.uk and we will respond as far as we reasonably can.

Please note an honest limitation: the site holds no account and no visitor records of its own, so in most cases we cannot identify you from a visit and therefore cannot retrieve or delete data specific to you. We will not promise access to data we cannot identify.

You can also raise concerns with the UK regulator: the Information Commissioner’s Office (ICO).

If the site changes

A future version of EPC Benchmark could allow a visitor to look up a real address. That is not part of the current site, and it would require an updated privacy notice published before any such feature launched. This page will be revised and re-dated when the implementation changes.