Privacy Policy

1. Who we are

Enelyst Ltd ("Enelyst", "we", "us") provides energy compliance, building survey and sustainability services across England. We are registered in England & Wales (company number 16240369), with our registered office at 3rd Floor, Old Stock Exchange, St Nicholas Street, Bristol, BS1 1TG, England.

We are the data controller for the personal data described in this policy. If you have any questions about it, contact us at hello@enelyst.co.uk.

2. What we collect

We collect personal data when you:

• Send an enquiry: your name, email address, phone number, organisation name and anything you include in your message.
• Book a service: property addresses, access arrangements, and details about the building relevant to the assessment or survey you've asked for.
• Correspond with us: records of emails and phone conversations relating to your enquiry or project.

We also obtain a limited amount of business contact and property data from public registers and other third-party sources, rather than from the person concerned. Section 6 explains what this covers and why.

We do not knowingly collect data from children, and we do not collect special category data unless you volunteer it in a message.

3. How we use your data

• To respond to enquiries and provide quotes;
• To schedule, carry out and deliver the services you book;
• To lodge statutory certificates (such as EPCs and DECs) on official government registers where the law requires it;
• To remind you about certificate renewals and relevant regulatory deadlines;
• To keep records we are legally required to keep (for example for tax and accreditation purposes).

4. Legal bases

Under UK GDPR, we rely on:

• Contract: to deliver services you've booked or take steps you've asked for before booking;
• Legal obligation: for statutory lodgement, tax and accreditation record-keeping;
• Legitimate interests: to respond to enquiries, maintain business records, send renewal reminders relevant to services you've used, and contact organisations whose statutory certificates are due for renewal (see section 6);
• Consent: for anything else, which you can withdraw at any time.

5. Who we share it with

We never sell your data. We share it only with:

• Accredited assessors and vetted contractors who carry out your assessment, survey or works, limited to what they need to do the job;
• Government registers: energy certificates such as EPCs are lodged on the official national register as required by law. Please note the EPC register is publicly searchable: the certificate, including the property address and rating, can be viewed by anyone. This is a legal feature of the certificate itself, not a choice we make;
• Accreditation bodies: the government-approved scheme an assessor belongs to, where required for auditing and quality assurance;
• Service providers that host our website, email and business systems, under appropriate data processing terms.

6. How we identify prospective customers

Not every organisation we contact has approached us first. We identify potential customers from two public sources: the Get energy performance of buildings register, published by the Ministry of Housing, Communities and Local Government, which records EPCs, DECs and air conditioning inspection reports; and Companies House. Both are published records that anyone can search.

From those sources we hold:

• The property address as published on the certificate;
• Certificate details: the reference number, the rating, the expiry date and the floor area recorded on it;
• Company and business contact details that are publicly available, which may include a business contact name and email address.

We use this to identify organisations whose statutory energy certificates have expired or are approaching expiry, and to contact them to offer assessment services. Our legal basis is legitimate interests under UK GDPR Article 6(1)(f): the interest is in offering relevant compliance services to organisations with a lapsing statutory obligation. We do this on a business-to-business basis only.

Where we contact an organisation we did not obtain the data from directly, we say so and we name the public register it came from, at or before the point of first contact. This is what UK GDPR Article 14 requires of us.

You can object at any time and we will stop. To object or opt out, email hello@enelyst.co.uk. We keep a do-not-contact list, which overrides everything else, so that the same details are not used again.

Where an organisation does not go on to engage us, we delete the prospect record 12 months after we collected it.

7. How long we keep it

We keep enquiry data for up to two years after our last contact. Records relating to delivered work (including assessment evidence) are kept for as long as our accreditation schemes and tax law require, typically six years, and then deleted or anonymised. Prospect data taken from public registers is kept for 12 months where no engagement follows, as set out in section 6.

8. Your rights

You have the right to:

• Access a copy of the personal data we hold about you;
• Ask us to correct inaccurate data;
• Ask us to delete data we no longer need to keep;
• Object to or restrict certain processing;
• Data portability, where processing is based on contract or consent;
• Withdraw consent at any time, where consent is the legal basis.

To exercise any of these rights, email hello@enelyst.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

9. Cookies and third-party services

This website does not set advertising or analytics cookies. Our pages load fonts from Google Fonts, which means your browser makes a request to Google's servers (disclosing your IP address to Google) when a page loads. If we introduce analytics or additional third-party services in future, we will update this policy and, where required, ask for your consent.

10. Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls on business systems, and sharing data only on a need-to-know basis.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page shows when it last changed. Significant changes will be highlighted on this page.