Privacy Policy

This website and the services marketed as London EICR Certificates are operated by Codeex Maintenance Ltd (company number 12777967), registered office 128 City Road, London, EC1V 2NX, United Kingdom.

London EICR Certificates is a trading and marketing name of Codeex Maintenance Ltd. It is not a separate legal company.

Codeex Maintenance Ltd is the data controller for personal data collected through this website and related booking or quotation channels described here.

Privacy requests: mail@codeex.co.uk. Operational customer service: office@londoneicrcertificates.co.uk or 0203 811 8331.

We collect personal data that is necessary to deliver services, respond to enquiries and operate the website securely.

• Contact data: name, email, telephone.
• Property and access data: address/location, access notes, parking constraints, booking preferences.
• Booking agreement records: your typed name, drawn or typed electronic signature, chosen signature method, acceptance time and the terms supplied with your request. We keep these privately to administer the booking and handle queries or disputes; we do not use the drawing to verify your identity biometrically.
• Communication history across email, phone and WhatsApp where you contact us.
• Technical data generated by hosting and security controls (for example request metadata).
• Marketing or renewal preferences where you make a separate choice.
• Invoice, billing and payment-status data for booked work: invoice amounts, due dates, and whether an invoice is unpaid, part-paid or paid after a bank transfer is recorded. We do not collect card numbers or other payment-instrument details through this website.
• Tool inputs held in the browser for the price calculator (non-personal selections) and in-session answers for the compliance checker and curated guidance assistant.

We do not rely on a blanket statement that using the website means you agree to all processing. This notice is information, not blanket agreement. Terms acceptance is separate from optional marketing.

Contract / steps prior to contract — only where necessary for the individual’s own booking, quotation, invoice, report delivery and related service communications. We do not use contractual necessity automatically for a tenant who did not contract with Codeex.

Legitimate interests — tenant/site-contact coordination, relevant business contacts, proportionate claims prevention, customer support, securing the site and preventing spam, with a balancing assessment. Provide appropriate information when contact details come from landlords or agents. Minimise access notes and avoid unnecessary health or sensitive household details.

Legal obligation — tax, accounting, insurance, regulatory and dispute records where a specific duty applies.

Consent — optional analytics/tracking and optional renewal/marketing. For email, SMS or WhatsApp marketing to individual subscribers, legitimate interests alone does not bypass PECR: we need consent or every applicable soft-opt-in condition. Corporate subscribers are distinguished from sole traders and some partnerships. Renewal marketing is distinct from essential service communications. Objections are respected and a minimal suppression list is kept. Public review submission is not automatic permission to republish private email feedback.

You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Marketing opt-out does not disable essential service notices.

Strictly necessary storage supports security, consent preference and essential booking/calculator behaviour.

Optional analytics default to off. Accept, reject and settings controls are available and your choice does not block booking. On the published production website, Vercel Web Analytics and Google Analytics 4 measure visits, controlled interactions and successfully saved requests. Microsoft Clarity provides strictly masked recordings and heatmaps on public information pages without forms. Booking forms, signatures, quotation forms and private operational pages are excluded from recording. These providers remain disabled on review previews and before publication approval.

Analytics events exclude form contents, names, contact details, addresses, postcodes, signatures, uploaded files and booking references. Analytics page URLs exclude query strings and fragments. Google advertising storage and personalisation remain disabled; Google Tag Manager and Meta Pixel are not loaded. Withdraw analytics consent on the Cookie Policy page; this clears our analytics cookies and reloads the page to stop loaded scripts.

To distinguish search and campaign traffic, Google receives an external referring website's origin without its path or query, and only recognised public campaign labels. Arbitrary campaign text, search terms and advertising click identifiers are excluded.

If you accept analytics, this tab remembers the first public page observed after consent, the external referring website's origin and recognised campaign labels for up to 30 minutes. When you submit a request, these limited values can be saved with it for first-party enquiry reporting. We do not save query strings, search terms or advertising click identifiers as attribution. Booking works without this storage, and missing attribution is not treated as direct traffic. See the Cookie Policy for the session keys and withdrawal controls.

Not used on this website: Google Tag Manager; Meta Pixel; WPForms; Trustpilot widget/pixel.

Manage preferences on the Cookie Policy page. Non-essential technologies are not activated until you accept them where consent is required.

We do not sell personal data.

If you accept optional analytics on the published production website, Vercel, Google Analytics and Microsoft Clarity receive limited website-use information, including technical information processed when your browser connects to their services. Clarity masks all text and is restricted to public information pages without forms. These optional services are separate from processing your booking request.

Attending engineers or subcontractors may receive name, property address, contact details, access instructions and documents needed to perform the booked service. They must not use that data for unrelated marketing. Access is restricted to assigned jobs.

The attending engineer is the author of your report and is responsible for the technical content and for the records their registration scheme requires them to keep; for the administration of your booking they act on our instructions under a written agreement.

We use these service providers to run the website and the booking service, each under a contract that limits them to processing on our instructions: Vercel (website hosting and private file storage), Supabase (booking database, hosted in London), Resend (sending transactional email such as confirmations, reminders and reports), Cloudflare (the Turnstile security check on our forms), Microsoft 365 (the mail service that receives email sent to our office address) and Google Workspace (our office email). If you choose to contact us on WhatsApp, Meta processes those messages under its own terms.

We do not take card payments through this website. Invoices are paid by bank transfer, so no card details are collected or stored by us.

Forms are submitted to our own systems; no third-party form service is used.

We may disclose data where required by law, insurers, courts or professional advisers.

Price calculator: remembers non-personal estimate choices in your browser (property type, bedroom band, short postcode, parking). It does not create an account.

Compliance checker: answers stay on this visit and are not kept as a permanent record by the tool. You may print a summary locally.

EICR guidance assistant: uses on-site guidance material. Conversations are not sent to an external AI provider and are not stored permanently by the tool.

Restricted transfers are used only where an adequacy decision or actually executed UK-appropriate safeguards and required assessment are evidenced. EU SCCs alone are not asserted as a sufficient UK mechanism. The UK Addendum or IDTA is checked where applicable. Overseas support or access is documented when known. Where a provider above processes data outside the UK (for example email delivery), it does so under the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask office@londoneicrcertificates.co.uk for details of the safeguards in place.

Booking and quotation data is held in access-controlled systems, encrypted in transit and at rest; engineers see only the jobs assigned to them; staff and contractors are bound by confidentiality; our forms are protected by a security check against automated abuse. No method of transmission or storage is completely secure.

We keep personal data only as long as needed for the stated purposes and applicable legal requirements. Retention depends on the type of record and why it is needed. Contact us to ask about a particular record.

Booking, report and invoice records are kept for six years after the service, which is the period our accounting obligations and any claim about the work require. Access notes and routine technical logs are kept for much shorter periods. Renewal-reminder records are kept until you unsubscribe or the property is no longer ours to remind you about.

Browser tool state and consent preferences remain under your control and are not treated as permanent membership accounts.

We do not use automated decision-making that produces legal or similarly significant effects on individuals.

Depending on the circumstances you may have rights to access, rectify, erase, restrict, object, data portability, and to withdraw consent.

To exercise rights, email mail@codeex.co.uk. We may need to verify your identity. Data-subject access response deadlines are separate from privacy-complaint acknowledgements.

Privacy complaints: email mail@codeex.co.uk. We acknowledge within 30 days, investigate, and communicate progress or outcome without undue delay. You may also complain to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/

ICO complaints: ico.org.uk/make-a-complaint

Our services are intended for adults responsible for properties. We do not knowingly collect personal data from individuals under 18.

We log personal data breaches and assess notification separately: the ICO within 72 hours where required and feasible, and individuals without undue delay where high risk requires it. Those thresholds differ.

If you submit a review on a public platform, that platform’s terms apply. We only republish review content with a lawful basis and without publishing unnecessary personal details.

We may update this Privacy Policy. Changes will be published on this page with a revised last-updated date.