Privacy Policy

This Privacy Policy explains how L&D Energy, a trading name of Luminous & Deliver (“we”, “us”, “our”), collects, uses and protects your personal data when you enquire about or book one of our services.

1. Who we are

Data controller: Abdul Motaleb Taher, trading as Luminous & Deliver / L&D Energy, based in Stratford, London. For privacy enquiries, contact us at [email protected].

2. What data we collect

When you contact us or book a service, we collect:

• Your name
• Phone number
• Email address
• Property address and postcode
• Property details relevant to your quote or assessment, including internal floor area when known and requested services
• Your customer type, requested timing and access arrangements
• Any additional notes you provide

For an assessment we also record measurements, property features, photographs and supporting evidence needed to produce and quality-check the EPC. Please avoid including unrelated personal information in your enquiry or evidence.

3. How we use your data

• To respond to your enquiry and arrange your appointment
• If you tick the optional box on the quote form, to send you one email about L&D Digital (our web and software service) and L&D Builds (custom PC builds)
• To carry out the EPC assessment and lodge your certificate on the UK Government EPC Register
• To send you your certificate and any related documents
• To invoice and collect payment
• To meet our legal and regulatory obligations

4. Lawful basis

We use information needed to prepare your requested quote and arrange or deliver a service to take steps at your request before a contract, or to perform that contract. We rely on legitimate interests to answer other business enquiries, protect the website, keep proportionate service records and handle complaints. We rely on legal obligations where tax or other applicable law requires records or disclosures.

The form’s contact agreement confirms that you want a reply about your request. It is not permission for unrelated marketing. Where we rely on consent for any separate optional purpose, you can withdraw that consent.

The L&D Digital and L&D Builds box is unticked unless you tick it. If you do, we rely on your consent to send one email about L&D Digital and L&D Builds, which are part of the same business, Luminous & Deliver. We send nothing more about it unless you reply. To withdraw, reply to that email or contact us.

5. Sharing your data

We share your data only where required to deliver the service:

• The UK Government EPC Register (mandatory lodgement of EPC data)
• Elmhurst Energy and Quidos, our accreditation schemes
• Resend, our transactional email provider
• Cloudflare, for website hosting, security checks, email routing and website statistics
• Google, for the business email inbox used to handle correspondence
• Your letting agent or solicitor, only if you ask us to send the certificate directly

We do not sell your data and we do not share it for marketing purposes.

Some service providers process information outside the UK. Their data-processing arrangements use applicable transfer safeguards, such as adequacy decisions or approved contractual terms. Contact us if you need details of a particular processing arrangement. Certificate information lodged on the government register is handled under the register’s own privacy notice.

6. Data retention

We keep enquiry correspondence while dealing with your request and any necessary follow-up or dispute. Information that becomes part of an assessment record is retained with that record. Financial records are kept for the applicable tax and accounting retention period. We review other correspondence against its continuing purpose; the website does not automatically delete email from the business inbox.

EPC assessment evidence must be retained securely for at least 15 years under our accreditation scheme’s requirements. A complaint, legal claim or other applicable obligation can require longer retention. We retain only the information needed for those purposes.

The government EPC Register controls its own retention. A certificate’s usual 10-year validity is not a promise that its record is deleted after 10 years. See the register’s data-disclosure guidance and privacy notice.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure where we no longer need the data
• Object to or restrict processing
• Request data portability
• Complain to the Information Commissioner’s Office (ico.org.uk)

To exercise any of these rights, email [email protected].

Complaints about your data

If you’re unhappy with how we’ve handled your personal data, email [email protected] with “Data complaint” in the subject line. We’ll acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome. If you’re still unhappy after that, you can complain to the Information Commissioner’s Office.

8. Security

We use industry-standard security measures including HTTPS encryption in transit and access controls on stored data.

9. Website statistics and browser storage

We use Cloudflare Web Analytics to understand aggregate page use and loading performance so we can improve this website. Its beacon does not use analytics cookies, local storage or fingerprinting to recognise you across visits. It sends page and referrer locations with query strings and fragments removed, browser/device information and performance measurements. Cloudflare discards the source IP address at its nearest data centre rather than storing it in its analytics databases or logs.

We use these statistics only to improve this service, under the statistical-purpose exception to the storage and access consent rules. You can object using the controls below. We do not send enquiry contents or customer identities to Web Analytics and do not join its statistics to individual enquiry records. We do not use GA4, advertising trackers or session recordings.

A separate, controlled service/source label accompanies your actual enquiry so we can understand which website route generated it. Where your browser provides it, the enquiry also carries the name of the website that sent you here (for example google.com) and the first page you opened on this site; never the full link, search words or tracking codes, and nothing is stored on your device for this. We also look up the postcode you give on postcodes.io, an open-data service, to see which borough it is in. Successful enquiries, qualified enquiries and confirmed bookings are assessed from our business records; analytics page views do not establish that a booking happened.

When you choose, this browser stores a single on/off preference called ld-energy-analytics. It contains no visitor identifier or contact details and remains until changed or browser storage is cleared. An earlier rejection stored by the old banner is honoured. We also respect supported Do Not Track and Global Privacy Control signals. If browser storage is unavailable, optional analytics stays off.

Cloudflare security and Turnstile protect the site and enquiry form from abuse. They may process browser/network information and use necessary security cookies, such as cf_clearance. These protections are separate from optional analytics. The form may retain your selected customer type in that browser history entry; it does not persist your name, address or contact details there.

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page indicates when it was last revised.