Cast Iron Property Solutions Ltd ("we", "us", or "our") is committed to protecting and respecting your privacy. This policy explains how we collect, use, and protect your personal data in compliance with the UK GDPR, the Data Protection Act 2018, and relevant Welsh property legislation.

1. Data Controller

The data controller is Cast Iron Property Solutions Ltd (Company No: 15476520).

• Contact: Andy Davies

• Email: info@castironpropertysolutions.co.uk

• ICO Registration: ZC095741

2. Information We Collect

We collect and process the following information necessary for our professional services:

• Contact Information: Name, email address, and phone number (provided via enquiry or booking).

• Property Data: Address and technical specifications (construction type, heating, insulation, water systems) required for EPCs, LRAs, and Property Reports.

• Inspection Records: Photographic evidence and descriptive data regarding property condition and safety.

3. How We Use Your Data & Lawful Basis

Our lawful bases for processing are Contract (to provide quotes and services) and Legal Obligation (to meet safety and energy regulations).

• Service Delivery: Providing quotes and conducting property assessments (EPCs, LRAs, Inventories, Mid-term Inspections).

• Third-Party Disclosure: * LODGEMENT: We lodge energy data with Elmhurst Energy for inclusion on the UK Government’s EPC Register.

  • REGULATORY: Data may be shared with Rent Smart Wales or the Property Redress Scheme (PRS) for compliance and audit purposes.

  • ACCOUNTING: Business records are maintained via FreeAgent for tax and accounting purposes.

4. Data Retention

• Business/Accounting Records: Retained for 6 years in line with HMRC requirements.

• EPC Data: Property data remains on the public register for 10 years as required by law.

• Safety & Condition Reports: Retained as long as necessary to ensure the property owner meets health and safety compliance records under Welsh Law.

5. Data Security

We use secure, encrypted cloud-based systems to protect your information. Your data is processed within the UK and is not transferred to third countries.

6. Your Rights

Under the UK GDPR, you have the right to request access to, correction of, or erasure of your personal data. You also have the right to contact the Information Commissioner’s Office (ICO) (www.ico.org.uk) if you have concerns about our data practices.