Privacy notice
Last updated: April 2026
Who we are
BandCheck is the data controller for personal data you provide. We are registered with the Information Commissioner's Office (ICO) under the Data Protection (Charges and Information) Regulations 2018. Contact: [email protected].
What we collect
| Data | Source | Lawful basis |
|---|---|---|
| Postcode + house number | You enter | Article 6(1)(b) — performance of contract |
| Email (if provided) | You enter | Article 6(1)(b) |
| Name + contact address (if you buy a package) | You enter | Article 6(1)(b) |
| Move-in date (if you provide one) | You enter | Article 6(1)(b) |
| Payment data (when Stripe is live) | Stripe Checkout | Article 6(1)(b); Stripe is a separate processor |
Who we share data with
- Valuation Office Agency / your local Scottish Assessor — we generate documents you choose to send. We do not transmit on your behalf without your action.
- Resend — transactional email provider for reminders. UK / EU hosted.
- Stripe — payment processing. PCI-DSS compliant.
- Cloudflare R2 — encrypted object storage for generated PDFs (UK region). Signed URLs expire within 1 hour.
How long we keep data
Appeal records: 6 years, the standard contract limitation period in England and Wales. Email-only sign-ups (no purchase): 12 months.
Your rights
- Access — get a copy of all data we hold about you within 30 days
- Rectification — correct inaccurate data
- Erasure — request deletion (we retain anonymised audit logs where legally required)
- Portability — export in machine-readable format
- Object — to processing based on legitimate interest
Email [email protected] to exercise any of these. If we don't respond satisfactorily, you can complain to the ICO.
International transfers
All primary data processing happens in the UK. Stripe and Resend may process payment / email metadata in the EU and US under their standard contractual clauses; supplementary measures (encryption at rest, data minimisation) apply.
Cookies
See our Cookie policy for the specifics.