Privacy Policy

Last updated: 19 May 2026

1. Who we are

PAS™ (“Property Appliance Standard”, “we”, “our”) is the controller of personal data submitted through report.propertyappliancestandard.co.uk. We are based in the United Kingdom and process data in accordance with the UK GDPR and the Data Protection Act 2018.

Data protection contact: privacy@propertyappliancestandard.co.uk.

2. What we collect

• Property data — address, postcode, property type, year built, tenure.
• Appliance data — declared makes, models, ages, conditions, service history and any documents you choose to upload.
• Contact data — your name, email address, optional phone number, and your role (seller / agent / landlord / other).
• Payment data — handled directly by Stripe. We receive a payment reference and the amount paid; we do not store card details on our servers.
• Technical data — IP address, browser type, session cookie (used only to resume your in-progress order).

3. Why we collect it

• To generate the Property Appliance Report you ordered.
• To deliver the report PDF and shareable URL to you by email.
• To allow you to recover or revisit your past reports via a magic-link.
• To respond to support enquiries and refund requests.
• To comply with UK financial record-keeping requirements (HMRC retention of payment records for 6 years).
• To improve PAS — using aggregate, anonymous statistics only.

4. Legal basis

We process your data under the following lawful bases:

• Contract — to deliver the report you paid for.
• Legitimate interest — to operate, maintain and improve the platform; to prevent fraud.
• Legal obligation — financial record retention and any compelled disclosure.
• Consent — only where you opt in to marketing communications. You can withdraw at any time.

5. Who we share data with

• Stripe Payments UK, Limited — for processing your payment. Stripe acts as an independent controller of the payment data it collects; see their UK privacy notice.
• Resend Inc. — for sending transactional emails (report delivery, magic-link).
• UK postcode validation service postcodes.io — a single anonymous postcode lookup, no PII.
• Anyone you choose to share your report URL with — once you have your report, sharing the URL is your decision.

We do not sell your data, ever.

6. How long we keep data

• Reports and supporting documents — for the validity period of the report (24 months), then archived for 6 years to meet HMRC requirements, then deleted.
• Abandoned drafts — automatically purged after 30 days of inactivity.
• Audit logs — retained for 2 years for fraud prevention.
• Marketing consent records — kept until you opt out, then deleted.

7. Your rights

Under UK GDPR you have the right to:

• Access a copy of your personal data — available self-service at /account/reports (“Export my data”).
• Erasure — also available self-service. Note: financial transaction records are retained as legally required.
• Rectification — contact us to correct inaccurate data.
• Restriction or objection — contact us.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly.

8. Security

Data is stored on UK-based servers. Payment card details never touch our servers. All admin secrets (Stripe keys, email API keys) are encrypted at rest with AES-256-GCM. The site is served exclusively over HTTPS with a Let's Encrypt certificate that auto-renews.

9. Cookies

We use only essential cookies: a session cookie that lets you resume an in-progress order, and an admin session cookie for staff. We do not use tracking cookies, advertising cookies, or third-party analytics that profile individuals.

10. Children

PAS is not directed at children under 18 and we do not knowingly collect data from them.

11. Changes to this policy

Any material change to this policy will be announced on this page and, where you have an active report, by email.