Privacy policy

1. Who we are

Wattcheck is operated by Wattcheck Ltd, a company registered in England and Wales, company number 17428035, registered office 70–72 Pantiles, Tunbridge Wells, Kent, TN2 5TW.

For anything on this site, Wattcheck Ltd is the data controller — the organisation that decides what happens to your information and is answerable for it.

To reach us about anything in this policy, write to the registered office above marked for the attention of the data protection contact. We answer data protection requests within one month, as the law requires.

2. The short version

You can read the whole site without telling us anything. We do not use advertising cookies, we do not run Google Analytics or any other third-party analytics, and we do not set a cookie on your browser when you are simply reading pages.

If you give us your email address to get the buyer’s guide, we use it to send you the guide. That is all it is for.

We only pass your details to a solar supplier if you separately and deliberately tick a box asking us to, and even then only to suppliers named on our supplier list. We do not sell data to anybody, in any circumstances.

Every email we send has a one-click unsubscribe link that works without signing in.

3. What we collect

If you just read the site

Our web server keeps standard access logs: the page requested, the time, the response, your browser’s user-agent string, and your IP address. This is ordinary server plumbing and it is how we notice when something is broken or being attacked. Those logs are kept for 30 days and then deleted.

When you use the savings calculator, the postcode you type is sent to postcodes.io to turn it into a latitude and longitude, and those coordinates are used to look up solar yield from the European Commission’s PVGIS service. We do not store the postcode you type into the calculator.

If you ask for the buyer’s guide

• Your email address. Required — it is where the guide goes.
• Your postcode, if you give one. Optional. We use it to work out the solar yield where you live so the guide’s numbers mean something for your roof rather than an average one.
• The exact wording you agreed to, and when. We store the consent sentences character for character, with a timestamp. The law puts the burden on us to show you consented, and a tick in a database column does not show anything.
• A one-way hash of your IP address, and your browser’s user-agent string. These sit alongside the consent record as evidence that a real, distinct browser submitted the form. The IP address itself is not stored — only an irreversible hash of it, using a key that changes when our server restarts.

If you are a solar vendor claiming a listing

We hold your business contact details and a note of where we found them publicly. That part of the site is covered by the same policy: it is business information about a company, but if you are a sole trader it is personal data and everything below applies to you too.

What we never collect

We do not ask for your name, your phone number, your address, your income, your energy usage, or anything about your household. We do not ask about health, ethnicity, politics, religion or anything else in the special-category list, and we do not want it. If you send it to us anyway in an email, we will delete it.

4. Why, and on what lawful basis

UK GDPR requires a specific lawful basis for each separate thing we do with your data. Not one basis for the site — one for each purpose. Here they are.

Where the basis is consent, you can withdraw it at any time and it is as easy to withdraw as it was to give — see section 9. Withdrawing does not make what we did beforehand unlawful, but it stops us doing any more.

5. Supplier introductions — the optional bit

This is the part of a comparison site that most often goes wrong, so we want to be unusually clear about it.

Asking for the guide does not put you in front of a salesperson. Those are two different things and we treat them as two different things. The form asks you separately, with a box that starts empty, and nothing about the guide depends on your answer.

What the guide request says, in full:

I am asking Wattcheck Ltd to email me the Plug-in Solar Buyer’s Guide. Wattcheck will send one confirmation email and then the guide. Wattcheck will not send me marketing or pass my details to anyone else on the strength of this request alone, and I can withdraw at any time using the unsubscribe link in any email.

What the optional supplier box says, in full:

I would also like Wattcheck Ltd to pass my email address and postcode to UK plug-in solar suppliers that have signed a data-sharing agreement with Wattcheck, so that they can contact me about buying a system. The suppliers this covers are listed at wattcheck.co.uk/legal/suppliers and that list is kept up to date; my details will only ever go to suppliers named on it at the time of sharing. I understand this is optional, that I will still get the guide if I leave it unticked, and that I can withdraw it at any time.

We deliberately do not use phrases like “carefully selected partners” or “trusted third parties”. The Information Commissioner has repeatedly found that sort of wording too vague to be valid consent, and rightly: it tells you nothing about who ends up with your email address. Instead the consent describes a bounded set — suppliers that have signed a written data-sharing agreement with us — and links to the live list of exactly who that is.

Three rules we hold ourselves to on this:

1. Your details only ever go to a supplier named on that list at the time of sharing. If a supplier is added later, that does not retrospectively cover you.
2. We record on your own record which suppliers received your details, and when.
3. Nothing is shared before you have confirmed your email address by clicking the link we send you. An unconfirmed signup is a request we have not verified, and we do not act on it.

We take a fee from suppliers for an introduction. We are telling you that here rather than burying it, because you should be able to weigh it. It does not affect anything else on the site: our comparison rankings and compliance checks are not for sale, and paid placements are labelled wherever they appear.

6. Who else sees anything

We use a small number of suppliers to run the service. They act on our instructions.

• Amazon Web Services — the server this site runs on, in the London (eu-west-2) region. They host the database your record sits in.
• postcodes.io — receives a postcode when you use the savings calculator, in order to return coordinates. It receives no email address and no identifier.
• PVGIS (European Commission, Joint Research Centre) — receives coordinates to return solar yield figures. No personal data.
• An email delivery provider — not yet appointed. When one is, it will be named here before a single email is sent through it.
• Solar suppliers — only if you ticked the optional box, and only those on the list. Once your details reach a supplier they become a data controller in their own right for what they do next, and their own privacy policy applies to that.

We do not sell personal data. We do not share it with data brokers, list rental services, advertising networks or social media platforms, and there is no code on this site that would let us.

We would disclose information if we were legally required to — a court order, or a lawful request from a regulator. We would tell you unless we were forbidden from doing so.

7. How long we keep it

• Server access logs: 30 days.
• An unconfirmed signup: the confirmation link expires after 14 days. Records that were never confirmed are deleted within 30 days of that.
• A confirmed subscriber: for as long as you want the emails, and then 24 months of inactivity, after which we delete the record. We will not sit on a stale list.
• After you unsubscribe: immediately and automatically, we delete your postcode, the hash of your IP address and your browser’s user-agent string, and any record of the supplier-introduction consent. What is left is your email address, the date you signed up, the date you withdrew, and the standard wording you had been shown — which is the same sentence everybody sees, not anything about you. We keep your address because remembering not to email you is the only way to be sure we do not.
• If your details were shared with a supplier: we keep the record of which supplier and when for six years, because that is how long a dispute about it could run. We keep the fact of the share, not a live marketing record.

8. Your rights

These are yours by law. Using them is free, and we will not make it awkward. Write to the registered office above and we will respond within one month.

• Access. Ask what we hold about you and get a copy. For most people this is one email address, one postcode and a consent record — we will send you all of it, including the exact wording you agreed to.
• Rectification. If something is wrong, tell us and we will correct it.
• Erasure. Ask us to delete you. Where we are keeping something only because you consented, we will delete it. The one thing we may keep is a suppression record so we do not accidentally add you back.
• Objection. You can object to anything we do on the basis of legitimate interests — in practice, the server logs. Tell us and we will stop unless we have a compelling reason not to, which we would have to explain.
• Portability. Where we hold data on the basis of your consent, you can have it in a common machine-readable format, or have us send it to somebody else.
• Restriction. You can ask us to freeze processing while a dispute about accuracy or grounds is sorted out.
• Withdrawal of consent. At any time, for any consent, without giving a reason. See the next section.

There is no automated decision-making on this site that has a legal or similarly significant effect on anyone, and no profiling of visitors.

9. Withdrawing consent

The law says withdrawing consent must be as easy as giving it. We have taken that literally.

Every email we send carries a link that unsubscribes you the moment you open it. No login, no password, no form to fill in, no “are you sure” page, no questionnaire about why you are leaving, and it works with JavaScript turned off. It takes effect immediately and it stops both the guide emails and any supplier introductions — clicking unsubscribe is not a request to keep being passed to salespeople.

If you have lost the email, write to the registered office and we will do it for you.

One thing we cannot undo: if your details were already passed to a supplier before you withdrew, that supplier already has them. We will tell you which supplier so you can ask them directly, and they are obliged to act on the same rights.

10. Cookies and tracking

We set no cookies on visitors. Not analytics cookies, not advertising cookies, not “essential” cookies that turn out to be analytics. There is no consent banner on this site because there is nothing to consent to.

The only cookie this site can set is a session cookie for our own staff signing in to the listing-review area. If you are not us, you will never see it.

We do not embed social media buttons, YouTube players, chat widgets or tracking pixels. Paid placements on the comparison pages are served from our own database as plain images and links — there is no ad network involved and no third party learns you visited.

One thing we should own up to. Our typefaces are currently loaded from Google Fonts, which means your browser makes a request to Google and Google sees your IP address when a page loads. No cookie is set and we receive nothing back, but it is a third party seeing a request we asked your browser to make, and on a site that boasts about setting no cookies it is the wrong way round. We are moving the fonts onto our own server. We would rather tell you than quietly not mention it.

When you click through to a vendor from one of our links, we count the click on our own server before redirecting you. We record that the click happened, not who made it.

11. Security

The site is served over HTTPS. The database is not reachable from the internet. Where we hold a token that would let somebody click a link as you — an unsubscribe link, a confirmation link — we store only a one-way hash of it, so a stolen copy of our database is not a set of working links.

We do not hold passwords for consumers, because we do not have consumer accounts. The fewer things there are to steal, the better.

If something did go wrong, we would report it to the Information Commissioner within 72 hours where the law requires, and tell you directly if it were likely to put you at risk.

12. Where your data is

Your data is stored in the United Kingdom, on servers in the AWS London region. PVGIS is operated by the European Commission and receives coordinates only, no personal data.

If we ever appoint an email provider outside the UK, we will name it in section 6 and use the transfer safeguards the law requires — an adequacy decision, or the International Data Transfer Agreement.

13. Children

This site is for people buying equipment for a home. It is not aimed at children and we do not knowingly collect data from anyone under 13. If you think we have, tell us and we will delete it.

14. If you want to complain

Please tell us first — write to the registered office above. We would rather fix something than have you discover we were the sort of company you have to escalate past.

But you do not have to come to us first, and your right to complain to the regulator does not depend on it. The UK’s data protection regulator is the Information Commissioner’s Office:

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Changes to this policy

If we change this policy we will change the date at the top. If a change affects what you have consented to — a new category of recipient, a new purpose — we will not apply it to you retrospectively. We will ask you again.

We keep the exact consent wording each person agreed to, with a version stamp, so we can always tell what a particular person signed up to rather than what the current page happens to say.