This notice covers cucumbereco.co.uk, no-c-no-fee.co.uk, epcgrants.org.uk and offgasgrants.org.uk, and everything you tell us by phone, email or message. It replaces our notice of 29 September 2026.
1. Who we are
Cucumber Eco Solutions Ltd is the data controller for the personal information described in this notice. We run the four websites above and the grant, energy-efficiency and heating services they describe.
- Company number 11438494, registered in England and Wales
- Registered office: Kimada House, 442 Flixton Road, Flixton, Manchester, M41 6QT
- Information Commissioner's Office registration: ZC264898
- Privacy questions: info@cucumbereco.co.uk, or write to the address above marked "Privacy"
We are not required to appoint a data protection officer. A director is responsible for data protection and can be reached at the address above.
2. Where your information comes from
Almost all of it comes from you: a form on one of our websites, an advert on Facebook or Instagram where Meta passes your form answers to us, a phone call, an email, a text or a WhatsApp message. The rest arises as we work with you: survey results, certificates, invoices, payments and notes of what we agreed. We do not buy lists.
3. What we collect
- Contact details: name, email address, phone number, postal address and postcode.
- Property and eligibility details: whether you own or let the property, how many properties, EPC ratings, heating and fuel type, and where a grant scheme requires it, whether anyone in the household receives qualifying benefits.
- Service records: surveys, assessments, quotes, invoices, payments, certificates, installer paperwork, and notes of our calls and messages.
- Call recordings: calls to and from our team may be recorded for training and to keep an accurate record of what was agreed.
- Website and advertising data: the page and campaign you enquired from, and the cookie and pixel data described in section 10.
Giving us your contact details is necessary to answer an enquiry or provide a service. If you do not give them we cannot help you. Nothing else is compulsory unless a grant scheme requires it, in which case we will tell you at the time.
4. Why we use it, and the lawful basis
| Purpose | Lawful basis under UK GDPR Article 6 |
|---|---|
| Answering your enquiry and checking which grants or services you may qualify for | Taking steps at your request before entering a contract, 6(1)(b); and our legitimate interest in running an enquiry service, 6(1)(f) |
| Arranging and delivering surveys, assessments, installations, certificates and lodgements | Performance of a contract with you, 6(1)(b) |
| Invoicing, taking payment and keeping accounts | Contract, 6(1)(b); and our legal obligations for tax and company records, 6(1)(c) |
| Passing your details to the installer, surveyor, assessor or scheme administrator who carries out or funds the work | Contract, 6(1)(b); and, for government or supplier grant schemes, the legal obligations of the scheme, 6(1)(c) |
| Telling you about grants and energy services similar to the one you asked about, by email, text message or WhatsApp | Our legitimate interest in promoting our services, 6(1)(f), relying on the "soft opt-in" in regulation 22(3) of the Privacy and Electronic Communications Regulations; or your consent, 6(1)(a), where you ticked the box on our form |
| Recording calls and keeping notes of what was agreed | Legitimate interest in accurate records, staff training and resolving disputes, 6(1)(f) |
| Measuring our advertising and improving our websites | Your consent through the cookie banner where consent is required, 6(1)(a); otherwise legitimate interest, 6(1)(f) |
| Protecting our business, preventing fraud and enforcing our terms | Legitimate interest, 6(1)(f); legal obligation, 6(1)(c) |
Where we rely on a legitimate interest we have considered whether it is outweighed by your interests and rights, and concluded that it is not, because the use is what you would expect from a company you have asked about these services, and you can object or opt out at any time. You can ask us for a copy of that assessment.
Where a grant scheme asks about benefits, we use that answer only to check eligibility and pass it to the scheme. It is not used for marketing.
We do not make decisions about you by purely automated means that have a legal or similarly significant effect on you.
5. Marketing, and how to stop it
If you have enquired about or bought our services, we may contact you about similar grants and energy services by email, text message or WhatsApp. We do this under the soft opt-in rule: you gave us your details while asking about our services, we told you we would do this and gave you the chance to refuse, and every message we send tells you how to stop. Where our form offered a tick box and you ticked it, we rely on that consent instead.
The box on our forms says:
Keep me informed about grants and energy services by email, text and WhatsApp. You can opt out at any time.
To stop marketing on any channel, take one step:
- Email: click Unsubscribe in any marketing email.
- Text message: reply STOP.
- WhatsApp: reply STOP.
- Any channel: email info@cucumbereco.co.uk, or tell any member of our team on the phone.
We record every opt-out against your record for each channel and check that record before any marketing message is sent. Opting out of marketing does not stop messages about a survey, installation, invoice or certificate you have asked for.
We do not sell your personal information, and we do not share it with other organisations for their own marketing.
6. Who we share it with
- Installers, surveyors and assessors who carry out the work you asked for, and the grant scheme administrators, energy suppliers or funders a scheme requires us to report to.
- Service providers acting on our instructions: Xero for invoicing and accounts, Stripe for card payments, CloudTalk for telephony and call recording, Resend for sending email, Vercel and Neon for hosting our customer system, and Meta for advertising measurement as described in section 10. Each is bound by a contract that limits what it may do with your information.
- Professional advisers such as accountants, lawyers and insurers where we need their advice.
- Public authorities where the law requires or permits it.
- A buyer or successor to our business, as set out in section 8.
Some of these providers process information outside the United Kingdom, mainly in the United States and the European Economic Area. Where they do, the transfer is covered by UK adequacy regulations, including the UK–US data bridge, or by the UK International Data Transfer Agreement or Addendum. You can ask us for details of the safeguard that applies to a particular provider.
7. How long we keep it
| Information | How long | Why |
|---|---|---|
| Enquiries that did not lead to a purchase: contact and eligibility details | 3 years from our last contact with you, after which we stop marketing to you. The record is deleted or anonymised 12 months later unless we need it for a legal reason. | Grant schemes open and close and eligibility changes, so an enquiry you made may become actionable later. This is a reasonable period to follow it up. |
| Customers: contracts, surveys, certificates, invoices and payments | 7 years after the last transaction | Tax and company-law record keeping, warranty periods and the time limit for contract claims |
| Call recordings | 12 months | Training, quality and resolving questions about what was agreed |
| Marketing opt-outs | Kept as a suppression record for as long as we send marketing | So we never contact you again once you have asked us not to |
| Website and advertising data | As set out in section 10 |
When a retention period ends we delete the information or remove anything that identifies you, so that only anonymous statistics remain.
8. If our business changes hands
If Cucumber Eco Solutions Ltd, or substantially all of its business or assets, is sold, merged, reorganised or transferred to another company, your personal information, including your enquiry history, your marketing permissions and your opt-outs, may be transferred to the new owner as part of that transaction and to its advisers during due diligence under a duty of confidence. The new owner may use it only for the purposes described in this notice, and your opt-outs continue to apply. We will tell you about any such change by updating this notice and, where the law requires it, by contacting you directly.
9. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- have inaccurate information corrected;
- have your information deleted where we no longer need it or you withdraw consent;
- restrict how we use it while a question about it is resolved;
- receive the information you gave us in a portable electronic form;
- object to our use of your information where we rely on a legitimate interest, which for direct marketing we will always honour without question;
- withdraw consent at any time where we rely on consent, without affecting anything done before you withdrew it.
To exercise any of these, email info@cucumbereco.co.uk or write to our registered office. We may ask you to confirm your identity. We will respond within one month, or tell you if we need longer for a complex request. There is no charge unless a request is clearly unfounded or excessive.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would welcome the chance to put things right first.
10. Cookies and advertising
Our websites set cookies and use similar technologies for three things: to make the site work, to measure how people reach us and use the site, and to measure whether our advertising on Facebook and Instagram works, using the Meta pixel. Cookies that are not strictly necessary are set only after you agree through the banner on each site, and you can change or withdraw that choice through the banner at any time. Measurement data is kept for up to 26 months. Information collected by the Meta pixel is also processed by Meta Platforms Ireland Ltd under its own privacy policy, which you can read at facebook.com/privacy.
11. Keeping your information secure
Your information is held in access-controlled systems with every staff login protected by a password and, for administrators, two-factor authentication. Access is limited to the people who need it to do their job, and changes to records are logged. Our providers are chosen for their security standards and bound by contract.
12. Children
Our services are for adults who own or let property. We do not knowingly collect information from anyone under 18, and we will delete it if we learn that we have.
13. Changes to this notice
This is version 2, effective from 5 October 2026. It replaces version 1 of 29 September 2026. Each version is dated and archived, and the version in force when you enquired is recorded against your enquiry so we can tell you what you were told at the time. If we make a change that affects you significantly we will draw it to your attention.