Privacy Notice

1. Who we are

CostShield Ltd is a company registered in England and Wales (Company No. 17238772). We are the data controller for the personal data described in this notice.

2. What data we collect

When you upload a bill through our bill upload form, we collect:

• Your name and email address, so we can send you your savings report.
• Your business name and postcode, to benchmark against comparable businesses.
• Your utility or service bill (the file you upload).

Bills may contain personal data — for example, your name and service address if you trade as a sole trader. We treat all uploaded bills as personal data regardless of your business structure.

3. Lawful basis for processing

We process your data on two grounds under UK GDPR:

• Contract performance (Article 6(1)(b)): processing your bill is necessary to deliver the savings report you requested.
• Legitimate interests (Article 6(1)(f)): retaining a copy for a short period after delivery so we can answer follow-up queries about your report. Our interests are proportionate and do not override your rights.

We do not use your data for marketing without your separate, explicit consent.

4. Who can see your data

We do not sell, rent, or share your personal data with any third party for commercial purposes. We never will.

5. Third-party platforms (data processors)

We use the following platforms, each processing your data on our behalf under data processing terms:

GoDaddy and Google operate under Standard Contractual Clauses (SCCs) recognised under UK international transfer rules.

6. How long we keep your data

Your bill and all associated personal data are deleted within 30 days of your savings report being delivered to you.

We chose 30 days as a balance between being available to answer your follow-up questions and deleting your data promptly. This commitment is published on our website and upload form.

If we cannot produce a report, we delete your bill on the day we notify you.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request erasure ('right to be forgotten').
• Restrict or object to processing.
• Data portability where processing is automated.

Email us at [email protected] — our data protection contact is Leigh Cummings, Director, CostShield Ltd. We will respond within one calendar month.

8. Complaints

You can raise a complaint with the Information Commissioner's Office (ICO) at any time:

We would welcome the chance to resolve any concern directly first.

9. Changes to this notice

We review this notice annually. Material changes will be updated on costshield.co.uk.