Last updated 2 October 2026
This notice is for people we contact as part of a campaign COG Services Limited runs for one of our clients, for example a letter we post to your home, and for people who then respond to us. It is separate from the notice for people who contact us about our own services, which is on the COG website.
COG Services Limited runs the campaign and decides how and why your data is used, so COG is an independent data controller. The business whose product or service the campaign promotes is our client. When we pass your details to that client, they use the data for their own purposes and are an independent controller in their own right. COG does not act as a processor on a client's instructions, and there is no Article 28 processor arrangement between us.
How we get your details depends on the campaign, and one or more of the following will apply. We make clear which one applies when we contact you.
Where your details come from a source other than you, the EPC register or a client, this notice is how we tell you that we hold them and where we obtained them.
How we contact you depends on the campaign. We may post a letter to the property address, with a QR code that takes you to a landing page and a phone number you can call. We may follow up by phone, email or post, using the details you have given us or that the campaign holds. Where a property is rented, we may also contact the letting agent or landlord about it.
Where we post a letter, we use the property's address. When you respond, or when you give us your details through an advert or a form, we collect your name and contact details and answers to questions that check whether you are eligible for what the campaign offers. For example, we may ask about your property tenure status, whether you own your home, rent privately or are in social housing. Property tenure status is not special category data, so no Article 9 condition is needed, and it is collected only to screen eligibility.
Our lawful basis across all of these routes is legitimate interests: our interest, and our client's, in reaching and following up with people who may be eligible for a scheme or service, weighed against your interests and rights. Because we rely on legitimate interests, you can object at any time, which we explain below.
If you respond, your details are passed to the company whose campaign you responded to, the one whose name appeared on the letter, so they can follow up with you. From that point that company is responsible for how it uses your data as its own independent controller, under its own privacy information. COG also keeps a record so we can measure how the campaign performed, and we receive updates back, for example whether your response became an appointment or a sale, so we can report on the campaign.
We use a mailing provider to print and post the letters, a landing page to receive responses from the QR code, and the tools listed in our main privacy notice to handle the data. These providers act on our instructions as our processors. We do not sell your data.
Some providers may process data outside the UK. Where that happens the transfer is covered by an appropriate safeguard, such as Standard Contractual Clauses with the UK Addendum.
COG keeps campaign lead data for 24 months from collection, then deletes it. The company you responded to keeps your details under its own policy as an independent controller.
You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, and object to how we use it. Because we rely on legitimate interests to contact you using an address from the EPC register, you can object to that at any time: email us and we will stop, unless we have compelling grounds that override your interests. These rights are not absolute. To exercise any of them, email hello@cogservices.uk, or complain to the ICO at ico.org.uk.
We do not use your response to make solely automated decisions that have legal or similarly significant effects on you.
We use appropriate technical and organisational measures to protect your information. No method of sending information over the internet is completely secure, so we cannot promise absolute security. We may update this notice, and the latest revision date is shown at the top.