1. Who we are
AssetFort is provided by Fort Energy Limited ("we", "us", "our"), a company registered in England and Wales, company number 14228845, VAT number GB 422524918, of 40 Middlegate, Morpeth, Northumberland, NE61 2DD.
Fort Energy Limited is the data controller for the personal data described in this notice — we decide how and why it's processed, rather than processing it on someone else's instructions.
2. What we collect
What we hold about you depends on how you interact with us. In summary:
| Category | Examples |
|---|---|
| Contact details | Name, email address, phone number, postal address |
| System information | Solar/battery/inverter make and model, install date, system size, original installer, site address |
| Inspection records | Renewable Energy Safety Inspection findings, test results, health score, photographs where taken, inspector observations |
| Payment information | Membership tier and billing history — card details themselves are held by Stripe, our payment processor, never by us directly |
| Communication records | Emails and certificates we've sent you, and whether you've opted in or out of marketing |
| Technical data | Basic website usage data where applicable (see Cookies, below) |
3. Why we collect it
UK GDPR requires us to have a lawful basis for every use of personal data. We rely on the following:
- Contract — to deliver AssetFort membership and the Inspection service you've signed up for, including scheduling, billing, and providing your certificate.
- Legal obligation — to meet our obligations as an RECC and MCS registered installer, and to keep records required by tax and consumer protection law.
- Legitimate interests — to maintain accurate asset records, follow up on outstanding inspections, and improve our service, always balanced against your right to privacy.
- Consent — specifically for marketing communications, described in the next section, which you can withdraw at any time.
4. Marketing communications
We only send marketing emails to people who have given consent, or who are existing customers being contacted about closely related services (a lawful "soft opt-in" recognised under UK electronic marketing law). Every record in our system carries a consent status, and we do not send marketing to anyone marked as not having given consent, or who has opted out.
Every marketing email includes a one-click unsubscribe link. Clicking it removes your consent immediately and permanently — we do not require you to log in, explain why, or contact us to action it. This does not affect service emails you need as an active member, such as renewal notices, certificates, or safety-related communications, which we send on the basis of our contract with you rather than marketing consent.
You can withdraw marketing consent at any time using the unsubscribe link in any email, or by contacting us directly — see Section 12.
6. How long we keep it
We keep active membership and inspection records for as long as you remain a customer, plus a further period afterward to meet our legal, insurance and safety-record obligations — inspection and certification records in particular are kept long-term, reflecting the multi-year safety relevance of the systems they describe. Marketing consent records are kept for as long as you remain subscribed, and for a reasonable period after you unsubscribe, solely to ensure we don't accidentally re-contact you. We do not keep personal data indefinitely without a genuine ongoing reason to do so.
7. International transfers
Our hosting and core records are held in the UK. Some of our service providers, including elements of Stripe's and Brevo's infrastructure, may process data outside the UK. Where this happens, it's covered by appropriate legal safeguards required under UK data protection law, such as standard contractual clauses or an adequacy decision covering the destination country.
8. Your rights
Under UK GDPR, you have the right to:
- Ask what personal data we hold about you, and get a copy of it
- Ask us to correct inaccurate or incomplete data
- Ask us to delete your data, where we don't have an overriding reason to keep it
- Ask us to restrict or object to certain processing
- Receive your data in a portable format, where technically feasible
- Withdraw consent for marketing at any time, without affecting the lawfulness of anything done before you withdrew it
To exercise any of these, contact us using the details in Section 12. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
10. Keeping your data safe
We take reasonable technical and organisational measures to protect personal data, including access controls on our systems (each team member has their own login, not a shared password), secure hosting, and never storing payment card details ourselves. No system is completely immune to risk, but we treat data protection as an ongoing responsibility, not a one-off setup.
11. Changes to this notice
We may update this notice from time to time, for example to reflect changes in our services or the law. The date at the top shows when it was last updated. Continuing to use AssetFort after a change means you're aware of the updated notice.
12. Contact us
For anything relating to your personal data, or to exercise any of the rights above, contact us at hello@assetfort.co.uk, or write to Fort Energy Limited, 40 Middlegate, Morpeth, Northumberland, NE61 2DD.