THE LEGAL STUFF

Privacy policy

01 August 2024

This policy sets out the basis on which any personal data we collect from you or that you provide to us, will be processed, shared and used by us whether that be personal data you provide through your use of this website; when you enter into a contract for the supply of energy with us or take part in a competition and how you can exercise your privacy rights. Please read the following carefully to understand how we look after your personal data. This website is not intended for children and we do not knowingly collect data relating to children.

This policy applies to personal information collected by Ecotricity Group Limited (registered no.03521776) and its subsidiary Ecotricity (Smart Grid) Limited (registered no.11574520), and whose registered office is at Lion House, Rowcroft, Stroud, Gloucestershire, GL5 3BY. In these terms and conditions “Smart Grid”, “we”, “our” or “us” means Ecotricity (Smart Grid) Limited, and “you” or “your” means you, our customer.

Ecotricity Group Limited is registered with the ICO with registration number ZA021407 and Ecotricity (Smart Grid) Limited is registered with the ICO registration number ZB339203.

What does Ecotricity Smart Grid do?

Ecotricity Smart Grid, through our product Ecolibrium, operates a Virtual Power Plant (VPP) that aggregates the generation, storage, and consumption potential of our customers' assets (the “Services”). This enables our customers to financially benefit from providing flexibility services in the energy and ancillary markets.

How we collect your information and why

Personal Data means any information about a living individual from which that person can be identified. It does not include data which has been anonymised.

We may collect, use, store and transfer different kinds of personal data about you, as follows:

Type of data	Data required
Identity Data	First name
	Last name
	Username or similar identifier
	Title
Contact data	Company/asset address
	Email address
	Telephone numbers
Financial data	Bank account and payment card details
Transaction data	Details about payments to and from you
	Other details of products and services you have purchased from us
Technical data	Your internet protocol (IP) address
	Your login data, browser type and version
	Time zone setting and location
	Browser plug-in types and versions
	Operating system and platform device ID
	Other technology on the devices you use to access this website
Profile data	Your username and password
	Purchases or orders made by you
	Your preferences, feedback and survey responses
Usage data	Information about how you use our website, products and services
	Your communication preferences
Marketing and communications data	Your preferences in receiving marketing from us and our third parties
	Your communication preferences
	Market research

The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

Information that you provide directly

• We collect your Identity, Contact, Financial and Transaction Data when you

• Contact us to enquire about our Services

• Register with us to receive the Services

• Use the Services

• Use our website under the domain name www.ecotricitysmartgrid.co.uk (the “Website”)

• Request information or assistance from us.

• You may be asked to provide us with Usage Data which we would communicate with you about, explaining the purposes in which we require it.

Information that we obtain from third party sources

• We may collect information about you, including Identity and Contact Data, that is publicly available, for example, from business directories, companies house or data brokers.

Information that we collect automatically

• When you use the "Services" we may collect asset and meter data

• When you use the Website, we collect Technical Data about your activity by using cookies and similar tracking technologies.

• Cookies are small amounts of information which we store on your computer. Cookies make it easier for you to log on to and use the Website during future visits. They also allow us to monitor Website traffic and to personalise the content of the Website for you. You may set up your computer to reject cookies by modifying the settings in your browser although, in that case, you may not be able to use certain features on our Website. You can also disable Cookies from the Cookie banner you are presented upon visiting our website.

• Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.

• We may send out emails that use tracking to show how they’ve been interacted with. We do this to help improve our emails and for analysing how successful they are. You can opt out of email tracking at any time by clicking a link in the footer of our marketing emails.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.

We use the following cookies:

Strictly necessary cookies. These are cookies that are required for the operation of our website. These essential cookies are always enabled because our website won’t work properly without them. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services. You can switch off these cookies in your browser settings but you may then not be able to access all or parts of our website.

Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.

Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose so that they can serve you with relevant advertising on their websites.

We use the following Cookies on our website, however, should you decline the collection of Cookies by choosing to "Reject All" cookies in the cookie banner. when you visit our page only essential cookies which enable the running and performance of the website can be used.

However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

Except for essential cookies, all cookies will expire within 2 years.

Cookie Name	Placed By	Description
NID	Google	Google uses this cookie to set a unique ID to remember your preferences for marketing/tracking purposes. Lifespan: 6 months.
FPAU	Google	Google sets this cookie, which assigns a specific ID to the visitor. This allows us to determine the number of specific user-visits for analytical/statistical purposes. Lifespan: 90 days.
AID	Google	Google sets this cookie to link activity across devices if you are signed in to your google account. It is used in conjunction with advertising campaigns. Lifespan: 13 months.
TAID	Google	Google sets this cookie to link activity across devices if you are signed in to your google account. It is used in conjunction with advertising campaigns. Lifespan: 14 days.
FPGCLDC	Google	This cookie is placed by Google to link any analytics to a Campaign Manager marketing campaign. Lifespan: 90 days.
gcl_dc	Google	This cookie is placed by Google Adsense and used to store and track conversions for marketing / tracking purposes. Lifespan: 90 days.
gcl_au	Google	This cookie is placed by Google Adsense and used to store and track conversions for marketing / tracking purposes. Lifespan: 90 days.
FCNEC	Google	This cookie may be used to enable social media features on our website. Lifespan: 265 days.
FPGCLAW	Google	This cookie is placed by Google Ads. It helps track how advertising campaigns convert to activity on our website. Lifespan: 90 days.
FPGCLGB	Google	This cookie is placed by Google Ads. It helps track how advertising campaigns convert to activity on our website. Lifespan: 90 days.
gcl_gb	Google	This cookie is placed by Google Adsense and used to store and track conversions for marketing / tracking purposes. Lifespan: 90 days.
gac_gb <wpid>	Google	This cookie is placed by Google Adsense and used to store and track conversions for marketing / tracking purposes. Lifespan: 90 days.
gcl_aw	Google	This cookie is placed by Google Adsense and used to store and track conversions for marketing / tracking purposes. Lifespan: 90 days.
gcl_gs	Google	This cookie is placed by Google Adsense and used to store and track conversions for marketing / tracking purposes. Lifespan: 90 days.
gcl_ag	Google	This cookie is placed by Google Adsense and used to store and track conversions for marketing / tracking purposes. Lifespan: 90 days.
FPLC	Google	The FPLC cookie is a cross-domain link cookie that is hashed from the FPID cookie. Lifespan: 20 hours.
ga	Google	Google Analytics Cookies: These cookies are used to collect information about how visitors use our website. Lifespan: 2 years.
gid	Google	Google Analytics Cookies: These cookies are used to collect information about how visitors use our website. Lifespan: 24 hours
gat <customname>	Google	Google Analytics Cookies: These cookies are used to collect information about how visitors use our website. Lifespan: 1 minute
utma	Google	Google Analytics sets this cookie to measure the number of visits a user makes to our site, to help us analyse the performance of the website. Lifespan: 2 years.
utmb	Google	Google Analytics sets this cookie (in conjunction with _utmc) to measure a user spends on our website. Lifespan: 30 minutes.
utmc	Google	Google Analytics sets this cookie (in conjunction with _utmb) to measure a user spends on our website. Lifespan: current session.
utmt	Google	Google Analytics set this cookie to throttle the amount of requests it makes, to help improve the user experience of our website. Lifespan: 10 minutes.
utmz	Google	Google Analytics set this cookie to track how you arrived at our site and if that was linked to a marketing campaign that we manage. Lifespan: 6 months.
utmv	Google	Google analytics may set this cookie to track "visitor level" analytics, if this is something we choose to use in the future. Lifespan: 2 years
FPID	Google	Google Analytics set this cookie, which stores a unique identifier that is used to compile statistics on how visitors use the website. Lifespan: 2 years
ga <wpid>	Google	Google Analytics set this cookie to help analyse an individual users session. Lifespan: 2 years
dc_gtm <property-id>	Google	Google Analytics set this cookie, which is associated with sites using Google Tag Manager to load other scripts and code into a page. It is necessary for the functionality of other related scripts. Lifespan: 2 years.
gaexp	Google	Google Analytics use this cookie to determine a user's inclusion in Google Optimize experiment. Lifespan: max 93 days.
gaexp_rc	Google	Google Analytics use this cookie as part of a user's inclusion in Google Optimize experiment. Lifespan: 10 seconds.
opt_awcid	Google	Google Analytics may set this cookie as part of a optimisation experiment. Lifespan: 24 hours.
opt_awmid	Google	Google Analytics may set this cookie as part of a optimisation experiment. Lifespan: 24 hours.
opt_awgid	Google	Google Analytics may set this cookie as part of a optimisation experiment. Lifespan: 24 hours.
opt_awkid	Google	Google Analytics may set this cookie as part of a optimisation experiment. Lifespan: 24 hours.
opt_utmc	Google	Google Analytics may set this cookie as part of a optimisation experiment. Lifespan: 24 hours.
gcl_gf	Google	Google analytics may set this cookie as an integration with Google Flights. Lifespan: 90 days.
gcl_ha	Google	Google analytics may set this cookie as an integration with Google Hotel Ads. Lifespan: 90 days.
PAIDCONTENT	Google	Google analytics may set this cookie as an integration with Google Surveys. Lifespan: 30 days.
opt_expid	Google	Google Analytics may set this cookie as part of a optimisation experiment. Lifespan: 10 seconds.

Use of your information

We will only use your Personal Data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• to tell you about new products or services supplied by Ecotricity or third parties that we think may be of interest to you.

If you would rather not receive marketing e-mails from us please let us know by emailing us at DataProtection@GreenBritainGroup.com.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason, and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with this policy, where this is required or permitted by law.

Disclosure of your information

• Your Personal Data will be held on our systems and may be accessed by or transferred to any entity in our corporate group, including any entity that acquires us or that we may acquire. This may include staff working outside the UK and third parties, some of whom are located outside the European Economic Area. Such third parties process information, fulfil orders and provide support services on our behalf a list of third parties relevant to your account can be made available on request.

• We may transfer your personal data as a part of a corporate reorganisation, business sale, or other merger activity. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

• We may also transfer or disclose your personal information to our service providers (O&M providers etc), professional advisers (accountants, lawyers etc) and to such other parties as we consider reasonably necessary for the administration of the Services, the Website any related, ancillary matters (including competitions and prize draws) and related business.

• We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes, and only permit them to process your personal data for specified purposes and in accordance with our instructions.

• Countries outside the UK and European Economic Area do not always have strong data protection laws which afford adequate protection to individuals’ personal data, and so we limit when we transfer data to them. When data is transferred internationally, we will always take steps to ensure it is afforded an adequate degree of protection by ensuring that at least one of the following safeguards is implemented.

  • We will only transfer your Personal Data to countries that have been deemed to provide an adequate level or protection for personal data by the European Commission or other national body.

  • We may use specific standard contractual terms for use in the UK which give the transferred personal data the same protection as it has in the UK namely an International Data Transfer Agreement. To obtain a copy of these contractual safeguards, please contact us at dataprotectionofficer@ecotricity.co.uk

Sometimes we are required or compelled to disclose your information. We will respond to requests (in each case, limiting disclosure to the extent required) where:

• Our compliance is required by law;

• We receive a request from a public authority or law enforcement agency;

• There is a threat to the safety of you or any other person; or

• We suspect you of committing a criminal offence, including fraud.

We will only otherwise disclose any of the information you provide to us when permitted to do so by applicable law or with your consent.

Legal basis for processing personal information

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

• Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.

• Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

• Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

• Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

• Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

• We will normally collect personal information from you only where we need the personal information to perform a contract with you, where we have your consent to do so, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms.

• If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information)

• Similarly, if we collect and use your personal information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

• We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified our legitimate interests are where appropriate.

Legal basis for processing	Purposes of processing
Contract	Providing you with the Services
	Administering Payments
	Providing and running Customer helplines
	Complaints handling
	Setting up and otherwise administering your account(s) for Services and products which we provide to you, this may include linking different Services which you receive from us
	Contacting you in connection with the Services and your account (including through the use of electronic communication, e-mail, SMS or telephone)
Legitimate interests	Verifying your identity when you make enquiries by phone, email or letter
	Marketing of our products and services to existing customers and customers who have left us in the preceding 24 months- You have the right to object.
	Contacting you in relation to a quotation in respect of the Services we provide
	Commencing legal or recovery proceedings against you to recover unpaid charges, where this is necessary
	Assisting with statistical analysis to assess and improve our Services and systems
Legal obligation	Complying with energy supply and distribution laws
	Responding to requests by law enforcement authorities for access to your personal information
	Protecting our businesses and other customers from criminal or fraudulent activities
	Enforcing a judgment of a court of law
	The detection and prevention of theft, fraud, and money laundering offences
Consent	Where we have no other basis to rely on, we shall ask you for your consent. This may include but is not limited to letters of authority.
	Marketing the services of our other Group Companies, you have the right to withdraw.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact our Data Protection Officer at DataProtection@GreenBritainGroup.com

Security

• We employ security measures to protect your information from access by unauthorised persons and against unlawful processing, accidental loss, destruction and damage. Protection of the registration details and any debit or credit card information you give to us is a major priority. We have implemented a security policy that guards against unauthorised access. Data on our secure pages is encrypted using SSL technology.

• Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Website, you are responsible for keeping this password confidential, and for letting us know if you think that your password has been compromised.

• All your private data will be encrypted at all times whilst in transit over the Internet. SSL is special software that automatically encrypts any data sent by you on our secure pages. Our server then reads the data using a private key. This means that your data, be it debit or credit card information or any other personal details, is turned into code that can only be decoded with the private key or password. All pages on the site that require you to enter personal or sensitive information are secure. Your browser will indicate that the page is secure by displaying a padlock or key in the status bar at the bottom of the window. If your browser is suitably configured, you will receive a warning message when you first access any secure page on the site. This is simply information to advise you that the site is protecting your data.

• Although Smart Grid will do its best to protect your personal data, it cannot guarantee the security of any personal data that you disclose online. You must accept the inherent security implications of using the Internet and we will not be responsible for any breach of security unless we have been in breach of applicable laws and then only to the limits set out in the terms and conditions for the Website.

• Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers, affiliates and members of our corporate group. If you follow a link to any of these websites, please note that these websites have their own privacy policies/web site terms of use and we do not accept any responsibility or liability for these policies. Please check such policies before you submit any personal data to them.

Data Retention

• If you are a Customer, we will retain your information for as long as you continue to use the Services and for a period of 7 years (or as long as the law requires) after your account has closed. We may decide it is necessary to retain your information for longer for the purpose of resolving disputes or payment issues, or because it is still useful (in an anonymised form) to us to analyse your use of the Services. We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

• To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

• By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for seven years after they cease being customers for tax purposes.

• In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

• If you have requested information about the Services we provide, for example a quotation, we will retain your information for a period of up to 24 months from the provision of the information requested, after which your personal data will be deleted, providing that there is no ongoing legitimate reason for us to retain it.

• When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until permanent deletion is possible.

Access to information

You have the right to:

• Request access, request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Update your personal information. You can do so at any time by contacting us using the contact details provided under the “Contact” heading below.

• Object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal data (see the table above for details of when we rely on your consent as the legal basis for using your data). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

  • If you want us to establish the data's accuracy;

  • Where our use of the data is unlawful but you do not want us to erase it;

  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided under the “Contact” heading below.

• If we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on other lawful grounds.

Complaints

• You have the right to complain about our collection and use of your personal information. In the first instance you should contact our Data Protection Officer by emailing DataProtection@GreenBritainGroup.com.

• In the event that you are unhappy with the Data Protection Officer’s response you may raise your concerns with the Information Commissioner’s Office at https://ico.org.uk/concerns/

• We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We may also contact you to ask you for further information in relation to your request to speed up our response.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

Changes to our privacy policy

Any changes to our privacy policy in the future will be posted to the Website. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.

You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.

Contact Details

All comments, queries and requests relating to our use of your information are welcomed, using the following details:

General Email address: hello@ecotricitysmartgrid.co.uk

Data Protection Email address: DataProtection@GreenBritainGroup.com

Telephone Number: 01453 790236

Or, you can write to:

The Data Protection Officer, Ecotricity Group Limited, Lion House, Rowcroft, Stroud, GL5 3BY