Your privacy

What is this and why should I read this?

SmartestEnergy Limited and SmartestEnergy Business Limited (‘SEL’, ‘SEBL’, ‘we’ ‘us’) are committed to protecting the privacy and security of your Personal Data, and we want to ensure you understand your rights and our responsibilities when it comes to your Personal Data.

This data privacy notice (‘Notice’) describes how we handle your Personal Data throughout our relationship, whether you are a client or prospect, a potential business partner, or just a member of the public. As such, both your engagement with us online, as well as contractually through any business dealings, are covered by this overarching data privacy notice. This is also held on our website for all to access.

We have tried to keep this notice straight forward with related sub-headings to help you navigate to the relevant sections. Please read below for more information and contact us if you have any questions.

You can also download a pdf version of the notice here.

What if I have questions or concerns?

Our Data Privacy Manager is responsible for overseeing and coordinating our privacy program. If you ever have any questions or concerns about how we handle your Personal Data, please contact:

Head of Data Protection & Privacy
SmartestEnergy Limited
Brooke Lawrance House
80 Civic Drive
Ipswich
Suffolk
IP1 2AN
Tel: +44 (0)1473234136
Email: [email protected]

Our commitment to your privacy (Personal Data Processing Principles)

Regardless of where, why or how we obtain or process your personal data, we comply with Data Protection Law (DP Law). DP Law protects ‘Data Subjects’ in the UK and EU by imposing stricter obligations on ‘Data Controllers’ and ‘Data Processors’ when we process personal data. See below for a glossary of these terms.

DP Law applies to any data that might identify you, wherever or however we got it, whatever we do with it and wherever we process it, even if someone else processes it on our behalf, and even if we send it outside the European Economic Area (EEA).

This means that whenever we process your personal data we do so

• Lawfully: Only if we can justify it on one of the following Lawful Bases:

• Fairly and transparently: we strike the right balance between our interests and yours and we tell you what we do with your personal data.
• For a specific purpose: we won’t use your personal data for another incompatible purpose unless the law permits or requires us to.
• Using the least amount reasonably necessary.
• Ensuring it is accurate, complete and up-to-date.
• For a limited time: Only for as long as reasonably necessary, and then we either destroy it or de-identify it so it can’t be linked back to you.
• Securely: managing our people and designing our processes and technology to ensure end-to-end confidentiality, integrity and availability.
• Within the UK/EEA: we don’t transfer your personal data outside the EEA except as permitted under DP Law. We use appropriate safeguards for consistent protection and ensure third parties we rely on do so as well.
• With your rights in mind: We make it easy for you to exercise your rights (see Your Rights, below).

The types of personal data we process about you are grouped under the following categories:

Your Data At-a-Glance

Our table below summarises what information we collect, why and how we use it and who we share it with. If we need to use your personal data for an unrelated purpose, we will notify you, explaining the Lawful Basis.

How do you strike the right balance when you rely on Legitimate Interests?

We conduct Legitimate Interests Assessments (LIA’s) whenever we rely on Legitimate Interests and, where appropriate, Data Protection Impact Assessments (DPIAs). You can obtain more detailed information by contacting our Privacy Manager.

For example, we do some limited profiling to target products and services to you that we’re quite confident your company will like and avoid bombarding you with those you won’t. To do this, we need to learn more about you and your preferences, your role in the company, in addition to company data such as your company’s energy needs. We ensure we have appropriate safeguards to prevent this information from being misused and ensure we strike the right balance:

• Only what we need - We use aggregated or pseudonymised data as much as possible to create profiles and segments and match them to our products and services. Then, we use Pardot to assign an engagement score based on your viewing behaviour (e.g. whether you watch an entire webinar or leave early, how often you register for content or download our materials), your use of our website if you have opted into marketing and targeting cookies, or other information you provide directly or indirectly to us, e.g. through a query, online form or conversation. Based on that engagement score and our analysis of your preferences and your sector, we identify products and services that are likely to be of greatest interest to you in light of your role within your company or the industry and determine when (or if) to contact you for business development purposes.
• When we need it and only by those who need it - 
  • Our Customer Service, Billing teams and Finance team only see what they need to answer your billing and customer service queries.
  • We never let third parties use your information for their own purposes, and we prevent this by giving them only what they need and as little Personal Data as possible, by pseudonymising and encrypting it wherever possible to protect your identity.
• We’ve built in privacy and security - We conduct Data Protection Impact Assessments (DPIAs) where appropriate and use what we learn to implement Data Protection by Design and Default into our business.
• Even so, it’s optional - You can object to this activity by opting out at any time. Simply disable targeting / marketing cookies on our Cookie Dashboard (see our Cookie Notice here for more information). Tell us you no longer want to receive marketing calls or emails and we’ll remove you from our list immediately.

However, in certain cases (outside marketing) our Legitimate Interests may override yours. For example, to conduct due diligence reviews for potential fraud or an unacceptable level of credit risk.

What happens if you can’t get this Personal Data?

If we can’t process this Personal Data, or if it’s inaccurate, we may not be able to perform the contract we have entered into with you (e.g. proceed with your application), or we may be prevented from complying with our legal obligations (e.g. doing our due diligence under Anti-Money Laundering rules). If we aren’t able to get profile, technical, usage and marketing and communications data (e.g. click and view data, customer feedback, page visits) it will be difficult for us to optimise our services or meet consumer demands and serve up content we think you’ll like. This means you might either receive communications that aren’t suited to you, or you may miss out ones tailored to you, like alerts for educational content or the latest industry developments.

What about sensitive Personal Data (Special Data) and Criminal Records Data?

Special Data requires higher levels of protection. Our internal Data Protection Policy combined with appropriate safeguards and controls ensure we only collect, use or share Special Data where reasonably necessary and where the law allows or requires us to do so.

We do not process Criminal Records Data, though we do run DBS checks for certain contractors.

We rarely process Special Data, unless:

• You have given your explicit written consent;
• We need to carry out our Legal Obligations or prepare for or defend legal claims; or
• Where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent (Vital Interests), or
• Where you have already made the information manifestly public.

What about third-party links, plug-ins, content or cookies on your website:

If you click on a link to third-party content, or like or share specific content, this will either take you to those third-party sites or applications or send your Personal Data to that third party related to your click. We have no control over their use of your Personal Data in this regard. However, we do get aggregated data about clicks and shares which are not attributable to individual visitors. We encourage you to read the Data Privacy Notice of websites you visit. See our Cookie Declaration for a list of Third-Party cookies and trackers at https://www.smartestenergy.com/cookie-declaration/ and links to their Privacy Notices.

Who else can see my Personal Data?

Need-to-know is the default…

Wherever we Process your Personal Data jointly with another Controller (Joint Controller), we establish clear lines of accountability to ensure your rights are respected and our obligations are met, and we adhere to the principles and approach we mention in this document to minimise how much Personal Data we use.

In all cases, we require third parties to respect the security of your Personal Data and to treat it in accordance with DP Law through binding contracts.

Do you share my Personal Data with other third parties?

If we sell or restructure all or part of the business, we will share some of your Personal Data with other third parties in the context of the transaction. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your Personal Data with the other parties if and to the extent required under the terms of the transaction and on the basis of Legitimate Interests. This ensures seamless service for you, regardless of who owns the business, and data due diligence by us. We will notify you in such circumstances and you may object to this transfer.

We may also need to share your Personal Data with a regulator or to otherwise comply with the law. This may include making returns to HMRC, disclosures to financial services regulators and disclosures to shareholders such as directors’ remuneration reporting requirements.

Do you transfer my Personal Data outside the EEA?

We primarily Process your Personal Data – including back-ups and archives - in the EEA and in countries the UK has recognised as providing adequate levels of protection (Adequate countries), specifically Japan. Where we work with third parties that necessitate data transfer, we use appropriate safeguards for consistent protection and ensure the third parties that we rely on do so as well. 

Is my Personal Data secure?

We’ve implemented measures to prevent your Personal Data from accidental loss, unauthorised use, access, alteration or disclosure. We’ve implemented procedures and safeguards to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where legally required to do so. Details of these measures are available upon request.

How long will you use my Personal Data?

We will only retain your Personal Data for as long as necessary to fulfil the purposes we mentioned in our At-a-Glance table, including to satisfy any legal, accounting, or reporting requirements. This will vary according to the Personal Data involved and the purpose.

We consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we use it, whether we can achieve those purposes through other means, and the applicable legal requirements. To illustrate:

• We generally hold onto Financial Data for 7 years to satisfy tax and corporate reporting requirements.
• We hold onto identifiable Marketing Data for 1-year post-campaign.
• We retain our suppression lists (do-not-call / unsubscribe) because we have an ongoing legal obligation under Direct Marketing rules.

In some circumstances we may aggregate or anonymise your Personal Data so that it can no longer be associated with you, in which case we may use it without further notice to you. We do this for purchasing statistics, historical operations data, or to analyse sales and marketing trends. For more information on our Data Retention Policy please contact the Privacy Manager.

What rights do I have over my Personal Data?

You have various rights with respect to your Personal Data:

We will need to confirm your identity to confirm your right to access the information or exercise any of your other rights. This is to prevent Personal Data being disclosed to anyone who has no right to receive it.

You can find out more about your rights by visiting the Information Commissioner’s Office website.

How can I make a complaint?

If you are unhappy with the way we handle your personal data, we encourage you to contact our Data Protection Team first, so we can try to promptly address your concerns:

Head of Data Protection & Privacy
SmartestEnergy Limited
Brooke Lawrance House
80 Civic Drive
Ipswich
Suffolk
IP1 2AN
Tel: +44 (0)1473234136
Email: [email protected]

You may complain to the Information Commissioner’s Office. You can find details here.

Glossary

Right	What this means
Data Subject	A living individual. We’ll just say ‘you’, ‘your’ or ‘individuals’ in this Notice.
Data Controller	The person or entity that decides what, how and why to Process Personal Data. We’ll use ‘we’ ‘our’ and ‘us,’ since we’re the Data Controller.
Data Processor	The person or entity that Processes Personal Data on behalf of a Data Controller according to their instructions.
Data Protection Law (DP Law)	The General Data Protection Regulation (GDPR), the UK Data Protection Act 2018 (DPA 2018), the Privacy and Electronic Communications Regulation 2003 (UK PECR), and other data protection legislation, as amended from time to time.
Joint Controller	A person or entity that decides what, how and why to Process Personal Data jointly with another Data Controller.
Process or Processing	Anything we do to Personal Data throughout its lifecycle: generating, scraping, collecting, sharing, storing, accessing, deleting, recording, organising – whether manually or using automation.
Personal Data	Any information relating to an identifiable individual, even if we don’t know their name. That means that any data that, alone or with other information, can be used to figure out who an individual is or to target or impact an individual – like location, IP address, ID number, image or voice, or identifiable cookies – is likely to be Personal Data. Even Personal Data that’s been ‘pseudonymised’ (i.e. identifiers have been stripped away but the pseudonym could be reverse-engineered or linked back to the individual) is Personal Data.
Special Data	Special categories of more sensitive Personal Data that requires a higher level of protection, such as information about a person’s health or sexual orientation. Special Data is subject to more stringent safeguards, and we’re only allowed to Process it in certain cases.