Protecting your privacy online
At Good Energy, we respect your privacy and commit to protecting your personal data. This policy explains what we do with your personal data, why we want to use it, how we protect it, and what rights you have to control our use of it.
It applies to the use of our website and personal data that we process via other interactions in the course of running our organisation, with individuals such as customers, employees partners and suppliers.
Information about the data controller
Good Energy is a group of companies. The main operating companies are:
- Good Energy PLC
- Good Energy Limited
- Good Energy Gas Limited
- Good Energy Generation Limited
We collect, use and are responsible for certain personal data about you and those activities are regulated under the General Data Protection Regulation (“GDPR”), which applies across the European Union (including the United Kingdom). We are responsible as “data controller” of that personal information under GDPR.
This privacy notice is issued on behalf of all group companies, so when we mention "Good Energy", "we", "us" or "our", we are referring to the relevant group company responsible for processing your data.
Our contact address is Monkton Reach, Monkton Hill, Chippenham, Wiltshire SN15 1EE, UK.
Our mission is to transform the UK energy market by helping homes and businesses to be part of a sustainable solution to climate change.
If you ever find you have a question about how we use your data or how we protect your privacy, you can contact us at firstname.lastname@example.org
The purpose and lawful basis for processing your personal data, how we collect it and how long we hold it for
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We use personal data from different categories of individuals for several different purposes and these each have a different lawful basis. This section describes these in detail and, although it’s technical, we’re required by law to explain this to you.
If you visit any of our websites:
We use Google Analytics on our website to track visitor numbers and user activity on our site. We record your computer’s IP address so we can tell how each user and repeat visitor is using our site (your IP address is also a piece of your personal data). We do this on the basis that it is necessary for our legitimate interests in tracking website users so that we can improve our service and keep our websites relevant and useful. The IP address information will be held in accordance with Google’s standard procedures.
If you fill in a “contact us” form we will hold your name, contact details and any other text you enter for the purpose of corresponding with you. We do this on the basis that it is necessary for our legitimate interests in running our business.
If you are a customer of Good Energy’s services or products:
we will hold certain details about you in order to provide you with the agreed services and products. This personal information will be captured during the onboarding process either given directly by you or provided to us by a third party on your behalf. Over the time that you are on supply with us as a customer or using other services and products, additional data may be captured and processed. Where additional information is obtained, you will be provided with the relevant Privacy Notice at the time. In some instances we may request sensitive data to support you appropriately to your needs as a customer. Where we obtain sensitive data you will be asked to provide your consent for us to do so.
From time to time we may want to send you communications about other services and products that Good Energy offer. We do this under the basis of consent, you have the right to withdraw or provide your consent for this type of processing activity at any time. There are certain types of communications that we have to send you, such as energy bills, information about your account or our newsletter to keep you informed as to how Good Energy are performing. These types of communications are provided to you under a contractual basis, and for some, a legal obligation.
If you would like more information on the type of data that we hold on you, and under what legal basis, please contact us. (see “ How to contact us” below). We will hold your details for as long as we need to interact with you for these purposes.
If you are a shareholder / bondholder or investor of Good Energy:
we will hold certain details about you in order to provide you with the agreed share or bond holdings. Your personal information will be captured during the registration process either provided directly by you or through a registered broker. Over the time that you hold an investment or share in Good Energy your data may change or we may capture additional information about you. Where additional information is obtained, you will be provided with the relevant Privacy Notice at the time. In some instances the data required to manage your investment may be sensitive data, where we obtain sensitive data you will be asked to provide your consent for us to do so.
If you are an employee, worker or contractor of a customer or partner of Good Energy or if you are an industry contact or working in a field relevant to our mission:
we may hold your name, company, job title and contact details. We may have been provided with this data by you or your employer or in some cases we may have sourced it from publicly available sources, such as Linked In and internet searches. We need this data in order to interact with you (or your employer) for the following purposes:
- Running and developing our business;
- Communicating with interested people regarding industry events, news and updates.
We do this on the basis that it is necessary for our legitimate interests in running and growing our business. We will hold your details for as long as we need to interact with you for these purposes. In all cases if you would like us to update or delete your information, just send us an email (see “ How to contact us us” below).
If you are a supplier or an employee, worker or contractor of a supplier:
we may hold your name and contact details because we have a legitimate interest in doing business with your company. Our purpose for processing your personal data is to interact with you or your employer to procure and pay for goods and services. We will aim to hold this information for as long as we need to interact with you.
Whether information has to be provided by you and if so why
In some cases where we are required to collect personal data by law or under a contract with you or your employer, if you fail to provide the personal data requested we will not be able to perform the contract we have or are trying to enter into with you in order to supply our services and products or be your employer.
Who we share your personal data with
If you visit our website or our mobile app:
We use Google Analytics on our website and analytics on our app to track visitor numbers and user activity. We record your computer’s or mobile’s IP address so we can tell how each user and repeat visitor is using our site (your IP address is also a piece of your personal data). We do this on the basis that it is necessary for our legitimate interest in tracking website users so that we can improve our services and keep our websites and app relevant and useful. By ticking your understanding of our policies on the app, you are supplying us with your consent. The IP address information will be held in accordance with Google’s standard procedures.
If you are a customer of Good Energy
Your personal information will be shared with our third party agents in order to provide you with a supply of Gas and/or Electricity. The third party agents that we use to deliver energy to you can be obtained by contacting us (see “ How to contact us ” below). In addition to supplying energy services to you we may also pass your personal information to debt recovery agents where apprioriate. For more information on our use of debt recovery agents, please refer to your standard terms & conditions of supply. Where you choose for us to provide your data to a third party for Marketing purposes, this will be clearly explained to you as part of the Privacy Notice at the time of providing your consent.
If you are shareholder / bondholder or investor of Good Energy
The personal information that is required to perform the contract in your investment is managed by our registrar, Computershare. Their address is The Pavilions, Bridgwater Rd, Bristol BS99 6ZZ. The type of data they hold and the purpose in which they process it will be explained to you as part of the relevant Privacy Notice which will be available at the time of your data being captured or upon request by contacting us. (see “ How to contact us ” below)
We may hold your name and contact details in email and contacts applications provided and hosted by Microsoft (as our ‘data processor’). We may also hold data in spreadsheets or documents stored in Dropbox (as our ‘data processor’) and/or SMARTdoc (as our ‘data processor’). We may also hold your contact details on our accounting system, EPICOR (as our ‘data processor’).
Other circumstances in which we may need to share personal data with third parties
We may also share your personal data with third parties in the following circumstances:
- We will share personal information with law enforcement or other authorities (such as tax authorities) if required by applicable law.
- We may share personal information with third parties to whom we may choose to sell, transfer, or merge parts of our organisation or our assets. Alternatively, we may seek to acquire other organisations or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
- We may share personal information with professional advisors such as lawyers, accountants or auditors in order to provide legal, accounting or auditing services.
We will not sell or rent your information to third parties and we will never share your information with third parties for marketing purposes without your explicit consent to do so.
International transfers of personal data, and the measures in place to safeguard it
We do not directly transfer any of your personal data outside the European Economic Area (EEA). However, some of data processors may do so and this section explains the impact of these international transfers and how personal information is protected.
Several data processors (e.g. Microsoft, Dropbox, Google) operate “cloud-based systems”, which means the information is held in information data centres in different locations.
All the cloud-based systems we use reserve the right to hold copies of your personal information outside the EEA. Please note that the reason companies may choose to do this is to hold back-up copies, so they can guarantee recovery.
Microsoft, Dropbox and Google may transfer personal information to cloud data centres in the USA. The personal privacy laws and safeguards in the USA are not equivalent to those in the EEA, so the European Commission has approved a system called “EU-US Privacy Shield” to make sure the personal information of European citizens is properly protected if held by participating companies in the USA. For further details, see European Commission: EU-US Privacy Shield.
Currently Good Energy PLC choose not to directly use any data centres outside of the EEA for the purposes of processing Personally Identifiable Information.
Your personal data rights
The personal data we hold about you is your data, so you have certain rights over the data under the GDPR. This section summarises your rights and how you can exercise them (generally free of charge).
You have the right to request a copy of all personal data we hold relating to you. You also have the right to require us to correct any mistakes in the personal data we hold relating to you.
Where we are processing your data based on your consent (underlined in the section on “purpose and lawful basis”, above) you can withdraw that consent and we must immediately stop processing your data. Please note that up to that point, we’re acting lawfully with your consent, withdrawal of consent cannot be backdated.
Where we process your data based on a “legitimate interest” (underlined in the section on “purpose and lawful basis”, above) you still have the right to object to our processing of that data if you feel it impacts on your fundamental rights and freedoms. From that point, we must stop processing your data until we have determined whether your rights override our interests.
You also have the right to object where we are processing your personal data for direct marketing purposes.
In certain situations, you have the right to require us to erase personal data where there is no good reason for us continuing to process it. However, note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
You have the right to request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Finally, you have the right to request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format. Note that this right only applies to automated processing of information about you, which we carry out based on your consent or where it is necessary to perform a contract with you.
For further information on each of these rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.
If you would like to exercise any of these rights, the easiest way is by dropping us an email (see “ How to contact us ” below). Please note:
- We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
- We try to respond to all legitimate requests quickly, but in any event within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Your rights to lodge a complaint with the Regulator
At all times, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at https://ico.org.uk/concerns/ or by calling them on 0303 123 1113. Of course, we hope that we can resolve your issue quickly and fairly.
Automated processing of your personal data
Note that you have a right to object to any decisions being taken through the processing of your personal data by automated means if they produce legal effects concerning you or similarly significant effects on you. We do not use your personal data in a way that makes such decisions.
Keeping your personal information secure
We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Other purposes for processing personal data
We don’t process your personal data for any other purpose than we’ve described here. We won’t sell your personal data to other companies.
As we develop our activities and services, we might add new data processes that use your personal information. Should we decide that we want to develop a new processing purpose, we will contact you to let you know what we intend to do, the lawful basis we will use, and your rights over our intended new processing. We’ll also publish information about it here.
We may change this privacy notice from time to time by amending this page.
How to contact us
If you have any questions, concerns or just want some more information about our privacy management, drop us a line at email@example.com or by writing to us at, Good Energy PLC, Monkton Reach, Monkton Hill, Chippenham, Wiltshire SN15 1EE, UK