Privacy Notice

Table of Contents

Topic
Key Summary
About Us and This Notice
Useful Words and Phrases
What Information do we Collect?
Why do we Process Your Personal Data
How is Processing Your Data Lawful?
When Will we Delete Your Data
Who will Have Access to Your Personal Data
Your Rights

Key Summary

This Privacy Notice is provided by the Retail Energy Code Company Limited.

We are responsible for the governance of the Retail Energy Code (the Code), which is the code which governs the switching arrangements for gas and electricity suppliers in Great Britain.

The key personal data for which we are the controller relates to:  

  • individuals who are representatives of parties and other market participants under the Code, whose data we process in relation to arranging meetings, recording meeting minutes, submitting invoices, Code changes, other Code management matters, and notifying Code related developments;
  • individuals who serve on the REC Board, the REC Panel or sub-committees of the REC Board or the REC Panel, whose data we process in relation to arranging meetings, recording meeting minutes and notifying Code related developments;
  • individuals who are or who represent our service providers, whose data we process in relation to contract management;
  • individuals who are or who represent potential service providers, whose data we process in relation to potential future contracts;
  • individuals who use our website; and
  • individuals who send general enquiries to us.

This notice explains what data we process, why, how it is legal and the rights of data subjects.

ABOUT US and THIS NOTICE

This Privacy Notice is provided by the Retail Energy Code Company Limited (“RECCo” or “we” or “us“). We are a controller for the purposes of the Data Protection Laws. We take your privacy very seriously and ask that you read this Privacy Notice carefully as it contains important information about our processing and your rights. 

How to contact us

If you would like this Privacy Notice in another format (for example audio, large print, braille) please contact us at the details below:

 Contact:

Company Secretary

Address:

130 Old Street, London, England EC1V 9BD

Email:

info@retailenergycode.co.uk

 

Changes to this Privacy Notice

The latest version of the Privacy Notice can be found at www.retailenergycode.co.uk/privacy-policy. We may change this Privacy Notice from time to time. We will alert you on our website when changes are made.

Current version: 27 September 2019

Useful Words and Phrases

Please familiarise yourself with the following words and phrases (used in bold) as they have particular meanings in the Data Protection Laws and are used throughout this Privacy Notice:

Term

Definition

Code

This means the Retail Energy Code, which can be found on our website atwww.retailenergycode.co.uk.

controller

This refers to the company or other entity which determines the purposes for which, and the manner in which, any personal data is processed.

criminal offence data

This means any information relating to criminal convictions and offences committed or allegedly committed.

Data Protection Laws

This means the laws which govern the handling of personal data. This includes the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act 2018 and any other national legislation that relates to data protection and privacy.

ICO

This means the UK Information Commissioner’s Office, which is the UK regulator responsible for implementing, overseeing and enforcing the Data Protection Laws.

personal data

This means any information from which a living individual can be identified. 

This will include information such as telephone numbers, names, addresses, e-mail addresses, photographs and voice recordings.  It will also include expressions of opinion and indications of intentions about individuals (and their own expressions of opinion/intentions).

It will also cover information which on its own does not identify a living individual but which would identify them if put together with other information which we have or are likely to have in the future.

processing

This covers virtually anything anyone can do with personal data, including:

  • obtaining, recording, retrieving, consulting or holding it;
  • organising, adapting or altering it;
  • disclosing, disseminating or otherwise making it available; and
  • aligning, blocking, erasing or destroying it.

processor

This refers to the company or other entity which processes the personal dataon behalf of the controller.

REC Board

This refers to the board of directors of RECCo.

REC Panel

This refers to the panel established under the Code.

special categories of data

This means any information relating to:

  • racial or ethnic origin;
  • political opinions;
  • religious beliefs or beliefs of a similar nature;
  • trade union membership;
  • physical or mental health or condition;
  • sexual life; or
  • genetic data or biometric data for the purpose of uniquely identifying you.

website

This means our website at www.retailenergycode.co.uk.

What Information Do We Collect

Personal data relating to you

Representatives of parties and other market participants under the Code

Parties and other market participants under the Code are required or permitted to propose contract managers and other representatives to act on their behalf in relation to the Code. If you are one of these representatives, we will process your personal data for the purposes described in the Code. This includes processing your personal data in relation to arranging meetings, recording meeting minutes, submitting invoices, progressing Code changes, and providing notices under the Code. We will also process your personal data for other Code management related matters, such as notifying Code related developments or any other purposes relating to the operation of the Code or the role of the party you represent as a RECCo shareholder. For this purpose, we process the following personal data: name, contact details, job title, place of work.

Those who serve on the REC Board, the REC Panel or sub-committees of either of them

We process your personal data if you are one of our board directors, or if you sit on the REC Panel or a sub-committee established by the REC Board or the REC Panel. We process your personal data for the purposes of arranging meetings, recording meeting minutes, notifying Code related developments, and for all other matters relating the operation of RECCo. For this purpose, we process the following personal data: name, contact details, job title, place of work, date of birth and personal address.

Service provider contract management

If you are one of our service providers, or if you represent one of our service providers, then we will process your personal data in relation to our management of the service provider contract.  For this purpose, we process the following personal data: name, contact details, job title, place of work. If you are a self-employed contractor we will also process your personal address if you do not have a separate business address.

Potential service provider list

 

If you are, or if you represent, a potential service provider that has indicated a willingness to be considered for future contracts which we may enter into, then we will keep your personal data so that we can alert you to future contracting opportunities and use your personal data in relation to the tender process for those contracting opportunities. For this purpose, we process the following personal data: name, contact details, job title, place of work. If you are a self-employed contractor we will also process your personal address if you do not have a separate business address, and we will keep records of how and when you contacted us and a description of your areas of expertise that are potentially relevant to our business.

Website usage information

If you are just visiting our website we will not collect personal data.

However, we do use cookies. Cookies are small files saved to your computer’s hard drive that track, save and store information about your interactions and usage of our website. Cookies allow us to store your preferences to correctly present content, options or functions throughout our Website. They also enable us to see information like how many people use our Website and what pages they tend to visit.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. If you would like more information about this practice, including how to prevent it, please visit ​www.aboutcookies.org, www.allaboutcookies.org or optout.networkadvertising.org.

Below is a list of all cookies utilised within our website:

First Party – Retail Energy Code Cookies
Host – retailenergycode.co.uk
Type – HTTP Cookie
Expiry – 1 Year
Description – Stores the user’s cookie consent state for the current domain.

General enquiries

We always welcome general enquiries concerning the Code, or from prospective parties considering acceding to the Code. During this interaction we process the following: name, contact details including email address, place of work, job title and details of the enquiry. We do not actively request special categories of data, but we may come across them if you provide them to us.

Personal data about other individuals

If you provide us with information about other individuals you confirm that you have informed the relevant individuals accordingly.

Why Do We Process Your Personal Data

We use your personal data for the following purposes listed in this section. We are allowed to do so on certain legal bases – please see section ‘How is processing your data lawful’ on page 9 for further detail.

Personal Data Relating to

Purpose

Legal Basis

Representatives of parties and other market participants under the Code

For the purposes described in the Code, for notifying Code related developments and for any other purposes relating to the operation of the Code or the role of the party you represent as a RECCo shareholder, as further described on page 6.

Legitimate Interests

Those who serve on the REC Board, the REC Panel or sub-committees of either of them

To arrange meetings, record meeting minutes and notify Code related developments, as further described on page 6.

Legitimate Interests

Service provider contract management

To manage contracts with our service providers.

Legitimate Interests

 

Potential service provider list

To alert you of and to manage future contracting opportunities.

Legitimate Interests

Website usage information

To provide website functionality.

Legitimate Interests

 

General enquiries

To assist and respond to enquiries.

Legitimate Interests

 

How Is Processing Your Personal Data Lawful?

Personal data

We are allowed to process your personal data for the following reasons and on the following legal bases:

  • Legitimate interests

We are permitted to process your personal data if it is based on our ‘legitimate interests’ i.e. we have good, sensible, practical reasons for processing your personal data which is in the interest of RECCo. We have considered the impact on your interests and rights, and have placed appropriate safeguards to ensure that the intrusion on your privacy is reduced as much as possible. You can object to any of the processing that we carry out on the grounds of legitimate interests (see the section “Your Rights” below to find out how)

Who Will Have Access To Your Personal Data?

Like any business, we use external providers to operate our business, such as website hosting, enquiry functionality and chat functions. Some of these providers will process your personal data as part of the services they offer to us as our processors. We take steps to ensure that our service providers process your data in accordance with the Data Protection Laws, only use it in accordance with our contract with them and keep it secure. If you would like more information about our processors, please contact us using the details at the “How to contact us” section.

We will also share your personal data with the police, other law enforcements or regulators where we are required by law to do so.  

We do not transfer your personal data outside the European Economic Area.

How we keep your personal data secure

We strive to implement appropriate technical and organisational measures in order to protect your personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access and any other unlawful forms of processing. We aim to ensure that the level of security and the measures adopted to protect your personal data are appropriate for the risks presented by the nature and use of your personal data. We follow recognised industry practices for protecting our IT environment and physical facilities.

When Will We Delete Your Data

The following categories of personal data will be kept for the following periods.

Personal data relating to

Retention period

Representatives of parties and other market participants under the Code

During the course of the data subject’s position as a representative and 13 months after leaving the position.

Those who serve on the REC Board, the REC Panel or sub-committees of either of them

During the course of the data subject’s position and for 7 years after leaving the position.

Service provider contract management

During the course of the contract with the service provider and for 7 years after termination of the contract.

Potential service provider list

For period of 18 months from date of initial contact.

Website usage information

Not currently stored.

General enquiries

During the course of dealing with the enquiry and for 18 months afterwards.

Your Rights

As data subjects you have the following rights under the Data Protection Laws:

  • Right to object to processing of your personal data;
  • Right of access to personal data relating to you;
  • Right to correct any mistakes in your information;
  • Rights in relation to automated decision making (note this does not apply);
  • Right to prevent your personal data being processed;
  • Right to have your personal data ported to another controller; and
  • Right to erasure.

These rights are explained in more detail below. If you want to exercise any of your rights, please contact us (please see “How to contact us” above).

We will respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex, in which case we will respond within three months.

Please be aware that there are exceptions and exemptions that apply to some of the rights which we will apply in accordance with the Data Protection Laws.

  • Right to object to processing of your personal data

You may object to us processing your personal data where we rely on a legitimate interest as our legal grounds for processing.

This is not relevant to you because we do not rely on legitimate interests as a ground for processing your personal data.

  • Right to access personal data relating to you

You may ask to see what personal data we hold about you and be provided with:

  • a copy of the personal data;
  • details of the purpose for which the personal data is being or is to be processed;
  • details of the recipients or classes of recipients to whom the personal data is or may be disclosed, including if they are overseas and what protections are used for those overseas transfers;
  • the period for which the personal data is held (or the criteria we use to determine how long it is held);
  • any information available about the source of that data; and
  • whether we carry out an automated decision-making, or profiling, and where we do information about the logic involved and the envisaged outcome or consequences of that decision or profiling.

To help us find the information easily, please provide us as much information as possible about the type of information you would like to see.

  • Right to correct any mistakes in your information

You can require us to correct any mistakes in your information which we hold. If you would like to do this, please let us know what information is incorrect and what it should be replaced with.

  • Right to restrict processing of personal data

You may request that we stop processing your personal data temporarily if:

  • you do not think that your data is accurate. We will start processing again once we have checked whether or not it is accurate;
  • the processing is unlawful but you do not want us to erase your data;
  • we no longer need the personal data for our processing, but you need the data to establish, exercise or defend legal claims; or
  • you have objected to processing because you believe that your interests should override our legitimate interests. 
  • Right to data portability

You may ask for an electronic copy of your personal data which we hold electronically and which we process when we have entered into a contract with you. You can also ask us to provide this directly to another party.

  • Right to erasure 

You can ask us to erase your personal data where:

  • you do not believe that we need your data in order to process it for the purposes set out in this Privacy Notice;
  • if you had given us consent to process your data, you withdraw that consent and we cannot otherwise legally process your data;
  • you object to our processing and we do not have any legitimate interests that mean we can continue to process your data; or
  • your data has been processed unlawfully or have not been erased when it should have been.

What will happen if your rights are breached?

You may be entitled to compensation for damage caused by contravention of the Data Protection Laws.

Complaints to the regulator

It is important that you ensure you have read this Privacy Notice – and if you do not think that we have processed your data in accordance with this notice – you should let us know as soon as possible. You may also complain to the ICO. Information about how to do this is available on its website at www.ico.org.uk.

Scroll to Top