Privacy Notice

Our privacy notice (including any other documents referred to in it) sets out the basis on which we process any personal data that we collect from you or about you that you provide to us or that we receive from other sources. By processing, we mean when we collect, use, store, delete and otherwise manipulate or access personal data.

If we ask you to provide information from which you can be identified, including as a result of using our website, it will be used in accordance with this privacy notice, as it is varied from time to time.

Please read this notice carefully to understand our practices regarding your personal data and how we will treat it. We recommend that, from time to time, you visit our website to review this notice to stay up to date with any changes to it.

If you would like to read more about how UK Power Networks processes personal data, you can find a more detailed description in our purposes below.

UK Power Networks will not process your personal data to sell it to a third party.

UK Power Networks is required to process your personal data in accordance with the law.

The Data Protection Act 2018 (DPA) implements the General Data Protection Regulation 2016 (EU Regulation 2016/679).

This privacy notice complies with the DPA and the General Data Protection Regulation 2016 (the “GDPR”).

A data controller is a person or persons who determine the purposes for which and means by which personal data is processed. In other words, at UK Power Networks, we are a data controller and we require information about you in order to do business and keep your electricity supply connected.

Because UK Power Networks has two businesses - our regulated business and our services business – we have more than one data controller.

By our regulated business, we mean the distribution of electricity through the public electricity distribution system, which has been developing since the first introduction of public lighting in the mid-1880s. Our regulated business is carried out as a legal obligation under the Electricity Act 1989 (as amended). If you are a customer of our regulated business – usually, this will be the case when your home is directly connected to our electricity distribution network – your data controller is UK Power Networks (Operations) Limited.

UK Power Networks (Operations) Limited is registered as a data controller with the Information Commissioner’s Office:

• Company Name - UK Power Networks (Operations Limited)
  
  
• Company Registration Number (Companies House) - 03870728
  
  
• Companies Registration Number (ICO) - Z7057514

By services business, we mean our electrical contracting business. It manages privately owned electricity networks for large infrastructure projects, such as airports and rail. Unless you are a representative of one of these privately owned networks, the data controller of the services business would have no reason to hold any personal data on you.

Our nominated Data Protection Officer is Nick Zentner, who can be contacted at DPO@ukpowernetworks.co.uk

The Data Protection Officer (the “DPO”) is responsible for monitoring our compliance with the GDPR, for informing and advising our business of its obligations in relation to the processing of personal data. The DPO is the point of contact with the ICO, the UK’s data protection supervisory authority, and is the person to whom you should direct any enquiries.

To distribute electricity to you, UK Power Networks will process personal data about its customers, such as your full name, postal address, e-mail address, and landline and/or mobile phone numbers.

If relevant, we may also collect and hold data such as details about your property, the name and contact details for the registered person who pays the bill, the alternative contact details for a home on the Priority Services Register, financial and credit information, and other information that helps us to provide our customers with a better service that is capable of being tailored to specific energy requirements or particular needs.

Some personal information requires an additional level of protection. Under the GDPR this is known as "special category data" and includes information relating to:

• race;
• ethnic origin;
• political beliefs;
• religious beliefs;
• trade union membership;
• genetics;
• biometrics (where used for ID purposes);
• health;
• sex life; or
• sexual orientation.

To provide services in connection with our Priority Services Register, we sometimes need to process special category data such as health information for reasons of substantial public interest. We only process special category data in very limited circumstances and ensure that we treat this data with the level of care required by the GDPR and the DPA.

To fulfil our statutory obligation to provide and maintain our customers with a supply of electricity, it may be necessary for UK Power Networks to share your personal data with others, including:

• other entities in the UK Power Network group of companies
• your chosen electricity supplier
• our third party business partners, suppliers, and subcontractors, and any of the third parties listed above which also provide us personal data
• other providers of essential services, such as gas transporters or water companies, local authorities and the emergency services
• analytics providers that assist us with improvement of our website
• credit reference agencies and other companies and organisations for the purpose of fraud prevention and credit risk reduction
• government agencies and independent regulatory bodies
• and as might be required by law, including compliance with any court order or legal obligation.

UK Power Networks may be required to share personal data with emergency services organisations for purposes associated with the Civil Contingencies Act 2004.

To conduct market research to improve the service we provide, it may be necessary for UK Power Networks to share your personal data with third party market research providers but only to the extent they need it to carry out their specific task.

In the event that UK Power Networks (or substantially all of its assets) were to be acquired by or merged with a third party, the personal data held by us about our customers would be included amongst the assets transferred or shared. If we were to sell or buy any business or assets, we may disclose personal data held by us to the prospective seller or buyer under strict confidentiality terms.

When entering into any agreements that involve the sharing or disclosure of personal data, UK Power Networks requires that these third parties comply with our data protection and information security policies or have substantially similar policies of their own in place.

UK Power Networks has put in place appropriate technical and organisational measures to prevent accidental loss, damage or destruction of your personal data, and to protect your personal data against unauthorised, or unlawful use or theft. We put in place strict confidentiality agreements, including data protection obligations, with our third party service providers and data processors.

Your personal data may be transferred outside the European Economic Area (EEA), where processing activities such as technical support, storage and backup may be provided. When this data is sent outside the EEA, we shall ensure its secure transfer and that appropriate safeguards are in place for the processing of your personal data in accordance with this notice and the requirements set out in the GDPR.

The GDPR provides you with a number of rights in relation to your personal data. These include rights to the rectification or erasure of your personal data, and to restrict or object to its processing.

If you are unhappy with the way in which you believe UK Power Networks has dealt with your personal data, please contact our Data Protection Officer to give us the opportunity to put matters right for you. You also have the right to complain to the Information Commissioner's Office.

If in the future we make any changes to our privacy notice, the latest version of our privacy notice will be posted on our website.

Your questions, comments or requests relating to our processing of your personal data or this notice are welcome, and you may contact us via our contact us webpage. This webpage provides a number of contact details relating to our different services. For other data protection matters or to report a data breach, please contact Nick Zentner at DPO@ukpowernetworks.co.uk.


Version date: March 2024