Haven Power Limited
Customer Privacy Notice
This document (together with our Terms and Conditions ) sets out how Haven Power Limited (“Haven Power]”, “we”, “us” or “our”) uses personal information about our prospective, current and past customers.
Haven Power Limited is primary designed to provide energy and related services to the business community. The collection of personal data is limited to personal information of individuals representing the commercial enterprise/business entity that will enable us to manage our commercial relationship with you, as explained further in this Privacy Notice (“Notice”).
This Notice only applies to our use of ‘personal data’ about ‘data subjects’ (as defined by data protection law and called personal information in this Notice) which includes personal information relating to our prospective, current and past customers who are consumers, sole traders, non-limited partnerships and corporate contacts at limited companies (“you” or “your”). This Notice does not apply to information which you provide to us or which we collect about limited companies.
Any changes we may make to this Notice will be posted on our website and, where appropriate, notified to you in writing.
We will be the data controller of your personal information which you provide to us or which is collected by us from you or third parties, such as your broker, if you have one. This means that we are responsible for deciding how we hold and use personal information about you and that we are required to notify you of the information contained in this Notice. It is important that you read this Notice so that you are aware of how and why we are using such information and how we will treat it.
The information which you provide to us may include information about other individuals who are associated with the management of your business, the administration of your account with us or, if you are a limited company, corporate contacts within your business. If you provide us with information about such individuals, it is important that you provide them with a copy of this Notice prior to providing us with the information and that you provide them with any updated Notices we provide from time to time.
Our Data Protection Manager is responsible for overseeing questions in relation to this Notice and is contactable on firstname.lastname@example.org. You can also contact us using the details provided at the end of this Notice in the “Contacting Us” section.
This Notice is provided in a layered format so you can navigate through to the specific areas set out below. Alternatively, you can download a pdf version of the Notice here
LEGAL BASIS AND PURPOSE FOR PROCESSING
We will collect various types of personal information from you. Further details of how we use your personal information are set out below.
In the section below, we have indicated with asterisks whether we need to process your personal information:
HOW WE WILL USE YOUR INFORMATION
Providing you with a Quote
When you request a quote from us via our website, or by email, or telephone, we will need to collect the following information about you to allow us to provide that quote**:
We will not be able to provide a quote to you unless you provide the information shown in bold above.
Onboarding you as a Customer
If you join us as a customer, we will need to collect the following additional information about you to allow us to complete the customer onboarding process (including verifying your identity and carrying out a credit check)** and to provide to you the products or services you have requested from us*:
If it is required in order to take over your energy supply, we may ask your previous energy supplier for information about you, including information about your metering equipment, meter readings and any charges you may owe your previous supplier.
We will only use these details for the purposes of onboarding you as a customer and providing our products and/or services to you**.
Managing your Account
Whilst you are our customer, we will collect the following information to allow us to manage your account*, analyse and monitor your energy consumption for billing purposes*/** and continue to provide the products or services you have requested from us*:
We may also continue to carry out credit checks on you whilst you have an account with us for the purpose of making credit decisions about you in order to administer your account** (see the Credit Checking section below).
Recording and Monitoring
We may record and monitor communications with you by telephone for the purposes of quality assurance, our mutual protection, staff training, improving our customer service, fraud detection, compliance with our regulatory requirements and, if you are a customer, administering your account*/**/***.
During the customer onboarding process and whilst you have an account with us, we may use the above personal information to search the files of Credit Reference and Fraud Prevention agencies for the purposes making decisions about your customer account and to prevent fraud**/***.
Credit Reference Agencies (CRAs) collect and maintain information about consumers’ and businesses’ credit behaviour. This includes data sourced from the Electoral Register, fraud prevention, and credit information – including details of previous applications and the conduct of your accounts – and public information such as County Court Judgements, decrees, and bankruptcies.
When a credit check is carried out on you, your credit records will be searched, along with any financially associated individuals such as your spouse or partner. The CRA will keep a record of this search and place a “footprint” on your credit file.
The information that organisations like us provide to credit reference agencies about you, such as your payment history, false or inaccurate information, or if we suspect fraud, may be provided to other organisations and used by them to:
Theft Risk Assessment Service
In order to facilitate the prevention, detection and any subsequent investigation of energy theft, all UK energy suppliers are required by law to provide information about their customers and the results of theft investigations to a central database, managed by a fraud prevention agency on behalf of the energy industry. This project is known as the Theft Risk Assessment Service (TRAS).
If we suspect or can confirm that you are involved with any cases of fraud or energy theft, we will record this information and share it with TRAS***. The information that we provide to TRAS will be linked to other information which the fraud prevention agency holds, including information provided by other energy suppliers. This information may be provided to other UK energy suppliers with whom you have an account to help them investigate and prevent the theft of energy. Equally, TRAS may provide information provided by other energy suppliers to us to help us identify potential fraud or theft of energy.
We may use information about such conduct to make decisions about you, including the products and services that we offer to you and the terms and conditions on which those products and services are made available to you.
The information provided to or by TRAS will not be used for any other purpose, unless required or permitted by law.
Other uses of your information
We may also use your personal information in the following ways:
We will not carry out any solely automated decision making using your personal information.
CHANGE OF PURPOSE
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will usually notify you and we will explain the legal basis which allows us to do so.
DISCLOSURE OF YOUR INFORMATION
We may share your personal information with the third parties set out below for the purposes described above:
We require all service providers and Group companies that we share your personal information with to respect the privacy and security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers, including Group companies, to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.
Most of the personal information we collect about you is based in the United Kingdom or in some cases, a service provider or their sub-processor may be based elsewhere in the European Union (EU) and so, they are required to comply with European data protection law. On occasion, we may appoint a third-party service provider whose operation or a server or sub-processor may be based outside of the EU. As part of our Vendor Management Policy, we carry out due diligence on our third-party providers and assess whether your personal information will be transferred to them or accessed by them from outside the EU. If that is the case, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
If you would like to know the specific mechanism used by us when transferring your personal information out of the EU, please contact us using the details set out in the “Contacting Us” section at the end of this Notice.
STORAGE OF YOUR PERSONAL INFORMATION
We will only keep your personal information for as long as necessary to fulfil the relevant purpose(s) we collected it for, as set out above in this Notice, and for as long as we are required to keep it for legal purposes.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
For example, by law, we have to keep basic information about our customers (including contact, identity, financial and transactional data) for six years after they cease being customers for tax purposes.
In some circumstances:
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator where we are legally required to do so.
Data protection laws provide you with the following rights (where we are processing your personal information (but not information about a limited company), to:
You also have the right to object to the processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights above). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We will need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. The ICO can be contacted by telephone on 0303 123 1113 or by post as follows: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF or via email at email@example.com. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance using any of the details set out below in the “Contacting Us” section.
CHANGES TO OUR PRIVACY NOTICE
Any changes we make to our Notice in the future will be posted on our website and, where appropriate, notified to you in writing.
If you have any queries, comments or requests regarding this Notice or you would like to exercise any of your rights set out above, you can contact us as follows: