Privacy

About this privacy notice

• Information about us

  This privacy notice is for Lee Valley Heat Network Operating Company Limited (company number 09763702) trading as “Energetik” (referred to as “Energetik”, “we”, “us” or “our” in this privacy notice).

  We collect, use and are responsible for certain personal data about you. When we do so we are regulated under the General Data Protection Regulation (“GDPR”), which applies across the European Union (including the United Kingdom) and we are responsible as “data controller” of that personal information for the purposes of the law.

  If you want to contact us about any of the points on this notice, or just generally about how we protect your privacy, please email us at [email protected]. Our contact address is Energetik, B Block North, Civic Centre, Silver Street, Enfield, EN1 3XA.

• The purpose and lawful basis for processing your personal data

  Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

  We use personal data from different categories of individual for several different purposes and each with its own “lawful basis”. This section describes these in detail and, although it’s technical, we’re required by law to explain this to you.

  If you visit our website:

  We use Google Analytics on our website to track visitor numbers and user activity. We record your computer’s IP address so we can tell how each user and repeat visitor is using our site (your IP address is also a piece of your personal data) as well as browser type and information about technology on the devices you use to access this website. We do this on the basis that it is necessary for our legitimate interests in monitoring and improving our website. The information will be held for 26 months after last user activity.

  If you fill in a form on our website to contact us:

  We will store the data you enter (such as name, contact details, job title, organisation, enquiry, reason for enquiry) for the purposes of answering your enquiry and communicating with you. We do this on the basis that it is necessary for our legitimate interests in operating and promoting our business. We store your data for as long as we need to interact with you for these purposes.  In all cases if you would like us to update or delete your information, please send us an email (see “How to contact us” below).

  If you receive our email update newsletter:

  We will hold your name and email address for the purpose of sending you updates on the Energetik heat network and industry news. We process this data on the basis that we have your consent.  You can withdraw your consent at any time by using the “unsubscribe” links at the bottom of each email. 

  If you are a residential heat supply customer:

  We will collect:

  • Your name
  • Your address
  • Phone number
  • Email address
  • Start date of ownership/tenancy
  • Your landlord’s name and contact details (if you are a tenant)
  • Energy usage and payment information
  • Communication preferences

  We use this for the following purposes:

  • To deliver our services to you according to our contractual agreement
  • To collect customer payments and manage payment plans
  • To contact you with important information about your account, including your payments, and your energy usage
  • To comply with our regulatory requirements or industry standards (for example under the Heat Trust Scheme)
  • To respond to customer enquiries and complaints
  • For management information reporting purposes, to help us continually improve our offering to our customers
  • To contact your landlord or the management company managing the development that your home is part of about your account
  • To protect the safety of our staff and contractors
  • To detect fraud or loss

  Our lawful basis for processing this data will be one or more of the following:

  • the processing is necessary for our legitimate interests in operating our business and giving you the best possible service
  • the processing is necessary to perform the heat supply contract we have with you, or to take steps to enter into such a contract with you
  • the processing is necessary in order for us to comply with a legal or regulatory obligation

  If you would like more details on the personal data we hold, the purposes and the lawful basis for processing, do not hesitate to get in touch (see “How to contact us” below)

  If you, your landlord or a third party feel you’re in need of additional support, or in a vulnerable situation, we may be provided with or ask you for and/ or process the following information:

  • Details of your health or medical condition(s)
  • Any other relevant information that you provide us with to inform us of your vulnerability

  We use this for the following purposes:

  • To protect vulnerable customers and provide appropriate assistance to customers with particular needs
  • To fulfil your request appropriately
  • To place you on our Priority Service Register

  We do so on the basis that it is necessary in order for us to comply with a legal or regulatory obligation as well as necessary for our legitimate interests in operating our business fairly and providing appropriate customer care.

  If you contact our customer services operatives by telephone:

  We will hold recordings of your calls for the purposes of training, monitoring and quality control.  We do this on the basis that it necessary for our legitimate interests in operating our business and giving you the best possible service.

  If you agree to be filmed or photographed by us:

  Then we will hold and use video or picture files containing your image (which is also your personal data).  We use this for the purposes of promoting and documenting Energetik through our website and social media.  We do so on the basis that it is necessary for our legitimate interests in promoting our business.  We will always ask you to sign a consent form so that we know you are happy with us using your image in that way.

  If you work for a commercial client or landlord or if you are an industry contact or working in a field relevant to our mission:

  We may hold your name, company, job title and contact details. We will have been provided with this data either by you or your employer or in some cases we may have sourced it from publicly available sources, such as LinkedIn and internet searches. We need this data for the purposes of interacting with you (or your employer) in order to operate our business, find new customers and partners, and to organise events. We do this on the basis that it is necessary for our legitimate interests in operating and growing our business. We will hold your details for as long as we need to interact with you for these purposes. In all cases if you would like us to update or delete your information, please send us an email (see “How to contact us” below). 

  If you are a supplier or work for a supplier:

  We may hold your name and contact details because we have a legitimate interest in doing business with your company. Our purpose for processing your personal data is to interact with you or your employer to procure and pay for goods and services. We will hold this information for as long as we need to interact with you for these purposes. In all cases if you would like us to update or delete your information, please send us an email (see “How to contact us” below).

  CCTV recording

  Why do we collect personal data through CCTV recording?

  We record CCTV images to monitor the security of our energy centres and to prevent and detect unauthorised access. We collect these images to prevent, deter, and if necessary, investigate unauthorised physical access to our property.

  The CCTV system is not used for any other purpose, such as to monitor the work of employees or their attendance. It is important to notice that the location and positioning of the video-cameras are such that they are not intended to cover the surrounding public space; the cameras are aimed to give a view of the entrances to our energy centres.

  The CCTV system covers the area of entry and exit points of the building and entry points inside the building.

  What data do we record?

  We only collect images caught on our cameras, and no voice is recorded. We will ensure clear notices are visible in the area around our cameras to advise customers that recording is being undertaken

  What is the legal basis for this processing operation?

  We use CCTV because it is necessary for our legitimate interests in protecting and managing of our property, and these interests are not outweighed by negative effects to the individual’s rights and freedoms.

• Whether information has to be provided by you and if so why

  Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with heat).

• Who we share your personal data with

  Data processors

  We use a number of different service providers (acting as ‘data processors’) who provide services or cloud-based software to enable us to operate our business and the services we provide to our customers. Your personal data is transferred to (and stored by) these service providers (as our ‘data processors’), who generally fall under the following categories:

  • Website analytics
  • Website and data hosting
  • IT and system administration
  • Document storage
  • Email, contacts and calendar
  • CRM, customer services and billing
  • Accounting

  These ‘data processors’ only process data on our behalf. They won’t use your personal data for their own purposes and we only permit them to use it in accordance with our instructions and the law.

  For security reasons we do not name all our service providers in this privacy notice. The types of personal data we hold about you (and that may be transferred to our data processors) are set out above. Please contact us (see below) if you want further information on specific data processors or the types of personal data they process for us.

  If you attend one of our events

  The name and organisation of attendees at our events may be shared with the event hosts, speakers and other attendees.

  Other circumstances in which we may need to share personal data with third parties

  We may also share your personal data with the following third parties in certain circumstances:

  • (For residential customers), your landlord or the management company managing the development that your home is part of
  • Credit reference and debt collection agencies
  • Law enforcement or regulatory authorities (such as tax authorities) if required by applicable law
  • Professional advisors such as lawyers, bankers, accountants or auditors in order for them to provide us with legal, finance, accounting or auditing services.

  We may also share personal information with third parties to whom we may choose to sell, transfer, or merge parts of our organisation or our assets or in situations where acquire other organisations or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

  We will not sell or rent your information to third parties and we will never share your information with third parties for marketing purposes.

  CCTV

  Who is responsible for the processing of CCTV data?

  Only Energetik has access to the data, it will never be transferred to a third party with the exception of the police when investigating unauthorised entry into our energy centres.

  Who can see CCTV data?

  The images can only be accessed by individuals with relevant clearance within Energetik. Access to the hard-disc recorder where images are stored is highly limited, being protected by a password and recording any log or action on the system.

• International transfers of personal data, and the measures in place to safeguard it

  We do not directly transfer any of your personal data outside the European Union. However, some of our data processors may do so and this section explains the impact of these international transfers and how your information is protected.

  Many of our data processors operate “cloud-based systems”, which means the information is held in information data centres in different locations.  Most of them reserve the right to hold copies of your personal information outside the EU. Please note that the reason companies may choose to do this is to hold back-up copies, so they can guarantee recovery.

  In each case our processors employ one or more of the following means that are designed to help safeguard your privacy rights and give you remedies in the unlikely event of abuse:

  • Certain processors only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
  • Providers storing data in the US, may be self-certified to the EU-US Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US. For further details, see European Commission: EU-US Privacy Shield.
  • With certain service providers, we may use specific contractual clauses approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.

  Please contact us (see below) if you want further information on the specific mechanisms used by our data processors when transferring your personal data out of the EEA.

  How long do we retain your personal data?

  We’ll only store your personal data for as long as is necessary to fulfil the purposes outlined in this privacy notice or for as long as reasonably necessary to establish, exercise or defend our legal rights.  In addition some data is retained in line with statutory and regulatory requirements such as:

  • To comply with the minimum regulatory retention requirements as set by industry regulators or government departments.
  • To comply with the statutory retention periods for accounting records, as set by the legislation and HM Revenue & Customs.

  Please contact us (see below) if you would like more information on retention periods for specific categories of data.

• Your personal data rights

  The personal data we hold about you is your data, so you have certain rights over the data under the GDPR. This section summarises your rights and how you can exercise them (generally free of charge).

  You have the right to request a copy of all personal data we hold relating to you. You also have the right to require us to correct any mistakes in the personal data we hold relating to you.

  Where we are processing your data based on your consent you can withdraw that consent and we must immediately stop processing your data. Please note that up to that point, we’re acting lawfully with your consent, withdrawal of consent cannot be backdated.

  Where we process your data based on a “legitimate interest” (underlined in the section on “purpose and lawful basis”, above) you still have the right to object to our processing of that data if you feel it impacts on your fundamental rights and freedoms. From that point, we must stop processing your data until we have determined whether your rights override our interests.

  You also have the right to object where we are processing your personal data for direct marketing purposes.  The easiest way to do this is to use the unsubscribe links at the bottom of all marketing emails.

  In certain situations, you have the right to require us to erase personal data where there is no good reason for us continuing to process it. However, note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

  You have the right to request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

  Finally, you have the right to request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format. Note that this right only applies to automated processing of information about you, if carried out based on your consent or where it is necessary to perform a contract with you.

  For further information on each of these rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

  If you would like to exercise any of these rights, the easiest way is by dropping us an email (see “How to contact us” below). Please note:

  • We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
  • We try to respond to all legitimate requests quickly, but in any event within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

   

• Automated processing of your personal data

  You have a right to object to any decisions being taken through the processing of your personal data by automated means if they produce legal effects concerning you or similarly significant effects on you. We do not use your personal data in a way that makes such decisions.

• Your rights to lodge a complaint with the Regulator

  At all times, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at https://ico.org.uk/concerns/ or by calling them on 0303 123 1113. Of course, we hope that we can resolve your issue quickly and fairly ourselves.

• Keeping your personal information secure

  We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

  We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

  CCTV

  How long will we store CCTV data?

  Unless required for evidential purposes, the investigation of an offence or as required by law, CCTV images will be retained for no longer than 60 days from the date of recording.

• Changes to this privacy notice

  This privacy notice was last updated on 24th August 2021 and historic versions can be obtained by contacting us. We may change this privacy notice from time to time by amending this page.

• How to contact us

  If you have any questions, concerns or just want some more information about our privacy management, drop us a line at [email protected].