Skip to main content
homeprivacy policy

SSE Energy Solutions privacy notice

We are committed to ensuring your privacy is protected. This privacy notice explains how we use the information we collect about you.

1. About us

This privacy notice applies to SSE Energy Solutions which is operated by the following data controllers (all of which are members of the SSE Group):

  • SSE Energy Supply Limited, No. 03757502
  • SSE Utility Solutions Ltd, No. 06894120
  • SSE Heat Networks Ltd, No. SC303682
  • TESGL Ltd (trading as SSE Enterprise Energy Solutions), No. 08462158
  • SSE Digital Services Ltd, No. 14621186

The registered office of SSE Energy Supply Limited, SSE Utility Solutions Ltd and SSE Digital Services Ltd is No.1 Forbury Place, 43 Forbury Road, Reading, United Kingdom, RG1 3JH and this company is subject to the laws of England and Wales.

The registered office of SSE Heat Networks Limited is Inveralmond House, 200 Dunkeld Road, Perth PH1 3AQ and this company is subject to the laws of Scotland.

The registered office of TESGL Limited is Ocean Court, Caspian Road, Atlantic Street, Altrincham WA14 5HH and this company is subject to the laws of England and Wales.

These companies are referred to as “SSE”, “we” or “us” throughout this privacy notice. We will be the “controller” of the information you provide to us.

This Privacy Notice covers the following processing activities of SSE Energy Solutions:

  • Customer Operations and Complaints
  • Priority Services Register
  • Electric Vehicles (EV), Chargers and Charging Sites
  • Smart Meter
  • Debt Collection
  • Heat Network Meters

2. What information do we collect?

We, or third parties on our behalf, collect your personal data when you use our website, communicate with us by phone, letter, email, social media or in person or when you receive our products and/or services. We may also be provided with information about you by a previous tenant, or a third-party intermediary (TPI) who is authorised to act on your behalf.

We may collect the following personal data and we refer to this as “personal data” throughout this notice:

  • First name and last name;
  • Gender;
  • Billing address;
  • Supply address;
  • Telephone number(s);
  • E-mail address;
  • Date of birth;
  • Details of secondary contact (e.g. name and phone number);
  • Call recordings;
  • Video footage through the use of Body Worn Cameras;
  • Customer ID numbers- when you register an account with us, we create and record a customer ID number for you and record the date you were registered;
  • Consumption/ Energy usage (e.g. meter readings, energy consumed, and average power used for Electric vehicle charging)- - If you have a smart meter then this information is automatically sent to us;
  • Financial data (such as bank account details (e.g. sort code, account number, name, account type) and payment card details;
  • Payment data (such as payment IDs and voucher codes).
  • Transaction data (such as details about payments to you and from you and other details of products and services you have purchased from or provided to us).
  • Your preferences (e.g. if you would prefer paperless billing);
  • Permissions;
  • Survey responses;
  • Whether you are living in social housing;
  • Your Meter Point Administration Number (MPAN) to identify your energy supply;
  • Your Meter Point Reference Number (MPRN) to identify your gas supply;
  • If someone has committed fraud or stolen energy, e.g. by tampering with a meter or diverting the energy supply, we will record that information;
  • If you visit our website, we store your IP address, the browser software you use and your behaviour on our website (for example, the pages that you click on). This information is collected through cookies. More information on how we use cookies can be found in our cookie policies on the relevant website; and
  • CCTV ( including smart sensor technology) footage when you visit our offices or any sites operated by us (including EV charging sites)..

3. What do we do with your personal data?

We, or third-parties on our behalf, collect, use and store the personal data collected about you to:

  • Provide, maintain, adapt, protect and improve any products and services you have requested from us
  • Use all available meter consumption data (monthly readings, 15-minute or half-hourly interval data) to analyse consumption patterns with the intention of developing products and services (including providing energy efficiency information)
  • Respond to any enquiries or issues you have, including directing you to the correct SSE support team
  • Identify you
  • Contact you, or authorised third parties, about our services- such as sending you information when you sign up or change tariffs, service announcements and administrative messages
  • Manage our relationship with you through customer services and support activities;
  • Provide you with any information that we are required to send you in accordance with our regulatory or legal obligations
  • Communicate with you by telephone, mail, email or other electronic means and obtain feedback on how we can improve our services
  • To enter into legal contracts with you
  • Perform our obligations under any contract for the supply of services we have with you;
  • Train our staff and improve our products and services, which may mean that we monitor and record communications that we have with you including phone conversations, emails, SMSs and web chats
  • To enable us to make payments, issue refunds and/or return credit balances to you.
  • To check and verify your bank account details.
  • Allow our engineers to visit you onsite (where required)
  • Use data analytics to understand and improve the way we do things as a business
  • Conduct, and contact you in relation to, market research e.g. through customer satisfaction surveys and questionnaires
  • Identify offers and advice tailored to your needs or lifestyle
  • Ensure the health and safety of you, our staff and contractors
  • Make personal projections about the amount of energy you are likely to use in a given period
  • Respond to and/or resolve any enquiries or requests that you may make via social media
  • Monitor, measure, improve and protect the content of our websites and services to provide enhanced and personal user experience for you
  • Enable internal corporate reporting, business administration, adequate insurance coverage, the security of company facilities, research and development, and to identify and implement business efficiencies
  • Comply with any procedures, laws and regulations which apply to us – including where we reasonably consider it is in our (or others) legitimate interests to comply
  • Establish, exercise or defend our legal rights – including where we reasonably consider it is in our (or others) legitimate interests
  • Facilitate the credit management process
  • Allow us to process charges in the event of damage to our equipment
  • Provide compensation to customers in certain circumstances
  • To detect and prevent crime, fraud or loss: including carrying out checks on customers, suppliers and other third parties, which relate to activities such as anti-money laundering, countering terrorist financing and other unlawful acts (for example, illegal trafficking and environmental crime) and anti-bribery and corruption requirements
  • Detect, prevent, investigate or remediate, crime (including anti-social behaviour), illegal or prohibited activities or to otherwise protect our legal rights, including liaison with regulators and law enforcement agencies
  • Compare the information we collect with that held by third parties, for example credit reference agencies for accuracy and verification;;
  • Manage the debt customers have with us by sharing data with credit reference agencies . Customer debt management also helps us, in part, to meet our obligations as a member of the Heat Trust to treat customers fairly.
  • Deliver joint content and services with third parties with whom you have a separate relationship.
  • For additional information on what we do with personal data for Priority Services Register, Electric Vehicles, Chargers and Charging Sites, Smart Meter, Debt Collection or Heat Network Meters, please click on the relevant link.

4. Artificial Intelligence (AI)

We use personal data for running, growing and developing our business which may involve the use of Artificial Intelligence (AI) technologies such as digital assistants, generative or machine learning to improve our products.

CoPilot We use Copilot (a generative AI tool and AI powered assistant) to assist employees to be more productive and efficient and it will be used for the following use cases:

  • Meetings: Copilot assists with meetings by taking minutes, producing summaries and actions, and helping staff catch up on missed meetings.
  • Writing: Copilot helps with writing documents and emails, such as suggesting ways to word something, helping to creating drafts and formatting documents
  • Presentations: Copilot is used to speed up the time it takes to create PowerPoint presentations.
  • Data analysis: Copilot is used to analyse and visualise data, identify trends and creating reports and graphs.

SSE’s data, used by Copilot is stored within our secure Microsoft tenant, which is held within the UK. The data is under the control of SSE and is not used to train or improve Microsoft, or third party AI models. Outputs and user prompts are retained as per existing retention rules.

5. Marketing Communications

Unless you’ve asked us not to, we may contact you in writing, by phone and (Individuals, Sole Traders and Partnerships only - where you have consented) via email or SMS with information on products, services and rewards that we, other companies within SSE Group, and occasionally our carefully selected partners identified at the time we collect your information, offer. We may also use third parties to send marketing communications.

Unless you have asked us not to, we may also use your personal data to show you digital advertisements via your social media newsfeed, on search engine results pages, or on other websites.

We also work with third parties to identify whether you are a user on other platforms and to deliver targeted advertisements to you on those platforms. To do so, we rely on your consent to the placement of cookies and similar technologies on your device, which you may have provided through the OneNote tool when you first access our website. You can withdraw your consent to the placement of these cookies at any time by changing your preferences here.

One third party we work with to deliver targeted advertisements to you is Facebook. Where you have consented to the placement of third party cookies by Facebook, SSE and Facebook Ireland Ltd. (“Facebook Ireland”) will be ‘joint data controllers’ meaning that we each have some responsibilities and obligations concerning your personal data. We have entered into terms with Facebook Ireland to determine our separate responsibilities available here and agreed that when your personal data is collected through cookies placed by Facebook Ireland:

  1. We are responsible for explaining how and why we share data with Facebook Ireland – which is to deliver targeted advertising as explained above;

  2. We are responsible for explaining how your personal data will be used by SSE – which is as set out in this privacy notice. For further information on how your personal data will be used by Facebook Ireland, including the legal basis relied upon by Facebook Ireland, how long your data may be retained and your personal data rights, please see Facebook Ireland’s privacy notice here.

If you wish to exercise any of your personal data rights (such as the right to receive information or the right of erasure), Facebook Ireland will be responsible for handling and responding to any such requests. You can find out further information on how to exercise your data rights against Facebook Ireland here.

Unless you have asked us not to, we may profile your data to provide you with marketing and offers that are relevant to you. If you opt out of profiling, we will still run analysis that includes your data, but any decisions or marketing output that result from that analysis will not be used to market to you. You will be sent generic marketing that may not be relevant to you.

Where you partially complete and/or abandon any information inputted into our website and/or other online forms, we may use this information to contact you to remind you to complete any outstanding information and/or for marketing purposes.

If you have not consented to receiving direct marketing communications, we will only send these communications to you when permitted to do so by law. To opt out of receiving marketing messages, or to object to our use of profiling for direct marketing purposes, contact us at any time using the details in section 12.

6. Legal bases for processing

In order to process and use your personal data lawfully, we rely on the following legal bases:

  • Contract – for the performance of a contract with you for provision of our products and/or services or to take steps at your request prior to entering into such a contract;
  • Legal Obligation – to comply with our legal obligations;
  • Legitimate Interest – ensuring effective operational management and internal administration; debt management; verifying the accuracy of information; document retention/storage; compliance with regulatory guidance; exercise or defence of legal claims; detecting and reporting criminal and/or anti-social behaviour to relevant authorities; service and product improvement; and communicating with you;
  • Consent – where we market to you via email or SMS, or where we collect personal data using cookies or similar technologies, as explained further in our Cookie Policy [link to cookie policy]. If we rely on your consent in these ways, but you later change your mind, you may withdraw your consent by contacting us using the details in section 12 and we will stop doing so; and/or
  • Substantial Public Interest – namely safeguarding of children and individuals at risk, where we process special categories of data e.g. vulnerability information on the Priority Services Register.

7. Who do we share your personal data with?

We may share your personal information with the following categories of third parties:

  • Ofgem, the Energy Ombudsman and any other regulatory authority we may be subject to for the purposes of demonstrating compliance with applicable law and regulations;
  • National databases supporting the energy transfer process, including ECOES, Xoserve, and PAF, which provide us with information about the supply of energy to each address in the UK. We may use a third party to facilitate access to this information;
  • KPMG, our Corporate Auditory for the purposes of demonstrating compliance with financial and regulatory frameworks;
  • Our third-party suppliers, partners and sub-contractors that provide, review and/or receive services in relation to our website, customer services, services and/or products. Our third-party suppliers include: payment processors; payment providers, payment system companies, technology providers, banks, suppliers of technical support and installation services; cloud services providers, research agencies and marketing service partners.
  • Third party intermediaries, where you have engaged their services;
  • Where appropriate, family members or cohabitants, previous tenants, landlords, letting agents or other third parties who require the information;
  • Government or law enforcement officials- If we’re under a duty to disclose your information in order to comply with any legal obligation, or where we require to report criminal and/or anti-social behaviour then we may disclose your personal data to meet national security or law enforcement requirements or to prevent illegal activity;
  • Metering agents;
  • Debt collection and tracing agents, and/or legal claims firms if we provide you with a service and you fail to make payments;
  • Credit Reference Agencies; please see section 8 below.
  • Authorised third parties or named account holders on any account you hold with us;
  • If we sell, merge, or perform any internal re-organisations in relation to any of our (or any third party’s) business or assets, the personal information will be one of the transferred assets to the relevant buyer and/or new data controller of such business or assets; and/or
  • Other SSE group companies for the purposes of account administration, payment management, strategy development, IT and marketing support.

8. How long do we hold it for?

We will keep your information only for as long as is necessary depending on the purpose for which it was provided.

When determining the relevant retention periods, we will take into account factors including:

  • our contractual obligations and rights in relation to the information involved;
  • legal obligation(s) under applicable law to retain data for a certain period of time;
  • (potential) disputes; and
  • guidelines issued by relevant data protection authorities.
  • Otherwise, we securely erase your information once this is no longer needed.

9. Credit checking and automated decision-making

Part A, Business Energy Customers

We may supply your personal information to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. Some parts of our business may do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at http://www.experian.co.uk/crain/index.html We may take credit scoring information into account when deciding the conditions placed upon your supply, including any premium to be added or security deposit required. In the majority of cases, we will also consider other information that we hold about you, and this decision will not be fully automated. Please note that businesses that we consider to be in higher risk industries will have a premium added. We use automated decision-making to determine the conditions upon which we supply you in the following circumstances:

  • Customers whose businesses are insolvent or no longer trading
  • If your business is insolvent or no longer trading, we will automatically refuse to supply you.
  • New connections customers with a supply larger than 23kVA
  • For new connections customers with a supply larger than 23kVA, we will use credit scoring information supplied by a third-party credit agency to determine whether a security deposit is appropriate. You can appeal any automated decision, receive an explanation of the decision or require human review of the decision by getting in touch using the details in the “Contacting Us” section below..

Part B, Heat Network customers When you become a customer of SSE Heat Networks, we will set up and share your information with Experian, one of 3 UK Credit Reference Agencies (CRAs). We’ll routinely do this:

  • To verify the accuracy of our data held about you;
  • As part of our management of your account, whether you are in credit or debt; and
  • To manage our debt risk and inform appropriate debt prevention strategies that we may implement.
  • The CRAs might share this data with others to help them make informed lending decisions.

The information shared with CRAs will not be used by SSE Heat Networks in deciding whether to supply your property.

The CRAs provide more information in a Credit Reference Agency Information Notice (CRAIN) which describes how the three main CRAs (Experian, Equifax and TransUnion) share and use personal data. This is available from all three CRAs and displayed on their websites. You can also find the information here.

• TransUnion

• Equifax

• Experian

10. Your rights

You have the following rights regarding your information:

Right to be informed You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. Therefore, we are providing you with the information in this privacy notice.

Right of access You have the right to obtain access to your personal data (if we are processing it) and certain other information (similar to that provided in this privacy notice). This is so you are aware and can check that we are using your personal data in accordance with data protection law(s).

Right to rectification You are entitled to have your personal data corrected if it is inaccurate or incomplete.

Right to erasure This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there is no compelling reason for us to keep it. This is not an absolute right to erasure; there are exceptions.

Right to restrict processing You have the right to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data, but may not use it further.

Right to data portability You have the right to obtain and reuse your personal data in a structured, commonly used and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.

Right to object to processing You have the right to object to your personal data being processed in certain circumstances. This includes where we are relying on legitimate interest and for direct marketing purposes (including profiling).

Right to withdraw consent If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for direct marketing.

For more information on your rights or if you would like to exercise any of your rights, you are welcome to get in touch using the details in the “Contacting Us” section below.

11. International data transfers – How is your personal data transferred outside of the European Economic Area (EEA) and the UK?

Your personal data may be transferred to or processed in a country which is outside your resident country (this includes outside of the United Kingdom and European Economic Area (“EEA”)). This may include transfers to other companies within the SSE group, and to third parties.

We take organisational, contractual, and legal measures to ensure that adequate levels of protection have been implemented to safeguard your personal data such as:

  • Where the country has been granted an adequacy decision by the European Commission and/or the Information Commissioner in the UK. This means that the destination country provides an adequate level of protection which is equivalent to that applied in the UK, and the EEA;
  • Put in place a contract with the third party receiving the personal data, which incorporates the Standard Contractual Clauses (“SCCs”) which has been issued by the European Commission (in relation to transfers of European residents’ personal data) and the UK addendum to the SCCs which has been issued by the ICO (in relation to transfers of UK residents’ personal data), that means the third party who receives the personal data must protect it to the same standards set out in the GDPR;
  • Where an appropriate derogation as set out in Article 49 of the GDPR applies; or
  • Where the EU-US Data Privacy Framework and/or the UK Extension to the EU-US Data Privacy Framework arrangements apply.
  • We, or a third party who we share personal data with, may transfer, host, store and/or handle your personal information outside of the EEA. For example, where we and/or our service providers (including servers) are based outside of the EEA.

The EEA consists of countries in the European Union, Iceland, Liechtenstein and Norway and are all considered to have equivalent laws in data protection and privacy. As of present, the UK including Northern Ireland, are also considered to have equivalent laws in data protection and privacy.

We will only permit this to happen if adequate safeguards have been put in place to protect your personal data. For countries outside the UK, this means that we will:

a) ensure that the country in which your personal data will be handled has been deemed “adequate” by the European Commission under Article 45 of the General Data Protection Regulation (GDPR); or b) include standard data protection clauses approved by the European Commission for transferring personal data outside the EEA and the UK into our contracts with those third parties (these are the clauses approved under Article 46.2 of the GDPR).

12. Changes to this notice

We may update our privacy notice from time to time. Any changes we make to our privacy notice in the future will be posted on the SSE website and, where appropriate, notified to you by post or email. For more information on your rights or if you would like to exercise any of your rights, you are welcome to contact us at the contact details set out below under “Contacting us”.

13. Contacting us

If you would like to contact us in relation to your rights or if you are unhappy with how we have handled your information, you may do so using the following details:

Email: EnergySolutionsDataProtection@sse.com

Address: SSE Energy Solutions, No.1 Forbury Place, 43 Forbury Road, Reading, United Kingdom, RG1 3JH

If you would like to contact our Data Protection Officer, you may do so using the following details:

Email: GroupDPO@sse.com

Address: Data Protection Officer, No. 1 Forbury Place, 43 Forbury Road, Reading, RG1 3JH

14. ICO complaints

If you’re not satisfied with our response to any complaint or believe our processing of your information does not comply with data protection law, you can make a complaint to the Information Commissioner’s Office (ICO) using the following details:

Telephone Number: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Website: ico.org.uk

LINKS TO SUPPLEMENTAL INFORMATION

1. PRIORITY SERVICES REGISTER

Special categories of personal data

In addition to collecting your basic personal data (name, address, telephone number and email address), if you or someone acting on yourself have registered your account on our Priority Services Register, we collect and process special categories or “sensitive” personal data about you (e.g. data concerning health and/or a medical condition).

We rely on legitimate interest and substantial public interest condition “safeguarding of children and individuals at risk” for collecting and processing special categories of personal data on the Priority Services Register. If you would like to be removed from the Priority Services Register, you may contact our customer service team to update your information.

What do we do with your personal information?

We use your information to:

  • register you on our Priority Service Register;
  • ensure that you are provided with the ongoing support you need in an emergency, bad weather and for planned supply interruptions (including providing you with updates and alerts) both onsite and through our customer contact centre;
  • providing you with a “knock and wait” service for appointments if you require it.
  • liaise with your nominated contact (where provided);
  • periodically contact you to confirm that the details we hold for you are up to date;
  • provide you with bills and to communicate with you in Braille, in large print, via an audio CD or language other than English if you require it; and
  • provide you with a security password.
  • We may also receive personal information about you from third parties acting on your behalf, such as your family member, neighbour, electricity suppliers, gas suppliers, water company, welfare organisations and NHS organisations to include you on our Priority Services Register so that you will benefit from this service. We will send you a letter to notify you when you have been added to the Register.
  • We may share your information with:
  • welfare organisations, local authorities, and emergency services for those organisations to provide support and assistance to you in special circumstances or emergencies; and
  • our sub-contractors to provide onsite support during, planned supply interruptions, bad weather or emergencies.

2. ELECTRIC VEHICLES

What personal information do we collect?

Sensors monitor activity within our EV car parks. We will use images collected from this to ensure the safety of our car parks and also for the prevention of crime and anti-social behaviour. Images are held for 30 days before they are securely deleted. The car park sensors use Artificial Intelligence (AI) but the AI will not be used to identify you in any way. The AI is being used for the sensor to be able to recognise objects.

What do we do with your personal information?

We will record details of your vehicle charging session, including the charging station location, type of connector used, date of session, and start and end times of charging sessions. Regarding the Electric Vehicle Recharging Network service offering, we will share your personal data with SWARCO UK Ltd, registered in England under company number 2755698, in order to allow them to provide services to Us in relation to the network;

3. SMART METER

What do we do with your personal information?

Data collected from your smart meter enables us to work out your bills and to identify and prevent fraud or energy theft. If you have a Smart Meter you will find more information on how we use your data in our Smart meter data guide which is located here

4. DEBT COLLECTION

What do we do with your personal information?

If we provide you with a service and you fail to make payments, then we may share information with third party debt collection and tracing agents (for example, TDX Group Limited) in order to collect outstanding payment. This information is also shared with Experian and Dun & Bradstreet to collate payment behaviour for companies. This payment behaviour is combined with details from other companies and may impact on your credit score. Your information may be shared with the appropriate court if the matter progresses to litigation.
We attach tracking pixels to our email correspondence with you. These pixels tell us information about when you have opened your email. We use this information to understand the effectiveness of our correspondence. You can opt out to the placement of these tracking pixels at any time by contacting Debt Register on 0345 070 1608

5. HEAT NETWORK CUSTOMERS

What do we do with your personal information?

We will access and utilise personal data from heat meters installed in customers’ homes where we run a heat network, including 15 minute heat and hot water consumption data in order to develop and maintain an efficient, co-ordinated and economical heat network. It will also be used to identify faults and where possible minimise disruption to the heat and hot water supply at sites where we run a heat network.