SSE Energy Solutions: Your Data Privacy Matters

Purpose	Categories of Personal Data Used	Lawful Bases
Registering you as a new customer, or switching your energy supply which may include receiving information relating to outstanding debt on your account in line with relevant market guidelines and meter readings and equipment	Identity Data, Contact Data, Financial Data, Transaction Data	Performance of a contract with you
To identify and contact you	Identity Data, Contact Data	Legitimate Interests; Performance of a contract with you
Manage our relationship with you through customer services and support activities, including responding to any enquiries or requests that you make to us	Identity Data, Contact Data, Financial Data, Transaction Data, Marketing and Communications Data, Customer Account Data, Special Category Data	Legitimate Interests; Performance of a contract with you; Substantial public interest condition “safeguarding of children and individuals at risk” for Special Category Data
To provide you with any information that we are required to send you in accordance with our Regulatory or legal obligations	Identity Data, Contact Data	Legal Obligation
To check and verify your bank account details	Identity Data, Contact Data, Financial Data	Legal Obligation under Anti-Financial Crime Regulations
To allow our engineers to visit on site	Identity Data, Contact Data	Legitimate Interests; Performance of a contract with you
Facilitating the credit management process	Identity Data, Contact Data, Financial Data	Legitimate Interests
Providing compensation to you where applicable and in certain circumstances	Identity Data, Contact Data, Customer Account Data, Financial Data	Performance of a contract with you
To undertake initial and ongoing credit checks where appropriate in order to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity, including exchanging information about you with Credit Reference Agencies	Identity Data, Transaction Data	Legitimate Interests
Processing and delivering orders e.g. to enter into legal contracts with you or with your organisation where you are the main contact; to facilitate energy supply, and/or perform our obligations under any contract for the supply of services we have with you	Identity Data, Contact Data, Financial Data, Transaction Data, Marketing and Communications Data, Customer Account Data	Performance of a contract with you
To issue energy bills to you and to facilitate bill payments and/or refunds and or return credit balances to you	Identity Data, Contact Data, Financial Data, Transaction Data, Customer Account Data	Performance of a contract with you
To register you with and provide you the benefit of being registered on the Priority Services and/or Special Services Registers	Identity Data, Contact Data, Special Category Data	Legitimate Interests; Substantial public interest condition “safeguarding of children and individuals at risk” for Special Category Data
To ensure your welfare and the welfare of others within the premises e.g. to ensure continuation of supply or to respond appropriately during a major incident or event. To do this, your personal data will be shared with the network operators	Identity Data, Contact Data, Special Category Data	Legitimate Interests; Substantial public interest condition “safeguarding of children and individuals at risk” for Special Category Data
To make reasonable adjustments to the information you receive from us (e.g. providing this in large print or braille) or to ensure that we meet your needs when attending an SSE event	Identity Data, Contact Data, Special Category Data	Consent; Legal obligation under the Equalities Act 2010; Explicit consent for Special Category Data
To provide you with projected and actual energy consumption data	Identity Data, Contact Data, Customer Account Data	Legitimate Interests
To apply for and obtain government funding for the supply of energy efficiency measures to you and your premises	Identity, Contact, Financial, Transaction, Special Category Data, Customer Account Data	Legitimate Interests
To enable you to login into your manage my account portal/app or any other website, portal or app relating to a service that we provide to you	Identity Data, Contact Data, Technical Data	Legitimate Interests
To create a single view of the customer where you have multiple accounts with us	Identity Data, Contact Data, Transaction Data, Financial Data, Customer Account Data, Technical Data, Marketing and Communications Data	Legitimate Interests
To recover debt owed to us by you. This includes attaching tracking pixels to our emails to understand the effectiveness of our correspondence. You can opt out to the placement of these tracking pixels at any time, contact Debt Register on 0345 070 1608	Identity Data, Contact Data, Transaction Data, Financial Data, Customer Account Data	Performance of a contract with you; Legitimate Interests
To offer and deliver competitions, discounts and prize draws	Identity Data, Contact Data, Marketing and Communications Data, Customer Account Data	Legitimate Interests

Purpose	Categories of Personal Data Used	Lawful Bases
Business Energy Customers: Data may be shared to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at http://www.experian.co.uk/crain/index.html We may take credit scoring information into account when deciding the conditions placed upon your supply, including any premium to be added or security deposit required. In the majority of cases, we will also consider other information that we hold about you, and this decision will not be fully automated. Please note that businesses that we consider to be in higher risk industries will have a premium added. Automated decision‑making applies when: Customers’ businesses are insolvent or no longer trading If your business is insolvent or no longer trading, we will automatically refuse to supply you. New connections customers with a supply larger than 23kVA For new connections with a supply larger than 23kVA, we use credit scoring information from a third‑party credit agency to determine whether a security deposit is appropriate. You may appeal automated decisions, request an explanation, or ask for human review.	Identity Data, Financial Data, Transaction Data	Legitimate Interests
Heat Networks Customers: When you become a customer of SSE Heat Networks, we will set up and share your information with Experian, one of the UK’s Credit Reference Agencies (CRAs). We’ll routinely do this: To verify the accuracy of our data held about you As part of our management of your account (credit or debt) To manage debt risk and inform debt‑prevention strategies CRAs may share this data with others to help them make informed lending decisions. The information shared with CRAs is not used by SSE Heat Networks to decide whether to supply your property.	Identity Data, Financial Data, Transaction Data	Legitimate Interests

More information is available via the Credit Reference Agency Information Notice (CRAIN) from:
TransUnion
Equifax
Experian

Purpose	Categories of Personal Data Used	Lawful Bases
To let you know about changes or updates to your service or product or to issue you with administrative messages	Identity Data, Contact Data, Customer Account Data.	Legitimate Interests Performance of a contract with you
To conduct market research, including communicating with you to obtain feedback on how we can improve our services (e.g. customer satisfaction surveys and questionnaires).	Identity Data, Contact Data, Customer Account Data.	Legitimate Interests
To deliver relevant marketing content and advertisements to you from us, other companies within the SSE Group and/or our selected third‑party partners, as notified to you from time to time.	Identity Data, Contact Data, Transaction Data, Marketing and Communications Data, Customer Account Data	Consent
To show you digital advertisements via your social media newsfeed, on search engine result pages or on other websites, unless you have asked us not to.	Technical Data	Legitimate Interests Consent (where using non‑functional cookies)
To profile your data to provide you with marketing and offers that are relevant to you. If you opt out of profiling, we may still run analysis that includes your data, but any resulting marketing output will not be used to market to you.	Identity Data, Contact Data, Marketing and Communications Data, Technical Data, Transaction Data, Profile Data, Customer Account Data.	Legitimate Interests

Purpose	Categories of Personal Data Used	Lawful Bases
To run, grow and develop our business, including to help us plan our marketing activities and develop customer insights.	Identity Data, Contact Data, Financial Data, Transaction Data, Technical Data, Profile Data, Usage Data, Marketing and Communications Data, Special Category Data, Customer Account Data	Legitimate Interests
For intra-group administrative purposes such as ensuring consistent delivery of our services to our customers or where other parts of the SSE Group provide services to SSE Energy Solutions businesses e.g. finance or marketing support	Identity Data, Contact Data, Financial Data, Transaction Data, Technical Data, Profile Data, Usage Data, Marketing and Communications Data, Customer Account Data	Legitimate Interests
To enable corporate reporting, business administration, to manage our business, to secure our facilities, and to identify and implement efficiencies and other business-related improvements	Identity Data, Contact Data, Financial Data, Transaction Data, Technical Data, Profile Data, Usage Data, Marketing and Communications Data, Special Category Data, Customer Account Data	Legitimate Interests
Detect, prevent and report crime (including anti-social behaviour), illegal or prohibited activities, fraud or loss. This includes: • receiving detail of suspected fraud or energy theft • performing fraud and energy theft checks on a regular basis • recording suspected/confirmed energy theft and sharing with fraud prevention agencies • performing anti-money laundering checks • countering terrorist financing and other illegal activities • anti-bribery and corruption requirements	Identity Data, Contact Data, Financial Data, Transaction Data, Profile Data, Usage Data, Customer Account Data, Suspected/Actual Criminal Data	Legal Obligation Legitimate Interests Article 10 – Processing of personal data relating to criminal convictions and offences Schedule 1, Part 3, paragraph 33 of the Data Protection Act 2018
To process charges in the event of damage to our equipment.	Identity Data, Contact Data, Financial Data, Transaction Data, Profile Data, Usage Data, Customer Account Data	Legitimate Interests
Training our staff and improving our products and services	Identity Data, Contact Data, Financial Data, Transaction Data, Technical Data, Profile Data, Usage Data, Marketing and Communications Data, Special Category Data, Suspected/Actual Criminal Data, Customer Account Data	Legitimate Interests
Analyse website and data usage for improvements, along with securing our network and information systems	Profile Data, Technical Data	Legitimate Interests
To ensure the health and safety of our staff and members of the public	Identity Data	Legitimate Interests
To comply with any applicable regulatory conditions, procedures and laws including where we reasonably consider it is in our (or others') legitimate interests to comply	Identity Data, Contact Data, Financial Data, Transaction Data, Customer Account Data	Legal Obligation Legitimate Interests
To establish, exercise or defend our legal rights including where we reasonably consider it is in our (or others') legitimate interests	Identity Data, Contact Data, Financial Data, Transaction Data, Technical Data, Profile Data, Usage Data, Marketing and Communications Data, Special Category Data, Suspected/Actual Criminal Data, Customer Account Data	Legal Obligation Legitimate Interests
Where we sell, merge, or perform any internal re-organisations in relation to any of our (or third party’s) business or assets	All data categories	Legitimate Interests
To analyse consumption patterns, using all available meter consumption data (monthly readings, 15‑minute or half‑hourly interval data) to develop products and services (including energy efficiency information)	Customer Account Data	Legitimate Interests
Identifying faults and where possible minimising disruption to the heat and hot water supply at sites where we run a heat network	Customer Account Data	Legitimate Interests

We will share your personal information with the following categories of third parties:

(a) Ofgem, the Energy Ombudsman and any other regulatory authority we may be subject to for the purposes of demonstrating compliance with applicable law and regulations;

(b) our third-party suppliers, partners and sub-contractors that provide, review and/or receive services for and on our behalf. This includes: payment processors; marketing support (e.g. third parties who serve advertising on their platforms on our behalf: Amazon, Viant, Facebook and Google Adwords); suppliers of technical, support and installation services; insurers; legal advisers; auditors; logistics providers; security providers; cloud services providers and via API integrators; research agencies; other energy suppliers where they carry out meter readings on our behalf and if you are entitled to claim government funding for energy efficiency measures, installers, energy performance assessors and sales advisers.

(c) other group companies in the SSE Group;

(d) authorised third parties or named account holders in addition to you; or where appropriate, family members or cohabitants, previous tenants, landlords, or letting agents who/which may require information about you or your premises, or who introduced you to SSE;

(e) Government or law enforcement agencies/officials or fraud prevention agencies or regulators, where we are under a duty to disclose your information to comply with any legal obligation or regulatory purpose, including as may be required to meet national security or law enforcement requirements or prevent illegal activity or to prove that you qualify for relevant government funded schemes;

(f) our Corporate Auditory for the purposes of demonstrating compliance with financial and regulatory frameworks;

(g) Other energy suppliers, if you choose to leave us, to assist the switching process, including energy usage and any debts on the account;

(h) relevant gas transporters, metering agents or network operators;

(i) Debt Collection Agencies, tracing agents, debt purchasers and/or legal claims firms if we provide you with a service and you fail to make payments

(j) Credit Reference Agencies – see the section “What we do with your personal information” and “Credit Reference Agencies”.

(k) Third party intermediaries, where you have engaged their services;

(l) If we sell, merge, or perform any internal re-organisations in relation to any of our (or any third party’s) business or assets, the personal information will be one of the transferred assets to the relevant buyer and/or new data controller of such business or assets.

You have the following rights regarding your personal information:

1- Right to be informed

What does this mean?

You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal data and your rights. This is why we are providing you with the information in this Privacy Notice.

2- Right of access

What does this mean?

You have the right to obtain access to your personal data (if we are processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you are aware and can check that You have the right to obtain access to your personal data (if we are processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you are aware and can check that we are using your personal data in accordance with data protection law.

3- Right to rectification

What does this mean?

You are entitled to have your personal data corrected if it is inaccurate or incomplete.

4- Right to erasure

What does this mean?

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there is no compelling reason for us to keep it. This is not a general right to erasure; there are exceptions.

5- Right to restrict processing

What does this mean?

You have rights to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data but may not use it further.

6- Right to data portability

What does this mean?

You have the right to obtain and reuse your personal data in a structured, commonly used, and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.

7- Right to object to processing

What does this mean?

You have the right to object to certain types of processing in certain circumstances. In particular, the right to object to the processing of your personal data based on our legitimate interests or on public interest grounds; the right to object to processing for direct marketing purposes (including profiling); the right to object to the use of your personal data for scientific or historical research purposes or statistical purposes in certain circumstances.

8- Right to withdraw consent

What does this mean?

If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for direct marketing.