About us
We are SSE plc (SC117119) of Inveralmond House, 200 Dunkeld Road, Perth, Perthshire, PH1 3AQ.
We use your information as further explained in this Privacy Notice. We’ll be the “controller” of the information you provide to us.
In addition to SSE plc, for the specific business areas outlined below, the SSE companies listed below will also be controllers of your personal information. We also enter into Joint Ventures with our partners. From time to time, personal data will be shared between and processed by the Joint Venture company, us and the partner company. For further details, see the Joint Venture section below:
Personal Information we collect about you
The personal information we collect, store and use about you have been grouped together as:
| Category | Types of Personal Data included within the Category |
| Identity Data | Information which can identify an individual, including but not limited to first name, last name, any previous names, username, customer id, account number or similar identifier, marital status, title, date of birth, gender, photographs, voice recordings, images, video footage, CCTV footage, vehicle registration numbers |
| Contact Data | address, phone number, email address, billing address, social media handle and profile |
| Community Fund Data | Business plans, copy of organisation constitution, academic achievements, AGM minutes, financial accounts, bank statements, Student Loan award letters, University/College admission acceptance letters |
| Financial Data | bank account, credit history, grant application details, payment card details (where applicable), payment identifiers, voucher codes |
| Transaction Data | details about payments to and from you, details of products and services you have purchased or use, information about other third-party supplier’s electricity and/or gas accounts held by you |
| Technical Data | internet protocol (IP) address, login data (username and passwords), browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices used to access websites and/or apps, approximate geolocation |
| Profile Data | purchases or orders made by a data subject, data subject's interests, feedback and survey responses |
| Usage Data | information about how a data subject interacts with and uses our websites, products and services |
| Marketing and Communications Data | preferences for receiving marketing from us and/or related/selected third parties and your communication preferences |
Special Category Data | Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation |
| Suspected/Actual Criminal Data | Fraud or theft of energy, meter tampering, convictions, fines, details of incidents, records, any investigation carried out in relation to an allegation or suspicion. |
| Customer Account Data | supply address, consumption/energy usage, smart meter data, meter point administration number (MPAN), Meter or Gas Point Reference Number (GPRN (ROI) or MPRN (UK), SMPN (NI)), property ownership/rental and occupation, off supply notifications, new connection requests, secondary contact details, billing preferences, priority service registration code and code expiry date. |
What we do with your personal information
Receiving your personal information
Most of the personal data we receive will be collected directly from you. From time to time, we may also receive your personal data from:-
- Your employer;
- Our Joint Venture Partners;
- Council and Local Authorities;
- Other SSE group companies ;
- Other energy suppliers;
- Credit reference or fraud prevention agencies; and
- Debt collection agencies
Sharing your personal information
We may share your personal data with:
- External third parties – such as third-party suppliers where these carry out work on our behalf or provide services to us (including but not limited to payment providers, payment system companies, technology providers), banks and debt collection agencies.
Our Joint Venture partners;
- Regulatory authorities (including Ofgem and the Planning Inspectorate /other relevant planning authorities) to whom we may be subject to for the purposes of demonstrating compliance with applicable law, financial and regulatory frameworks;
- “Competent Authorities” e.g., including but not limited to Police, Government Authorities and/or the Health and Safety Executive (HSE) as part of an investigation being carried out;
- Our Corporate Auditors for the purposes of demonstrating compliance with financial and regulatory frameworks;
- Other SSE group companies for the purposes of account administration, payment management and strategy development; and where they provide a service to us;
- Such organisations and individuals may include the community advisory panel, local authority or an organisation employed by SSE to evaluate grant applications. We may also share information with other organisations providing matched funding.
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach.
International Data Transfers outside of the European Economic Area (EEA)/UK
We, or a third party who we share personal information with, may transfer, host, store and/or handle your personal information outside of the EEA. For example, where we and/or our service providers (including servers) are based outside of the EEA.
The EEA consists of countries in the European Union, Iceland, Liechtenstein, and Norway and are all considered to have equivalent laws in data protection and privacy. The UK including Northern Ireland, are also considered to have equivalent laws in data protection and privacy.
We will only permit the transfer of your personal data to a country outside of the EEA/UK to happen if adequate safeguards have been put in place to protect your personal information. For countries outside the UK, this means that we will:
- ensure that the country in which your personal information will be handled has been deemed “adequate” by the European Commission under Article 45 of the General Data Protection Regulation (GDPR); or
- include standard data protection clauses approved by the European Commission for transferring personal information outside the EEA and the UK into our contracts with those third parties (these are the clauses approved under Article 46.2 of the GDPR); or
- Where an appropriate derogation as set out in Article 49 of the GDPR applies; or
- Where the EU-US Data Privacy Framework and/or the UK Extension to the EU-US Data Privacy Framework arrangements apply.
How long we hold your personal information
We will keep your information only for as long as necessary depending on the purpose for which it was provided.
When determining the relevant retention periods, we will consider factors including:
- legal obligation(s) under applicable law to retain data for a certain period of time;
- (potential) disputes; and
- guidelines issued by relevant data protection authorities.
Otherwise, we securely erase your information once this is no longer needed.
Your rights
You have the following rights regarding your information:
Right to be informed
You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal data and your rights. This is why we are providing you with the information in this Privacy Notice.
Right of access
You have the right to obtain access to your personal data (if we are processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you are aware and can check that we are using your personal data in accordance with data protection law.
Right to rectification
You are entitled to have your personal data corrected if it is inaccurate or incomplete.
Right to erasure
This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there is no compelling reason for us to keep it. This is not a general right to erasure; there are exceptions.
Right to restrict processing
You have rights to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data but may not use it further.
Right to data portability
You have the right to obtain and reuse your personal data in a structured, commonly used, and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.
Right to object to processing
You have the right to object to certain types of processing in certain circumstances. In particular, the right to object to the processing of your personal data based on our legitimate interests or on public interest grounds; the right to object to processing for direct marketing purposes (including profiling); the right to object to the use of your personal data for scientific or historical research purposes or statistical purposes in certain circumstances.
Right to withdraw consent
If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for direct marketing.
For more information on your rights or if you would like to exercise any of your rights, you are welcome to get in touch using the details in the “Contacting Us” section below.
Contacting us
If you would like to contact us in relation to your rights or if you are unhappy with how we’ve handled your information, you may contact us by sending an email to:
For SSE Thermal Companies to: thermaldps@sse.com
For SSE Renewables Companies to: renewablesdps@sse.com.
If you would like to contact our Data Protection Officer, you may do so using the following details:
Email: GroupDPO@sse.com
Address: Data Protection Officer, No. 1 Forbury Place, 43 Forbury Road, Reading, RG1 3JH
If you are not satisfied with our response to any complaint or believe our processing of your information does not comply with data protection law, you can make a complaint to the relevant Data Protection Office:
For data subjects in the Republic of Ireland | |
Data Protection Commissioner, | Data Protection Commissioner |
For data subjects in the UK | |
Information Commissioner’s Office, |
|
For data subjects in Japan | |
Personal Information Protection Commission |
|
Cookie policy
