Opus Energy Group and Haven Power Limited Customer Privacy Notice

This document (together with our contractual terms with you) sets out how the Opus Energy Group and Haven Power Limited use, sometimes jointly, personal information about prospective, current and past customers.

Opus Energy Group Limited is made up of different legal entities, including Opus Energy Limited, Opus Energy (Corporate) Limited, Opus Gas Supply Limited, Donnington Energy Limited, Farmoor Energy Limited, Abbott Debt Recovery Limited and Opus Energy Renewables Limited (the “Opus Energy Group”). This privacy notice is issued on behalf of the Opus Energy Group and an associated group company, Haven Power Limited.  So, when we mention “Opus Energy”, “Haven Power”, “we”, “us” or “our” in this privacy notice, we are referring to the relevant company in the Opus Energy Group or Haven Power Limited who are all part of the Drax group of companies and are responsible for processing your personal data.

Opus Energy and Haven Power provide energy and related products and services to the business community. Our collection of personal data is therefore limited to the personal information of individuals representing our customers that will enable us to manage our commercial relationship with you, as explained further in this notice. You will have entered into a contract with either Haven Power or Opus Energy but within the Drax group of companies, each company is working together to align systems and processes to better serve you as a customer, which means you will be offered a more efficient and cost effective service.

This notice only applies to our use of “personal data” about “data subjects” (as defined by data protection law and called personal information in this notice) which includes personal information relating to our prospective, current and past customers who are sole traders or non-limited partnerships, and contacts at corporate customers (“you” or “your”). This notice does not apply to information which you provide to us or which we collect about corporations (e.g. limited companies).

We will be the joint data controllers of your personal information which you provide to us or which is collected by us from you or third parties, such as your broker, if you have one. This means that we are responsible for deciding how we hold and use personal information about you and that we are required to notify you of the information contained in this notice. It is important that you read this notice so that you are aware of how and why we are using such information and how we will treat it.

The information which you provide to us may include information about other individuals who are associated with the management of your business, the administration of your account with us or, contacts within your business. If you provide us with information about such individuals, it is important that you provide them with a copy of this notice prior to providing us with the information and that you provide them with any updated notices we provide from time to time.

We will collect various types of personal information from you. Further details of how we use your personal information are set out below.

In the section below, we have indicated with asterisks whether we need to process your personal information:

• * to enter into and/or to perform a contract with you;
• ** to pursue our legitimate interests, provided that your interests and fundamental rights do not override those interests;
• *** to enable us to comply with our legal obligations; and/or
• **** with your consent.

Making an enquiry about Energy Services Products

• First name and last name
• Telephone number
• Email address
• How you would like us to contact you
• The products and services you are interested in

Providing you with a Quote

When you or your broker request a quote from us via our website, by email, or telephone, we will need to collect the following information about you to allow us to provide that quote**:

• First and last name;
• Business name;
• Full address of your business;
• Site location addresses;
• Email address;
• Telephone number;
• Meter point administration number (MPAN);
• Meter point reference number (MPRN);
• How much electricity and/or gas you use – you can provide this in pounds or kilowatts per year/6-monthly/quarterly/monthly; and
• What time of day is best to call you.

We will not be able to provide a quote to you or make contact with you unless you provide the information shown in bold above. If you do not wish to proceed after receiving your quote from us, we will delete your personal information. 

Electricity Central Online Enquiry Service – ECOES

As we prepare your quote for the supply of energy, we will use your MPAN o check the ECOES database (managed by Gemserv Limited) to determine what type of meter you are using.  This will help us to provide an accurate quote to you.

Gas Data Enquiry Service – DES

As above, we will also use your MPRN to check the DES database (managed by Xoserve Limited).

Onboarding you as an Energy Supply Customer

If you join us as an energy supply customer, we will need to collect the following additional information about you to allow us to complete the customer onboarding process (including verifying your identity and carrying out a credit check)* and to provide to you the products or services you have requested from us*:

• Personal details – title, name, phone number, email address, time at address;
• Job title (where you are acting on behalf of a limited company);
• Date of birth (of sole traders and partners – for credit checking (see below));
• Domestic address(es) (of sole traders and partners – for credit checking (see below));
• Contact / billing address;
• Business bank account details.

If it is required in order to take over your energy supply, we may ask your previous energy supplier for information about you, including information about your metering equipment, meter readings and any charges you may owe your previous supplier*.

Onboarding you as an Energy Services Customer

If you express an interest in any of our energy services products, i.e. electric vehicle related products or other electric assets, we will require details of your current energy consumption and supplier, if you are not one of our customers and details relating to the sites where products we supply will be installed*.

Managing your Account

Whilst you are our customer, we will collect the following information to allow us to manage your account*, analyse and monitor your energy consumption for billing and advice provision purposes*/** and continue to provide the products or services you have requested from us*:

• Meter consumption data, including half-hourly data from smart meters;
• Information about the operation of your account;
• Usage of our websites and online portals; and
• Details of which country you are making a card payment from.

We may also continue to carry out credit checks on you whilst you have an account with us for the purpose of making credit decisions about you in order to administer your account** (see the Credit Checking section below).

Whilst you are with us as a customer and you advise us of any personal data relating to your health (i.e. you wish to be treated as a ‘vulnerable customer’), we will only process that data with your explicit consent.****

If you have purchased an energy services product from us, we may also collect the following information from you if you are experiencing any issues:

• Details of the ChargePoint that is faulty
• Details of the ChargePoint card that is faulty
• Details of telematics devices that is faulty

Recording and Monitoring

We will record and monitor communications with you by telephone for the purposes of quality assurance, our mutual protection, staff training, improving our customer service, fraud detection, compliance with our regulatory requirements and, if you are a customer, administering your account*/**/***.

Credit Checking of Energy Supply and Service Customers

During the energy supply energy service customer onboarding process and whilst you have an account with us, we may use the above personal information to search the files of credit reference and fraud prevention agencies for the purposes of making decisions about your customer account, assessing your creditworthiness and product suitability, checking your identity, managing your account, tracing and recovering debts and preventing criminal activity**/***.

Credit Reference Agencies (“CRAs”) collect and maintain information about credit behaviour. This includes data sourced from the Electoral Register, fraud prevention, and credit information – including details of previous credit applications and your payment history – and public information such as County Court Judgements, and bankruptcies. CRAs will give us information about you such as your financial history.

When a credit check is carried out on you, your credit records will be searched, along with any financially associated individuals such as your spouse or partner when you are a sole trader. The CRA will keep a record of this search and place a “footprint” on your credit file.

The information we provide to credit reference agencies about you, such as your payment history, details of false or inaccurate information provided by you, or if we suspect fraud, may be provided to other organisations and used by them to:

• help make decisions, for example when managing credit and credit-related accounts or facilities;
• detect and prevent crime, fraud and money laundering;
• check your credit history;
• verify your identity;
• trace your whereabouts; and
• undertake research, statistical analysis and systems testing.

We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time.  CRAs will share your information with other organisations. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at https://www.experian.co.uk/crain/index.html

Theft Risk Assessment Service

In order to facilitate the prevention, detection and any subsequent investigation of energy theft, all UK energy suppliers are required by law to provide information about their energy supply customers and the results of theft investigations to a central database, managed by a fraud prevention agency on behalf of the energy industry. This project is known as the Theft Risk Assessment Service (“TRAS”).

If we suspect or can confirm that you are involved with any cases of fraud or energy theft, we will record this information and share it with TRAS***. The information that we provide to TRAS will be linked to other information which the fraud prevention agency holds, including information provided by other energy suppliers. This information may be provided to other UK energy suppliers with whom you have an account to help them investigate and prevent the theft of energy. Equally, TRAS may provide information provided by other energy suppliers to us to help us identify potential fraud or theft of energy.

We may use such information to make decisions about you, including the products and services that we offer to you and the terms and conditions on which those products and services are made available to you.

The information provided to or by TRAS will not be used for any other purpose, unless required or permitted by law.

Other uses of your Information

We may also use your personal information in the following ways:

• to allow you to access your information directly through our portals*;
• to provide details of electric vehicle usage, including location data*/****;
• to provide details of electric vehicle ChargePoint usage*;
• to recommend ways in which you can reduce energy costs*/**;
• to carry out market research**;
• to manage and provide any rewards and offers and administer any promotions, competitions and surveys**/****;
• to provide you with information about other products and services that we, as the Drax group of companies, offer or which we feel may be of interest to you, where permitted by law including via our social media and digital campaigns**/****;
• to provide you with the opportunity to purchase other products and services offered by carefully selected companies who we are partnered with****;
• to promote the uptake of smart meter installation**/***;
• to investigate, detect and prevent fraud, energy theft and any other crimes**/***;
• to create statistics and analyse customer profiles to develop and improve our products and services as well as forecast consumption and behaviour of new and existing customers**;
• analyse consumption by customer to detect anomalies so we can:
  • notify customers about safety concerns like consumption spikes or baseload shifts (shifts in energy made available)
  • spot Change of Tenancy and faulty meters as early as possible*
• to carry out testing of our IT systems to develop and improve our systems**;
• to respond to consultations and requests for information from industry and government bodies, including the energy regulator**/***; and
• to carry out any work required by our regulators**/***;
• for debt collection purposes**
• to invite you to re-join us for your energy supply**.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will usually notify you and we will explain the legal basis which allows us to do so.

We may share your personal information with the third parties set out below for the purposes described above:

• if you have appointed a broker, or other third-party intermediary to conduct business with us on your behalf, we will share your account information with them to enable them to give you informed advice and may share information with them if a direct debit on your account is not in operation. Furthermore, if your account is in arrears, we may share data with your broker to assist us in managing debt*;
• if you are an energy services customer, we will share your personal information with our carefully selected installers and the partners we work with to provide products and services to you*;
• if you have consented, we will share your personal information with third parties who may be able to offer non-energy related products and services to you, for example, insurance and other financial products****;
• we may share your information with third parties so we can enhance the data we already hold to ensure we have your most up to date contact information*
• we may share your consumption data with third parties to prevent; power disruptions and improve network reliability**;
• service providers (generally based in the UK) such as those who provide IT and system administration services or support us in the installation and maintenance of your energy meters (meter operator agents, meter asset providers, meter asset managers, data retrievers, meter read agents, data collectors, data aggregators and revenue protection agents) or delivery of any of our marketing materials to you (marketing agencies) or provide us with market research services or tracing and debt collection services*/**/***;
• other companies in the Drax group of companies such as Drax Corporate Limited or Drax Power Limited (based in the UK) who provide financial services, HR support, security, IT and system administration services and undertake management reporting and statistical analysis of our customers to improve our product and service offering*/**;
• if you move your supply to another company within our Drax group of companies, we may share your data with them so they can understand your consumption history, preferred payment method, to ensure they offer you the right products and services, to enable faster switching and improve your customer journey**;
• if we are under a duty to disclose or share your personal information in order to comply with any legal obligation), requirement of our regulators (including Ofgem), industry code, or in order to enforce or apply our contract with you***;
• if you decide to transfer your energy supply to another supplier, in which case we may provide that supplier with the information required to take over your supply of energy, including information about your metering equipment, meter readings and any outstanding debt to us***;
• in the event that we transfer, sell or buy any business or assets, in which case we may (where relevant) disclose your personal information to the prospective seller or buyer*;
• if we, or substantially all of our assets, are acquired by a third party, in which case personal information held by us will be one of the transferred assets*; and
• to protect the rights, property or safety of us, our customers and others. This includes exchanging information with other organisations such as credit reference, fraud and theft prevention agencies for the purposes of reducing credit risk, fraud and energy theft**.

We require all service providers and Drax group companies that we share your personal information with to respect the privacy and security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers, including Drax group companies, to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

Most of the personal information we collect about you is based in the United Kingdom or in some cases, a service provider or their sub-processor may be based elsewhere in the European Union (EU) and so, they are required to comply with European data protection law. On occasion, we may appoint a third-party service provider whose operation or a server or sub-processor may be based outside of the EU. As part of our Vendor Management Policy, we carry out due diligence on our third-party providers and assess whether your personal information will be transferred to them or accessed by them from outside the EU. If that is the case, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• we will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information by the European Commission [1]; or
• where we use providers based in the US, we may transfer personal information to them if they are part of the Privacy Shield which requires them to provide similar protection to personal information shared between the EU and the US. You can view certifications at www.privacyshield.gov [2]; or
• where we use certain service providers who are not in a ‘adequate’ country or part of the Privacy Shield, we may use specific contracts approved by the European Commission which give personal information the same protection it has in the EU, called an EU Model Clause Agreement [3].

If you would like to know the specific mechanism used by us when transferring your personal information out of the EU, please contact us using the details set out in the “Contacting Us” section at the end of this Notice. 

We will only keep your personal information for as long as necessary to fulfil the relevant purpose(s) we collected it for, as set out above in this notice, and for as long as we are required to keep it for legal purposes.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

For example, by law, we must keep basic information about our customers (including contact, identity, financial and transactional data) for six years after they cease being customers for tax purposes.

In some circumstances:

• you can ask us to delete your personal information, see “Your Rights” below for further details; and
• we may anonymise your personal information (so that it can no-longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know that information. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator where appropriate.

Data protection laws provide you with the following rights where we are processing your personal information (but not in respect of information about a corporation); to:

• request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
• request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
• request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);
• request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
• request a copy of your personal information which you have provided to us, in a structured, commonly used and machine-readable format and the right to transfer it, or to require us to transfer it directly, to another controller; and
• request a review of a decision made based on your profile, or request a review of a machine-made decision, for example a credit check.

You also have the “right to object” to the processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights above). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

You have the right to make a complaint at any time to the data protection regulator, the Information Commissioner’s Office (ICO). The ICO can be contacted by telephone on 0303 123 1113 or by post as follows: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or via email at [email protected]. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance using any of the details set out below in the “Contacting Us” section.

Any changes we make to our notice in the future will be posted on our website and, where appropriate, notified to you in writing.

If you wish to submit an individual rights request or complaint, or you are a law enforcement or government organisation wishing to make an enquiry, please visit our secure portal.

Updated: September 2020