We collect the following personal data about you:

• Name, Address, Telephone Number and Email Address
• Payment Details including bank details
• When using our website, your IP address, location information and browsing information
• Your preferences for communications e.g. by telephone, fax, SMS, email or post
• Details of your participation in surveys
• Details of your interactions with us on social media
• Details of any vulnerabilities so we can adapt our services appropriately
• If you contact us by telephone, we may record the call for training and service improvement purposes, and make notes in relation to your call.

We may enhance personal information we collect from you with information we obtain from third parties that are entitled to share that information, for example, credit agencies, search information providers and / or public sources. We may also be provided with information about you by a previous tenant, or a third-party intermediary (TPI) who is authorised to act on your behalf. As an Energy Service Company, MEESUK Ltd works closely with third parties, sub-contractors and other regulatory bodies.

We need to know your basic personal data to be able to supply your business with energy efficiency Services and maintain and operate our energy efficiency assets. In particular, we need to know your basic personal data to provide our services to you, direct any customer enquiries to the correct MEESUK Ltd support team, to allow our engineers to support you on-site and to communicate and conduct business with you. We may also collect specific information in order to enter into legal contracts with you.

In order to process and use your personal information lawfully, we rely on the following legal bases:

• For the performance of a contract with you for provision of our products and/or services or to take steps at your request prior to entering into such a contract
• To comply with our legal obligations
• For our legitimate interests in ensuring effective operational management and internal administration, document retention/storage, compliance with regulatory guidance, exercise or defence of legal claims, service improvement and communicating with you
• Consent (where we market to you via email or SMS, or where we store vulnerable information)

The personal data is processed by our staff to:

• Provide, maintain, adapt, protect and improve any products and services you have requested from us
• Perform our obligations under any contract for the supply of services we have with you
• Manage our relationship with you through customer services and support activities
• Provide you with any information that we are required to send you in accordance with our regulatory or legal obligations
• Detect, prevent, investigate or remediate, crime, illegal or prohibited activities or to otherwise protect our legal rights, including liaison with regulators and law enforcement agencies, etc.
• Communicate with you by telephone, mail, email or other electronic means and obtain feedback on how we can improve our services
• Monitor, measure, improve and protect the content or our websites and services to provide enhanced and personal user experience for you
• Deliver targeted advertising, marketing or information to you which may be useful to you, based on your use of our services
• Compare information for accuracy and to verify it with third parties, for example credit reference agencies
• Deliver joint content and services with third parties with whom you have a separate relationship

We may share your information with:

• Our sub-contractors for the purposes of carrying out work on our behalf
• Our service providers for the purposes of providing services to us
• Other Packaged Group companies for the purposes of account administration, payment management and strategy development
• Third party intermediaries, where you have engaged their services
• Debt collection agencies for the purposes of debt management

We may also use aggregate information and statistics in order to help us develop our services and may provide such aggregate information to third parties. These statistics will not include information that can be used to identify any individual.

Unless you’ve asked us not to, we may contact you in writing, by phone and (where you have consented) via email or SMS with information on products, services and rewards that we, other companies within the SSE group, and occasionally our carefully selected partners identified at the time we collect your information, offer. We may use third parties to send marketing communications.

Unless you have asked us not to, we may also use your email address to show you digital advertisements via search engine results pages or on other websites.

Unless you have asked us not to, we may profile your data to provide you with marketing and offers that are relevant to you. If you opt out of profiling we will still run analysis that includes your data, but any decisions or marketing output that result from that analysis will not be used to market to you. You will be sent generic marketing that may not be relevant to you.

Where you partially complete and/or abandon any information inputted into our website and/or other online forms we may use this information to contact you to remind you to complete any outstanding information and/or for marketing purposes.

To opt out of receiving marketing messages, or to object to our use of profiling for direct marketing purposes, please contact us at any time verbally, by email or in writing using the details in the “Contacting Us” section below.

We will keep your information only for as long as necessary depending on the purpose for which it was provided.

When determining the relevant retention periods, we will take into account factors including:

• legal obligation(s) under applicable law to retain data for a certain period of time
• (potential) disputes
• guidelines issued by relevant data protection authorities

Otherwise, we securely erase your information once this is no longer needed.

We may supply your personal information to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at http://www.experian.co.uk/crain/index.html

We may take credit scoring information into account when deciding the conditions placed upon your contract. In the majority of cases, we will also consider other information that we hold about you, and this decision will not be fully automated. Please note that businesses that we consider to be in higher risk industries will have a premium added.

We use automated decision-making to determine the conditions upon which we supply you in the following circumstances:

• Customers whose businesses are insolvent or no longer trading

If your business is insolvent or no longer trading, we will automatically refuse to supply you.

You can appeal any automated decision, receive an explanation of the decision or require human review of the decision by getting in touch using the details in the “Contacting Us” section below.

We, or a third party who we share personal information with, may host, store and handle that personal information outside of the European Economic Area (EEA).

We will only permit this to happen if adequate safeguards have been put in place to protect your personal information. This means that we will:

• Ensure that the country in which your personal information will be handled has been deemed “adequate” by the European Commission under Article 45 of the General Data Protection Regulation (GDPR)
• Include standard data protection clauses approved by the European Commission for transferring personal information outside the EEA into our contracts with those third parties (these are the clauses approved under Article 46.2 of the GDPR)
• (in the case of transfers from the EEA to the USA), ensure that the recipient of the personal information has certified with the US-EU Privacy Shield Framework, as permitted by Article 46.2 of the GPDR

You have the following rights regarding your information:

For more information on your rights or if you would like to exercise any of your rights, you are welcome to get in touch using the details in the “Contacting Us” section below.

If you would like to contact us in relation to your rights or if you are unhappy with how we’ve handled your information, you may contact us by sending an email sara.huber@meesuk.co.uk

If you would like to contact our data protection officer, you may do so by contacting them at:

Email: sara.huber@meesuk.co.uk
Phone: +44 (0) 20 7959 3066
Postal: Data Protection Officer, MEESUK Ltd, The Pinnacle, 160 Midsummer Boulevard, Milton Keynes, MK9 1FF

If you’re not satisfied with our response to any complaint or believe our processing of your information does not comply with data protection law, you can make a complaint to the Information Commissioner’s Office (ICO) using the following details:

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone number: +44 (0) 303 123 1113
Website: www.ico.org.uk