1.1Utility Warehouse Limited and its affiliates ("Utility Warehouse", "us", and "we") respect your right to privacy. At Utility Warehouse, we look after your personal information carefully. We adhere strictly to the requirements of UK data protection law and, in accordance with current law, we are registered on the public register of data controllers which is looked after by the Information Commissioner.
1.2This Privacy Notice tells you who we are, how we collect, share and use information which identifies you ("personal information") and how you can exercise your privacy rights. This Privacy Notice applies to personal information that we collect through our website at https://www.uw.co.uk, but also to other personal information that you may provide to us when we provide you with our services or products. Please do take a moment to read this Privacy Notice so that you will understand how we use your personal information.
1.3If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the bottom of this Privacy Notice.
We recommend that you read this Privacy Notice in full to ensure you are fully informed. However, if you only want to access a particular section of this Privacy Notice, then scroll down to the relevant section.
2.1Utility Warehouse is a multi-utility supplier based in the United Kingdom. Utility Warehouse supplies gas, electricity, broadband, fixed line telephony, mobile, insurance and boiler servicing and financing services (and other similar utility or household services) to individuals and businesses.
2.2For more information about Utility Warehouse, please see the "About us" section of our Website at https://uw.co.uk/about-us
3.1There are lots of 'touch points' where you may provide data to us voluntarily or where it is collected automatically. Given the number of services we offer, what data we collect from you depends on which you select. Types of personal data we typically collect at different touch points includes:
we may collect certain information automatically from your device. For example, your IP address, device type, unique device identification numbers, browser type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed, links clicked, and information gathered by our cookies.
For more information about our websites and cookies, see section 7, 'Cookies and similar tracking technology'.
your name, gender, date of birth, billing/delivery/supply address, orders and receipts, email, telephone number and a record of the products and services that you take from us. For your security, we'll also keep a record of your direct debit details (Card information is collected in a PCI compliant manner and is stored securely by a third-party payment processor, not by us).
Energy (gas & electricity) service: we process energy usage information, such as amounts and times of energy consumption.
Mobile service: we process call data records, such as who contacted you, who you contacted, when the contact took place, the duration and your location when you used your mobile device. Similar information is recorded for data consumption while using your mobile device.
Phone and broadband service: your call data records, such as who contacted you, who you contacted, when the contact took place, and call duration.
Insurance products (including buildings, contents, legal expense, home emergency, bill protector): we process data required to rate the risk of the insurance product you select. For example, about your house and household (e.g. number of occupants), of joint policy holders' possessions, claims history and personal sensitive data such as criminal convictions and County Court Judgments and details. For more information on how we handle personal sensitive data, please see section 3.1.1 below.
the content of your communications with us, including emails, letters, webchats and phone calls. When we call you or you call our call centre, we will record any telephone calls that we have with you, to make sure that we are providing you with a good service and meeting all our regulatory and legal responsibilities.
information about your home network, meter or usage patterns in order to fix the fault.
3.1.1Sensitive Personal Data: some of the personal information that you provide to us may include sensitive personal information, such as health-related information or information about your race or ethnicity. You may provide this information to us voluntarily, for example during communications relating to customer account management. If we need to collect sensitive personal information from you, we will obtain your consent (or otherwise let you know our relevant legal grounds for collecting this information), at the point when we ask you to provide this information.
Additionally, we may be required to collect sensitive information (such as criminal records) if you apply for our insurance products, we will let you know our relevant legal grounds for collecting this information, at the point when we ask you to provide this information.
3.1.2Data received from third parties: sometimes we will collect personal information from third parties. For example, gathering your energy supply numbers from third parties, validating and verifying your bank account and validating your credit history with a credit reference agency. We use the information we receive from these third parties to provide you with our services and products, as otherwise necessary for our legitimate business reasons (for example, to verify that you are a suitable customer and that a direct debit can be taken from the bank account details provided to us), or to comply with law.
3.1.3If you require more information on what we collect, how we handle sensitive personal data or what data we collect from third parties, please go to section 15, which shows you how to get in touch with us.
Most commonly, we need personal information for one of four reasons: (1) to perform a contract; (2) where it is in our legitimate interests to do so; (3) where it is required to comply with legal or regulatory obligations; and (4) where you have provided your consent.
To understand more about these legal grounds for processing your personal data, please see section 6, 'Legal basis for processing personal information'
4.1Where we use your personal data to carry our our contract(s) and provide products or services to you, if you don't give us the correct information, we might not be able to provide you with the product or service(s) you ordered from us. We need your personal information in order to do the following:
(when we do this, we still control your personal information and we have strict controls in place to make sure it's properly protected, see section 5 'Who does Utility Warehouse share my personal information with?');
4.2We may also use this information for legitimate business purposes, such as:
We will tell you at the point of collection when we use your personal data for legitimate interest purposes (for more information see section 6, 'Legal basis for processing personal information').
4.3We are a responsible supplier and we are required to comply with certain legal and regulatory obligations. One example of this is if you are a vulnerable customer.
If you tell us you have a disability or otherwise need support, we'll note that you are a vulnerable customer, but only if you give you permission or if we have to for legal or regulatory reasons. For example, if you told us about a disability we need to be aware of when we deliver our services to you, we have to record that information so we don't repeatedly ask you about it. We will also record the details of a Power of Attorney we have been asked to log against your account.
For more information about out regulatory and legal use of personal data, see section 5 'Who does Utility Warehouse share my personal information with?'
5.1We may disclose your personal information to the following categories of recipients:
6.1The law on data protection sets out a number of different reasons for which a company may collect and process your personal data. Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it, including:
In specific situations, we can collect and process your data with your consent. For example, when you tick a box to consent to enable one of our apps to use your location data from your mobile phone.
When collecting your personal data, we'll always make it clear to you which data is necessary in connection with a particular service.
In certain circumstances, we need your personal data to comply with our contractual obligations. For example, if we contract to provide you with energy, we'll need to collect your name and home address details in order to provide you with energy at the correct address. However, we will normally collect personal information from you only where we need that personal information to perform a contract with you.
If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud to law enforcement agencies.
Sometimes, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.
We carry out the following activities on the basis of legitimate interest:
6.6If you have questions about, or need further information concerning, the legal basis on which we collect and use your personal information, please contact us using the contact details provided in section 15, 'How to contact us'.
8.1We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level or security appropriate to the risk of processing your personal information.
8.2We check your identity when you get in touch with us, and we follow our security procedures and apply suitable technical measures, such as encryption, to protect your information.
8.3Specific measures we use include:
a.Implementing design principles within our infrastructure (e.g. use of DMZ and firewalls);
b.adopting security safeguards against attacks (e.g. internal and external monitoring of network traffic use and carrying out regular penetration tests); and
c.security policies which provide working guidelines to our staff as well as enforce controls and procedures in line with data protection law and other industry-specific complicance requirements.
9.1Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).
9.2Specifically, whilst we operate predominantly in the United Kingdom, our third party service providers and partners operate around the world. This means that when we collect your personal information we may process it in any of these countries.
9.3However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. We have implemented similar appropriate safeguards with our third party service providers (for example, the European Commission's Standard Contractual Clauses) and further details can be provided upon request.
10.1We retain personal information we collect from you only for as long as is necessary for the purpose for which it was collected. In most cases, we will keep your personal information while you're one of our customers, and for seven years after. In other cases we'll store personal information for the periods needed for the purposes for which the information was collected or for which it is to be further processed. And sometimes we'll keep it for longer if we need to by law.
10.2At the end of the retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.
11.1In some instances, our use of your personal information may result in automated decisions being taken (including profiling) that legally affect you or similarly significantly affect you.
11.2Automated decisions mean that a decision concerning you is made automatically on the basis of a computer determination (using software algorithms), without our human review. For example, we may use automated decisions to analyse your credit worthiness and verify your identity when we process your application for certain products and services.
11.3When we make an automated decision about you, you have the right to contest the decision, to express your point of view, and to require a human review of the decision. You can exercise this right by contacting us using the contact details provided under the How to contact us heading below.
12.1You may have the following data protection rights:
12.2We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
13.1We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by data protection law.
13.2You can see when this Privacy Notice was last updated by checking the "last updated" date displayed at the top of this Privacy Notice.
14.1Please be aware that our site may provide access to other websites by linking to them. We are not responsible for the data policies (including data protection and cookies), content or security of these linked web sites.
15.1If you have any questions or concerns about our use of your personal information, please contact our data protection officer using the following details: [email protected]
15.2The data controller of your personal information is Utility Warehouse Limited, which is registered with the ICO with registration number ZA243042.