This privacy notice describes how SP Energy Networks ("SPEN") (which includes SP Distribution plc (company number SC189125), SP Manweb plc (company number 02366937), and SP Transmission plc (company number SC189126) processes your personal data in connection with its business activities.

In this Policy, references to "we", "us", and "our" (and other similar terms) means SPEN and "you" and "your" (and other similar terms) mean our customers, contacts, suppliers and website visitors.

What personal data does SPEN collect and process? 

The categories of personal data we collect will depend on the nature of your relationship with SPEN but could include:

1.  Contact details, including name, address, telephone number(s), email address social media data
2.  The meter point administration number (“MPAN”) associated with your property, which is used to identify your electricity supply point;
3.  Financial details in circumstances where you pay us to provide a service to you or you receive payment from us;
4.  Details needed in order to design and install a connection to our electricity distribution network that you have requested us to make to your property;
5. Any health/medical condition or other specific circumstances e.g. children under the age of five, which would entitle you to receive any of our Extra Help Support Services or be added to our Priority Services Register (PSR)
6. Any additional data which would allow us to deal with your query or resolve your issue more efficiently. This would include but is not limited to any nominated contact, the nature of support required or site-specific details.

How do we collect your data?

Data may be collected from one, or all of the following sources:

• directly from you through the completing of forms (either paper or on our website), via telephone calls, emails or any other method of communication we may have with you
• from another individual – they may provide us with your personal data for the purpose of you acting as a nominated contact, co-owner, next of kin etc. They are responsible for ensuring they have your permission to provide this data
• from third parties - we may also receive personal data about you from third parties, including your electricity supplier.
• from social media platforms, including but not limited to Twitter, Facebook and Instagram.

Legal basis for processing

In order for us to process your personal data lawfully and in accordance with the legislation, we rely on the following legal bases:

• the performance of a contract – the processing is necessary for a contract you have with SPEN
• legal obligation – the processing is necessary for SPEN to comply with the Law
• vital interests – the processing of data is necessary to protect someone’s life
• legitimate interests – the processing is necessary for your legitimate interests or the legitimate interest of SPEN, unless there is a good reason to protect the personal data of an individual which overrides those legitimate interests
• consent – you have provided explicit consent for SPEN to process your personal data. This consent can be withdrawn at any time.
• public task – the processing is necessary for SPEN to perform a task in the public interest

Purpose of data processing

Your personal data may be processed for the following purposes (depending on the nature of your relationship with SPEN):

• Customer management - if you contact us with a query, issue or complaint (for example a planned or unplanned power cut, damage to equipment etc.
• Service partners – if you contact us with a land owner or service partner query, issue or complaint
• In relation to our Priority Services Register or other Extra Help Support Service
• Compliance with laws, regulation and obligations from regulatory bodies e.g. OFGEM

Who do we share your Personal Data with?

Your personal data may be shared with the following:

• consultants, suppliers and contractors who we engage with to help us provide specific services and support. Only personal data required to perform these services will be shared and this may include special category data. Agreements are in place with these third parties to protect the personal data of individuals and to restrict them from using any personal data other than as stated by SPEN. We will not pass any personal data collected to third parties for marketing purposes. Examples include companies we engage with to maintain and repair equipment and debt collection agencies in instances of non-payment.
• the energy regulator OFGEM when required under our license agreement or requested for a specific purpose. Appropriate measures will be taken to provide only the personal data which is required for the purpose and to provide this data securely
• another member of our group, meaning subsidiaries, our holding company and its subsidiaries
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or terms and conditions of supply and other agreements; or to protect the rights, property, or safety of SPEN our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction. Examples of this include Local Authorities, emergency services, Citizens Advice Bureau, Complaints Ombudsman and National Grid. Please note this is not an exhaustive list.
• Emergency Planning Officers (EPO’s) – data may be shared under certain circumstances with EPO’s for example in preparation for, or in reaction to, a storm
• MP’s/Members of Scottish Parliament/Welsh Assembly Government

Providing data to SPEN about third parties

You should not provide us with personal data about someone else (such as nominated contacts, co-owners or next of kin) without first getting their permission for it to be disclosed and used by us. If you provide such third-party data we will assume they have given permission for this, although we may still ask for confirmation.

Data security

We have in place appropriate technical and organisational security measures to protect your personal data against unauthorised or unlawful use, and against accidental loss, damage or destruction. We have put in place strict confidentiality agreements (including data protection obligations) with our third-party service providers and processors.

Your personal data will be processed and stored within the UK or the European Economic Area (EEA). In any instances where this data is to be transferred out with these areas, we will implement appropriate safeguards and security measures.

All data transfers that occur within the Iberdrola Group are carried out in accordance with the applicable data protection laws and our Binding Corporate Rules (BCRs). The Iberdrola Group’s BCRs reflect European legislation on data protection (General Data Protection Regulation) and means that all companies in our Group have to comply with the same internal rules. You can download a copy of the Iberdrola BCR here.

Closed-circuit television (CCTV)

SP Energy Networks operates CCTV at our facilities for the purposes of maintaining the security of property and premises, site safety and the detection and prevention of crime. To find out more information on the processing please see our full CCTV privacy notice by clicking here.

Cookies

Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie.

Cookies enable us to:

• Ensure our websites are working correctly
• Offer you a customised web service
• Continually improve our websites for you

We do not use cookies to:

• Collect any personal data

Managing Cookies

• If you want to remove any cookies already set, you can do so from your browser. You can find out how to do this by going to the help menu in your browser. Further information can be found on your browser's site.

Data Subject Rights

Your rights as the data subject:

In accordance with the GDPR you can contact us at DP@spenergynetworks.co.uk  to exercise any and all of the following rights that you have in relation to our processing of your personal data:

• Right of access – you have the right to obtain confirmation what personal data is being processed and to receive a copy of this personal data
• Right to rectification – you have the right to have your personal data rectified if it is inaccurate or incomplete
• Right to erasure (Right to be forgotten) – you have the right to request the deletion or removal of your personal data where there is no legal basis for its continued processing
• Right to restrict processing – you have the right to request that we block or suppress processing of your personal data
• Right to object to processing – you have the right to object to the processing of your personal data, under certain circumstances
• Right to data portability – you have the right to obtain and reuse your personal data for your own purposes across different services

Where consent is the legal basis for the processing of your personal data, you have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn. To withdraw your consent please contact DP@spenergynetworks.co.uk

Additionally, you have the right to lodge a complaint with our Data Protection Officer at dataprotection_corporate@scottishpower.com if you believe that your personal data is not being processed in line with this privacy notice. If you are not satisfied with the response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) by contacting:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113

Changes to the Privacy Notice

Any future changes we may make to this Privacy Notice will be posted on this page

Version date: April 2021