Introduction

In order for SPEN to comply with our obligations as a Distribution and Transmission Network Operator, we are required to collect and process your personal data. The personal data we collect may come from a number of different sources, including:

• directly from you through the completing of forms (either paper or on our website), via telephone calls, emails or any other method of communication we may have with you;
• from another individual – who may provide us with your personal data for the purpose of you acting as a nominated contact, co-owner, next of kin etc. They are responsible for ensuring they have your permission to provide this data;
• we may also receive personal data about you from third parties, including your electricity supplier; or
• from social media platforms, including but not limited to Twitter, Facebook and Instagram

SPEN will process your personal data for any of the following processes depending on the nature of the relationship you have with us. Open each section to find out more about how we process your personal data:

Stakeholder Engagement

SPEN will engage with a variety of different stakeholders for the purposes of hosting events and sending communications in connection to topics relating to our services. Personal data will be collected directly from you either; face to face at an event, via feedback forms, by email, by written response or by telephone.

SPEN may collect from you and process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Professional and or Employment data i.e. training, titles, job positions, occupation etc.;
• Language preference/ requirement; and
• Any comments, feedback or information you have provided.

Under Data Protection Legislation our lawful basis for processing your personal data is in connection to our legal obligations to engage with stakeholders in connection to our regulatory obligations and in the legitimate interest of SPEN to communicate and receive feedback for improvements.

Unplanned Faults & Power Cuts

When you contact us in the event of a power cut we will collect some personal data from you or the individual reporting it to us on your behalf. This is so we can provide you with communications during the power outage and ensure that your power has been restored once the fault has been fixed.

SPEN will collect the following categories of personal data when you report a fault:

• Identification and contact information i.e. Name, Address, Telephone Number and Email;
• Special Category data i.e. any medical conditions or if you have electrical equipment you are dependent on for medical reasons;
• Family details such as whether there are any vulnerable individuals at the property i.e. children under 5 or adults over 60;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide as part of the fault report.

Under Data Protection Legislation our lawful basis for processing your personal data is our legal obligation in connection to our regulatory obligations set by an Ofgem licence condition for SPEN. Additionally, in certain emergency circumstances we may be required to process your personal data in connection to your vital interests.

Planned Interruptions to Supply

SPEN are responsible for maintaining the electrical network and from time to time will be required to make upgrades and repairs to the network. In some instances, the only way to do this work is to stop the electrical supply in that area. In this event we will contact you if your electrical supply will be interrupted. We will do this either by letter, text message, telephone calls or face to face. When we notify you of the planned interruption to your electrical supply we will ask if you will need any additional support.

As part of planning an interruption SPEN may process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Telephone Number and Email;
• Special Category data i.e. any medical conditions or if you have electrical equipment you are dependent on for medical reasons;
• Family details such as whether there are any vulnerable individuals at the property i.e. children under 5 or adults over 60;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide to us as part of the planned interruption of power.

Under Data Protection Legislation our lawful basis for processing your personal data is our legal obligation in connection to our regulatory obligations set by an Ofgem licence condition for SPEN. Additionally, in certain emergency circumstances we may be required to process your personal data in connection to your vital interests.

Priority Services Register

SPEN have a Priority Services Register (“PSR”) for customers who may require additional support in the event of a power cut or planned interruption. The PSR is a free, optional service for customers who are either; over the age of 60; have a special communication need; depend on electricity for home/medical care; who have a child under 5 years of age; have a chronic illness or just feel like they need a little extra help. Additionally, you can register if you need support for a short period of time e.g. if you're recovering from an operation, if you are pregnant, or if you are recently bereaved.

SPEN will collect and process the following data received either directly from you or indirectly when you have given your energy/ utility supplier consent to share their PSR data with us:

• Identification and contact information i.e. Title, Name, Address, Email and Telephone Number; and
• The reason you wish to be registered on the PSR which may include:
  • Special Category data i.e. any medical conditions or if you have electrical equipment you are dependent on for medical reasons; or
  • Family details such as whether there are any vulnerable individuals at the property i.e. children under 5 or adults over 60.

You can provide us with a name and contact details of a nominated individual who would be likely to contact us on your behalf, please note you must get this individuals permission to share this data with us. Additionally, if you are a third party registering an individual for the PSR you must have their permission to share their personal data with us.

Once you are registered on the PSR we will communicate with you for following purposes:

• To provide you with a welcome pack fully explaining the PSR and additional services we can support you with;
• During a power cut to provide you with regular updates and any additional support required;
• In preparation and during a planned interruption to your electrical supply to provide you with regular updates and any additional support required; and
• Once registered if we have not communicated with you within two years we  will contact you to confirm if you still require to be registered. This to ensure we maintain an accurate and up to date PSR.

Under Data Protection Legislation our lawful bases for processing your personal data are:

• Legal obligation - in connection to our regulatory obligations set by an Ofgem licence condition for SPEN to provide support to vulnerable customers; and
• Consent – when you register we will ask for your consent to share your data provided with your energy/utility suppliers, so they can register you for their priority services. You have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn. To withdraw your consent please contact DP@spenergynetworks.co.uk

Requests for Connections

When you require to connect, disconnect or alter your electric supply to our network we will collect and process personal data to enable us to process your application, to provide you with a quote for the connection, receive payment and to carry out the work required.  

As part of the connections process we will collect and process the following data:

• Identification and contact information i.e. Title, Name, Address, Email and Telephone Number; Site address.
• Commercial information if you are a business and any points of contact action on behalf of the business;
• Payment details e.g. the amounts quoted, due or paid in relation to the connection work; and
• Any data required to undertake the work in connection to the services requested/ received e.g. locational data, equipment details etc.

Under Data Protection Legislation our lawful bases for processing your personal data are:

• Legal obligation - in relation to our regulatory obligations set by an Ofgem licence condition for SPEN to provide electrical supply connections to customers; and
• Contractual – as the processing is necessary for a contract you entered into with us, or because you have asked us to take specific steps before entering into a contract.

General Enquiries

SPEN will process your personal data when you raise an enquiry to either provide you or the individual reporting it to us on your behalf, with the information or service required. You can make an enquiry either via telephone, email or web form.

SPEN may collect from you and process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email, MPAN and Telephone;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide to us as part of the enquiry which may include your house characteristics, services received etc.

Under Data Protection Legislation our lawful basis for processing your personal data is our legal obligation in connection to our regulatory obligations set by an Ofgem licence condition for SPEN.

Social Referrals

SPEN have a social obligations team who support customers who register their interest in receiving free additional support of services from third parties SPEN work with. You can register your interest in the referral services we offer either by telephone, email or web form. If you are registering for someone else on their behalf, you must ensure you have the individual’s permission to share their personal data.

When you request additional services SPEN may process the following personal data:

• identification and contact information i.e. Title, Name, Address, Email and Telephone Number;
• personal data i.e. Date of Birth and if you have military service;
• the types of services you have expressed an interest in; and
• any data you provide that is relevant to the service.

Once you register a member of the social obligations team will call you to obtain further information required for the specific services you have expressed an interest in. We will then securely share your data with your consent to the third party. We will keep in touch with you throughout the referral process to ensure you receive the requested services.

Under Data Protection Legislation our lawful basis for processing your personal data is your consent. You have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn. To withdraw your consent please contact DP@spenergynetworks.co.uk

Customer Satisfaction Surveys

If you have engaged with SPEN either through the connections process, general enquires or during a planned or unplanned power cut then we may send you a satisfaction survey. This is to complete market research and understand the service you receive as a customer allowing us to improve or services we provide.

In connection to the satisfaction survey SPEN and our contracted service partners will process the following personal data:

• identification and contact information i.e. Title, Name, Address, Email and Telephone Number;
• coded PSR data relevant to the services provided – this may include special category data;
• the contact type we have had with you in connection to the services received; and
• any scores, comments and feedback you provide.

Under Data Protection Legislation our lawful bases for processing your personal data are:

• Legal obligation - in relation to our regulatory obligations where SPEN is required to collate feedback and monitor the services we provide to customers to satisfy the Broader Customer Service Measures as set by Ofgem.

Customer Complaints

When you contact us to make a complaint, SPEN will process and collect personal data to assist in investigating, responding and resolving the issue you have raised.

SPEN will process the following categories of personal data:

• Identification and contact information i.e. Name, Title, Address, Email and Telephone Number;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide to us as part of the compliant which may include your MPAN, house characteristics, services received etc.

Under Data Protection Legislation our lawful basis for processing your personal data is our legal obligation in connection to our regulatory obligations set by an Ofgem licence condition for SPEN.

Debt Management

SPEN will process personal data in connection to individuals who have an outstanding balance. The debt recovery team will communicate with you via telephone, emails or by letter to collect the outstanding payment to be made.

SPEN will process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Commercial information i.e. company and business details;
• Transactional data i.e. monetary values; and
• Any information, specific details in connection to the outstanding payment.

Under Data Protection Legislation our lawful basis for processing your personal data are:

• Contractual- where we have a contractual relationship with you; or
• Legitimate Interest – where we have a legitimate interest to collect the outstanding balance.

Third Party Damages

SPEN may collect and process personal data in connection to individuals and/or companies who are involved in or responsible for any damage to our equipment or property.

SPEN may collect the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Employment particulars i.e. job position
• Commercial information i.e. company and business details
• Transactional data, i.e. compensation, monetary values etc.
• Any information, specific details or evidence submitted as part of the damage reports.

Under Data Protection Legislation our lawful basis for processing your personal data are:

• Contractual- where we have a contractual relationship with you; or
• Legitimate Interest – where we have a legitimate interest to pursue a claim against you for damages caused to our equipment.

Insurance Claims

SPEN will collect and process personal data in connection to any claims received and this personal data may be collected directly from you or your representatives. In addition, SPEN will hold and process personal data of any representatives acting on behalf of the claimant(s)

SPEN may collect the following categories of personal data depending on the nature of the claim but will only collect the data required in connection to the claim:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Commercial information i.e. company and business details;
• Economic Financial Data i.e. insurance, account details, monetary values etc.;
• Employment particulars i.e. job position; or
• Any information, specific details or evidence submitted as part of the claim.

Planning Consultations

SPEN will process your personal data when you submit an enquiry, feedback or comments in connection to a planning consultation. This data will be collected directly from you either; face to face at a consultation event, via feedback forms, by email to the project mailbox, by letter or by telephone.

SPEN may collect from you and process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Information in relation to recreational activities you participate in at the area of the planned project; and
• Specific details relating to your comments, feedback and/or opinions related to the plans.

Under Data Protection Legislation our lawful basis for processing your personal data is in connection to our legal obligations to undertake public engagement in line with Environmental Impact Assessment legislation.

Under Data Protection Legislation our lawful basis for processing your personal data is legal obligation in connect to public liability and in connection to The Electricity Act 1989.

Call Recordings

Inbound and outbound telephone calls may be recorded for the purposes of:

• staff training and quality monitoring of staff;
• to investigate and resolve a complaint; and
• for the detection, investigation and prevention of crime.

When a call is recorded we collect:

• a recording of the conversation i.e. your voice
• call information i.e. telephone number, time, date and duration of the call;
• any personal data you disclose during the call; this may include special category personal data e.g. health or medical conditions etc.

Please note that in some circumstances you may be transferred to other departments or individuals who do not record calls.

Recording of calls is necessary to protect the interests of you, our staff or both. The lawful basis of processing is in our legitimate interests, unless those interests are overridden by you by asking for your call not to be recorded. You may request that your call isn't recorded and, in this situation, you will normally be advised to contact us either in writing or by email.

Call recordings are kept securely and deleted after 12 months, unless a request for the calls has been made, in these circumstances the recording or a transcript of the call may be held longer.

Closed-Circuit Television (CCTV)

SP Energy Networks operates CCTV at our facilities for the purposes of maintaining the security of property and premises, site safety and the detection and prevention of crime. To find out more information on the processing please see our full CCTV privacy notice by clicking here

Sharing of Data

SPEN engage with data processors who are third parties i.e. consultants, contractors and suppliers. These third parties provide elements of our services for us. We have agreements in place with our data processors that restrict the purposes for which they can process the personal data and we will only share personal data that is required to enable them to perform these services. We will not pass any personal data collected to third parties for marketing purposes.

We may share personal data in certain circumstances with another member of our group, meaning our holding company and its subsidiaries.

In some circumstances we are legally obliged to share information, for example:

• under a court order; or
• with regulatory authorities e.g. Ofgem in connection to our licence conditions; or
• in emergency situations in connection to The Civil Contingencies Act 2004; or
• in order to enforce or apply our Terms of Use or Terms and Conditions of supply and other agreements or to protect the rights, property, or safety of SPEN and our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

When we are required to share personal data we will take appropriate measures to ensure we have a lawful basis to share the data, that we provide only the personal data which is required for the purpose and to provide this data securely.

Security of Data

We have in place appropriate technical and organisational security measures to protect your personal data against unauthorised or unlawful use, and against accidental loss, damage or destruction. We have put in place strict confidentiality agreements (including data protection obligations) with our third-party service providers and processors. We will process and retain your personal data in line with our retention schedule.

Cookies

When accessing our website, for example if you submit a query or complete a form via our website, cookies may collect some data e.g. IP location. Please note we do not use cookies to collect personal data. Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies enable us to:

• Ensure our websites are working correctly
• Offer you a customised web service
• Continually improve our websites for you

You can manage the cookies or remove the cookies already set   from your browser; you can find out how to do this by going to the help menu in your browser. If you would like  more information and to manage your preferences please see our cookies policy.

Transfers of Data

Your personal data will be processed and stored within the UK or the European Economic Area (“EEA”). In any instances where this data is to be transferred out with these areas, we will implement appropriate safeguards and security measures.

SPEN are part of the Iberdrola Group and as such any data transfers that occur within the group are carried out in accordance with the applicable data protection laws and our Binding Corporate Rules (“BCRs”). The Iberdrola Group’s BCRs reflect European legislation on data protection (General Data Protection Regulation (GDPR)) which means that all companies in our Group have to comply with the same internal rules. You can download a copy of the Iberdrola BCR.

Your Rights

In accordance with Data Protection Legislation you can exercise any of the following rights by contacting us at DP@spenergynetworks.co.uk

• Right of access – you have the right to obtain confirmation of what personal data is being processed and to receive a copy of this personal data
• Right to rectification – you have the right to have your personal data rectified if it is inaccurate or incomplete
• Right to erasure (Right to be forgotten) – you have the right to request the deletion or removal of your personal data where there is no legal basis for its continued processing
• Right to restrict processing – you have the right to request that we block or suppress processing of your personal data
• Right to object to processing – you have the right to object to the processing of your personal data, under certain circumstances
• Right to data portability – you have the right to obtain and reuse your personal data for your own purposes across different services
• Right to withdraw consent - where consent is the legal basis for the processing of your personal data, you have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn.

DPO Contact Details

 If you believe that your personal data is not being processed in line with this privacy notice you have the right to lodge a complaint with our Data Protection Officer, by contacting:

dataprotection_corporate@scottishpower.com

or

Data Protection Officer
Scottish Power UK
320 St Vincent Street
GLASGOW
G2 5AD

Right to Complain

If you are not satisfied with the response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) by contacting:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113