Introduction

In order for SPEN to comply with our obligations as a Distribution and Transmission Network Operator, we are required to collect and process your personal data. The personal data we collect may come from a number of different sources, including:

• directly from you through the completing of forms (either paper or on our website), via telephone calls, emails or any other method of communication we may have with you;
• from another individual – who may provide us with your personal data for the purpose of you acting as a nominated contact, co-owner, next of kin etc. They are responsible for ensuring they have your permission to provide this data;
• we may also receive personal data about you from third parties, including your electricity supplier; or
• from social media platforms, including but not limited to Twitter, Facebook and Instagram

SPEN will process your personal data for any of the following processes depending on the nature of the relationship you have with us. Open each section to find out more about how we process your personal data:

Stakeholder Engagement

SPEN will engage with a variety of different stakeholders for the purposes of hosting events and sending communications in connection to topics relating to our services. Personal data will be collected directly from you either; face to face at an event, via feedback forms, by email, by written response or by telephone.

SPEN may collect from you and process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Professional and or Employment data i.e. training, titles, job positions, occupation etc.;
• Language preference/ requirement; and
• Any comments, feedback or information you have provided.

Under Data Protection Legislation our lawful basis for processing your personal data is in connection to our legal obligations to engage with stakeholders in connection to our regulatory obligations and in the legitimate interest of SPEN to communicate and receive feedback for improvements.

Unplanned Faults & Power Cuts

When you contact us in the event of a power cut we will collect some personal data from you or the individual reporting it to us on your behalf. This is so we can provide you with communications during the power outage and ensure that your power has been restored once the fault has been fixed.

SPEN will collect the following categories of personal data when you report a fault:

• Identification and contact information i.e. Name, Address, Telephone Number and Email;
• Special Category data i.e. any medical conditions or if you have electrical equipment you are dependent on for medical reasons;
• Family details such as whether there are any vulnerable individuals at the property i.e. children under 5 or adults over 60;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide as part of the fault report.

Under Data Protection Legislation our lawful basis for processing your personal data is our legal obligation in connection to our regulatory obligations set by an Ofgem licence condition for SPEN. Additionally, in certain emergency circumstances we may be required to process your personal data in connection to your vital interests.

Planned Interruptions to Supply

SPEN are responsible for maintaining the electrical network and from time to time will be required to make upgrades and repairs to the network. In some instances, the only way to do this work is to stop the electrical supply in that area. In this event we will contact you if your electrical supply will be interrupted. We will do this either by letter, text message, telephone calls or face to face. When we notify you of the planned interruption to your electrical supply we will ask if you will need any additional support.

As part of planning an interruption SPEN may process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Telephone Number and Email;
• Special Category data i.e. any medical conditions or if you have electrical equipment you are dependent on for medical reasons;
• Family details such as whether there are any vulnerable individuals at the property i.e. children under 5 or adults over 60;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide to us as part of the planned interruption of power.

Under Data Protection Legislation our lawful basis for processing your personal data is our legal obligation in connection to our regulatory obligations set by an Ofgem licence condition for SPEN. Additionally, in certain emergency circumstances we may be required to process your personal data in connection to your vital interests.

Asset Management

We will process your personal data for the purposes of linking your property/premises to specific SPEN assets/equipment. This allows us to understand what equipment provides you with your energy supply. The purpose is so we can understand where any potential faults are with our equipment if you have a power cut or to be able to identify customers who may be affected if upgrades are required to our equipment allowing us to appropriately plan and notify you. SPEN will process the following categories of personal data for these purposes:

• Identification and contact information i.e. Name, Address, MPAN, Email and Telephone Number; and
• Priority Services data.

Under Data Protection Legislation our lawful basis for processing your personal data is in connection to our legal obligations as we have an Ofgem regulatory requirements and where we have a Legitimate interest to ensure our network can be linked to the individuals we distribute energy to. 

Priority Services Register

SPEN have a Priority Services Register (“PSR”) for customers who may require additional support in the event of a power cut or planned interruption. The PSR is a free, optional service for customers who are either; over the age of 60; have a special communication need; depend on electricity for home/medical care; who have a child under 5 years of age; have a chronic illness or just feel like they need a little extra help. Additionally, you can register if you need support for a short period of time e.g. if you're recovering from an operation, if you are pregnant, or if you are recently bereaved.

SPEN will collect and process the following data received either directly from you or indirectly when you have given your energy/ utility supplier consent to share their PSR data with us:

• Identification and contact information i.e. Title, Name, Address, Email and Telephone Number; and
• The reason you wish to be registered on the PSR which may include:
  • Special Category data i.e. any medical conditions or if you have electrical equipment you are dependent on for medical reasons; or
  • Family details such as whether there are any vulnerable individuals at the property i.e. children under 5 or adults over 60.

You can provide us with a name and contact details of a nominated individual who would be likely to contact us on your behalf, please note you must get this individuals permission to share this data with us. Additionally, if you are a third party registering an individual for the PSR you must have their permission to share their personal data with us.

Once you are registered on the PSR we will communicate with you for following purposes:

• To provide you with a welcome pack fully explaining the PSR and additional services we can support you with;
• During a power cut to provide you with regular updates and any additional support required;
• In preparation and during a planned interruption to your electrical supply to provide you with regular updates and any additional support required; and
• Once registered if we have not communicated with you within two years we  will contact you to confirm if you still require to be registered. This to ensure we maintain an accurate and up to date PSR.

Under Data Protection Legislation our lawful bases for processing your personal data are:

• Legal obligation - in connection to our regulatory obligations set by an Ofgem licence condition for SPEN to provide support to vulnerable customers; and
• Consent (only for those added before 24/03/2023) – when you registered we asked for your consent to share your data provided with your energy/utility suppliers, networks and meter operators so they can register you for their priority services. You have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn. To withdraw your consent please contact DP@spenergynetworks.co.uk
• Legitimate Interest (only for those added after 24/03/2023) – we have a legitimate interest to share data with other energy/utility supplier(s), networks and meter operators so they can register you for their priority services and so they can provide you with the support that we will provide you

Low Carbon Technology Installations

When you appoint for a company to install your new low carbon technology device, they are required to check with us as your Distribution Network Operator (“DNO”) to ensure there is enough electrical capacity for the new equipment and ensure the SP Energy Networks equipment meets the required standard.

This means the Installer will provide us with some of your personal data to enable us to carry out any actions or requirements prior to the install. The Installer is also required to notify us of the device installed to record high load devices connected to our electrical network.  

SP Energy Networks will process the following personal data which has been provided from your Installer:

• Identification Data i.e. Name, Address, Telephone and Email,
• Property Data i.e. MPAN, Photos of your cut out;
• Geolocation data i.e. the coordinates of your property

Under Data Protection Legislation our lawful basis for processing your personal data is in connection to our legal obligations to retain data about installs of low carbon technology on our network within our licence conditions set by Ofgem. 

Requests for Connections

When you require to connect, disconnect or alter your electric supply to our network we will collect and process personal data to enable us to process your application, to provide you with a quote for the connection, receive payment and to carry out the work required.  

As part of the connections process we will collect and process the following data:

• Identification and contact information i.e. Title, Name, Address, Email and Telephone Number; Site address.
• Commercial information if you are a business and any points of contact action on behalf of the business;
• Payment details e.g. the amounts quoted, due or paid in relation to the connection work; and
• Any data required to undertake the work in connection to the services requested/ received e.g. locational data, equipment details etc.

Under Data Protection Legislation our lawful bases for processing your personal data are:

• Legal obligation - in relation to our regulatory obligations set by an Ofgem licence condition for SPEN to provide electrical supply connections to customers; and
• Contractual – as the processing is necessary for a contract you entered into with us, or because you have asked us to take specific steps before entering into a contract.

General Enquiries

SPEN will process your personal data when you raise an enquiry to either provide you or the individual reporting it to us on your behalf, with the information or service required. You can make an enquiry either via telephone, email or web form.

SPEN may collect from you and process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email, MPAN and Telephone;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide to us as part of the enquiry which may include your house characteristics, services received etc.

Under Data Protection Legislation our lawful basis for processing your personal data is our legal obligation in connection to our regulatory obligations set by an Ofgem licence condition for SPEN.

Social Referrals

SPEN have a social obligations team who support customers who register their interest in receiving free additional support of services from third parties SPEN work with. You can register your interest in the referral services we offer either by telephone, email or web form. If you are registering for someone else on their behalf, you must ensure you have the individual’s permission to share their personal data.

When you request additional services SPEN may process the following personal data:

• identification and contact information i.e. Title, Name, Address, Email and Telephone Number;
• personal data i.e. Date of Birth and if you have military service;
• the types of services you have expressed an interest in; and
• any data you provide that is relevant to the service.

Once you register a member of the social obligations team will call you to obtain further information required for the specific services you have expressed an interest in. We will then securely share your data with your consent to the third party. We will keep in touch with you throughout the referral process to ensure you receive the requested services.

Under Data Protection Legislation our lawful basis for processing your personal data is your consent. You have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn. To withdraw your consent please contact DP@spenergynetworks.co.uk

Customer Satisfaction Surveys

If you have engaged with SPEN either through the connections process, general enquires or during a planned or unplanned power cut then we may send you a satisfaction survey. This is to complete market research and understand the service you receive as a customer allowing us to improve or services we provide.

In connection to the satisfaction survey SPEN and our contracted service partners will process the following personal data:

• identification and contact information i.e. Title, Name, Address, Email and Telephone Number;
• coded PSR data relevant to the services provided – this may include special category data;
• the contact type we have had with you in connection to the services received; and
• any scores, comments and feedback you provide.

Under Data Protection Legislation our lawful bases for processing your personal data are:

• Legal obligation - in relation to our regulatory obligations where SPEN is required to collate feedback and monitor the services we provide to customers to satisfy the Broader Customer Service Measures as set by Ofgem.

Customer Complaints

When you contact us to make a complaint, SPEN will process and collect personal data to assist in investigating, responding and resolving the issue you have raised.

SPEN will process the following categories of personal data:

• Identification and contact information i.e. Name, Title, Address, Email and Telephone Number;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide to us as part of the compliant which may include your MPAN, house characteristics, services received etc.

Under Data Protection Legislation our lawful basis for processing your personal data is our legal obligation in connection to our regulatory obligations set by an Ofgem licence condition for SPEN.

Debt Management

SPEN will process personal data in connection to individuals who have an outstanding balance. The debt recovery team will communicate with you via telephone, emails or by letter to collect the outstanding payment to be made.

SPEN will process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Commercial information i.e. company and business details;
• Transactional data i.e. monetary values; and
• Any information, specific details in connection to the outstanding payment.

Under Data Protection Legislation our lawful basis for processing your personal data are:

• Contractual- where we have a contractual relationship with you; or
• Legitimate Interest – where we have a legitimate interest to collect the outstanding balance.

Third Party Damages

SPEN may collect and process personal data in connection to individuals and/or companies who are involved in or responsible for any damage to our equipment or property.

SPEN may collect the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Employment particulars i.e. job position
• Commercial information i.e. company and business details
• Transactional data, i.e. compensation, monetary values etc.
• Any information, specific details or evidence submitted as part of the damage reports.

Under Data Protection Legislation our lawful basis for processing your personal data are:

• Contractual- where we have a contractual relationship with you; or
• Legitimate Interest – where we have a legitimate interest to pursue a claim against you for damages caused to our equipment.

Open Data Requests

SPEN will collect and process personal data in connection to any open data requests that you make or to sign up to our Open Data Portal. An Open data request, is a request for different datasets relevant to an area of interest. This can be made through our Open Data portal or to our Open data team by email. Please note we do not share any personal data as part of our open data request process.

SPEN may collect the following categories of personal data;

• Identification and contact information i.e. Name, Address Email, and Telephone Number;
• Professional and/or Employment data i.e. training, titles, job positions, occupation, etc; and
• Any comments, feedback, or information you have provided.

Under Data Protection Legislation our lawful basis for processing your personal data are:

• Legal Obligation - to engage with stakeholders in connection to our regulatory obligations on providing access to SP Energy Networks data; or
• Legitimate Interest – to communicate and receive feedback for improvements.

Insurance Claims

SPEN will collect and process personal data in connection to any claims received and this personal data may be collected directly from you or your representatives. In addition, SPEN will hold and process personal data of any representatives acting on behalf of the claimant(s)

SPEN may collect the following categories of personal data depending on the nature of the claim but will only collect the data required in connection to the claim:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Commercial information i.e. company and business details;
• Economic Financial Data i.e. insurance, account details, monetary values etc.;
• Employment particulars i.e. job position; or
• Any information, specific details or evidence submitted as part of the claim.

Planning Consultations

SPEN will process your personal data when you submit an enquiry, feedback or comments in connection to a planning consultation. This data will be collected directly from you either; face to face at a consultation event, via feedback forms, by email to the project mailbox, by letter or by telephone.

SPEN may collect from you and process the following categories of personal data:

• Identification and contact information i.e. Name, Address, Email and Telephone Number;
• Information in relation to recreational activities you participate in at the area of the planned project; and
• Specific details relating to your comments, feedback and/or opinions related to the plans.

Under Data Protection Legislation our lawful basis for processing your personal data is in connection to our legal obligations to undertake public engagement in line with Environmental Impact Assessment legislation.

Under Data Protection Legislation our lawful basis for processing your personal data is legal obligation in connect to public liability and in connection to The Electricity Act 1989.

Network Analytics

SPEN undertake analytical analysis of our electricity network this helps us to improve the operation of the network by forecast constraints and capacity problems, understanding the connectivity and load at properties thus providing better identification and management of faults.

The data processed during this analytical work may be property address, map coordinate geolocation, MPAN, UPRN, any equipment connected via the property e.g. heat pump and smart meter consumption data.

Under Data Protection Legislation our lawful basis for processing personal data is in connection to our legal obligations as we have industry code and regulatory requirements and where we have a Legitimate interest to ensure our network can cope with capacity and ensure continuity of service.

Call Recordings

Inbound and outbound telephone calls from SPEN customer service contact teams are recorded for the purposes of:

• staff training and quality monitoring of staff;
• to investigate and resolve a complaint; and
• for the detection, investigation and prevention of crime.

When a call is recorded we collect:

• a recording of the conversation i.e. your voice
• call information i.e. telephone number, time, date and duration of the call;
• any personal data you disclose during the call; this may include special category personal data e.g. health or medical conditions etc.

Please note that in some circumstances you may be transferred to other departments or individuals who do not record calls.

Recording of calls is necessary to protect the interests of you, our staff or both. The lawful basis of processing is in our legitimate interests, unless those interests are overridden by you by asking for your call not to be recorded. You may request that your call isn't recorded and in this situation, you will normally be advised to contact us either in writing or by email.

Closed-Circuit Television (CCTV)

SP Energy Networks operates CCTV at our facilities for the purposes of maintaining the security of property and premises, site safety and the detection and prevention of crime. To find out more information on the processing please see our full CCTV privacy notice by clicking here

Sharing of Data

SPEN engage with data processors who are third parties i.e. consultants, contractors and suppliers. These third parties provide elements of our services for us. We have agreements in place with our data processors that restrict the purposes for which they can process the personal data and we will only share personal data that is required to enable them to perform these services. We will not pass any personal data collected to third parties for marketing purposes.

We may share personal data in certain circumstances with another member of our group, meaning our holding company and its subsidiaries.

In some circumstances we are legally obliged to share information, for example:

• under a court order; or
• with regulatory authorities e.g. Ofgem in connection to our licence conditions; or
• in emergency situations in connection to The Civil Contingencies Act 2004; or
• in order to enforce or apply our Terms of Use or Terms and Conditions of supply and other agreements or to protect the rights, property, or safety of SPEN and our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

When we are required to share personal data we will take appropriate measures to ensure we have a lawful basis to share the data, that we provide only the personal data which is required for the purpose and to provide this data securely.

Security of Data

We have in place appropriate technical and organisational security measures to protect your personal data against unauthorised or unlawful use, and against accidental loss, damage or destruction. We have put in place strict confidentiality agreements (including data protection obligations) with our third-party service providers and processors.

Retention of Data

SP Energy Networks and have in place a Retention Policy so that personal data is not stored or processed longer than necessary. How long we keep personal data will depend on the purpose(s) for which it was originally collected. 

As a Distribution Network Operator, we are required to hold customer data for properties connected to our network. We will hold customer name, contact details and priority service indicators until we are notified that the individual is no longer at the property, or the priority service indicator is no longer applicable. However, Property data e.g. address, postcode, equipment etc. will be held until the property or equipment is disconnected from our network.

Under our licence conditions we have established processes for Complaints, General Enquires, Satisfaction Surveys, Stakeholder Engagement, Connections, Planned Interruption, Network Analytics and Asset Management. Personal data processed in relation to these processes will be held for the relevant price control period plus two years, in line with our regulatory obligations.

Other processes that we have specific retentions for are:

• Social referrals data will be held for 12months from the closure of the referral.
• Planning Consultations and Projects will hold any personal data processed until the end of the planning process or end of the project.
• Debt Management and Third-party Damages will be held for the duration of the claim/case plus 12years.
• Insurance Claims will be held for the duration of the claim plus 6years.
• Text messages are deleted after 24 months.
• Call recordings are deleted after 12 months, unless a request for the calls has been made, in these circumstances the recording and/or a transcript of the call may be held longer.

Cookies

When accessing our website, for example if you submit a query or complete a form via our website, cookies may collect some data e.g. IP location. Please note we do not use cookies to collect personal data. Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies enable us to:

• Ensure our websites are working correctly
• Offer you a customised web service
• Continually improve our websites for you

You can manage the cookies or remove the cookies already set   from your browser; you can find out how to do this by going to the help menu in your browser. If you would like  more information and to manage your preferences please see our cookies policy.

Transfers of Data

Your personal data will be processed and stored within the UK or the European Economic Area (“EEA”). In any instances where this data is to be transferred out with these areas, we will implement appropriate safeguards and security measures.

SPEN are part of the Iberdrola Group and as such any data transfers that occur within the group are carried out in accordance with the applicable data protection laws and our Binding Corporate Rules (“BCRs”). The Iberdrola Group’s BCRs reflect European legislation on data protection (General Data Protection Regulation (GDPR)) which means that all companies in our Group have to comply with the same internal rules. You can download a copy of the Iberdrola BCR.

Your Rights

In accordance with Data Protection Legislation you can exercise any of the following rights by contacting us at DP@spenergynetworks.co.uk

• Right of access – you have the right to obtain confirmation of what personal data is being processed and to receive a copy of this personal data
• Right to rectification – you have the right to have your personal data rectified if it is inaccurate or incomplete
• Right to erasure (Right to be forgotten) – you have the right to request the deletion or removal of your personal data where there is no legal basis for its continued processing
• Right to restrict processing – you have the right to request that we block or suppress processing of your personal data
• Right to object to processing – you have the right to object to the processing of your personal data, under certain circumstances
• Right to data portability – you have the right to obtain and reuse your personal data for your own purposes across different services
• Right to withdraw consent - where consent is the legal basis for the processing of your personal data, you have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn.

DPO Contact Details

 If you believe that your personal data is not being processed in line with this privacy notice you have the right to lodge a complaint with our Data Protection Officer, by contacting:

dataprotection_corporate@scottishpower.com

or

Data Protection Officer
Scottish Power UK
320 St Vincent Street
GLASGOW
G2 5AD

Right to Complain

If you are not satisfied with the response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) by contacting:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113