This privacy statement ("Statement") describes how ScottishPower Renewables ("SPR") (which includes ScottishPower Renewables (UK) Limited (company number NI028425), ScottishPower Renewables (WODS) Limited (company number SC374288), East Anglia One Limited (company number 07366753), East Anglia One North Limited (company number 11121800), East Anglia Two Limited (company number 11121842), and East Anglia Three Limited (company number 08141208)) collects, stores and uses information that identifies individuals ("Personal Information") in connection with its business activities.
In this Statement, references to "we", "us", and "our" (and other similar terms) means SPR and "you" and "your" (and other similar terms) mean our contacts, suppliers, stakeholders, counterparties and website visitors.
Personal Information that SPR may collect from you and uses made of it.
We may collect Personal Information about you whenever we contact you, you contact us, or if we are in (or preparing to enter into) a contract with one another.
In particular, we may collect and process the following information:
- Information provided by filling in forms or following email links on our website, or received from you when we contact each other by phone, email, post or other methods.
- Information gathered when we enter into or prepare to enter into a contract or agreement with you or a body in which you are involved with in some capacity.
- Information to better provide you with required services or information about our projects, developments, policies and activities.
- Information needed to respond to a query, request or complaint submitted by you.
- Information gathered by us from publically available sources.
- Information gathered by third parties on our behalf.
Please note that we will assume, unless you tell us otherwise, that we may use and disclose your Personal Information in such a manner as we believe is reasonably necessary to provide our services and information to you (including as described in this Statement and as otherwise agreed between us).
More specifically we may collect, store and use your Personal Information for the following purposes:
If you contact us through our website:
We will collect your personal contact details for the purpose of contacting and corresponding with you in response to your enquiry or expression of interest in one or more of SPR’s projects or other business interests.
By contacting us via one of our website channels you will have consented to us processing your details in this way.
If you are a landowner:
We may collect details of your property, your name, information regarding any wayleaves, servitudes, easements, options or leases or consents over your property, how long you have owned it and details of any co-owners or others with rights over your property, for the purpose of obtaining rights over your property.
We consider that we have a legitimate interest to process your data in this manner in order that we have full knowledge of landowners affected by SPR’s projects. We may also be required to use these details for the purposes of entering into contractual discussions with you.
If you are a contractor (or prospective contractor) with SPR:
We may collect, store and use your personal and/or professional contact details for the purpose of contacting and contracting with you as well as the contact details for any organisation that you represent.
We may also collect your Personal Information through materials you may provide to us in relation to the services you supply to us, as well as your bank account and/or other payment details for the purpose of paying your fees in relation to any contract that we have with you.
In such instances we will process such information on the basis that it is necessary in order to enter into or perform a contract with you.
If you are a stakeholder:
We may collect, store and use your name, personal and/or professional contact details (including email address, telephone number and home/business address), job title, and any other information that may be classed as personally identifiable information as well as the name and contact details for any organisation that you may represent for the purpose of contacting you regarding SPR projects and/or policies and activities.
We consider that it is in both of our legitimate interests that we retain such Personal Information to keep you apprised of SPR activities (including project and/or policy developments) that may impact you as a stakeholder.
In some cases we may collect, store and use your political opinions where such opinions have been manifestly made public by you or where you have provided your explicit consent, for the purpose of contacting you regarding SPR projects and/or policies.
If you have made a complaint:
We may collect your name and personal contact details (including email address, telephone number and home address) for the purpose of contacting and corresponding with you regarding the complaint that you have made.
We consider that such Personal Information is processed with both of our legitimate interests in mind, to ensure a timeous and efficient conclusion of your complaint and to allow us to follow-up with you post resolution of the complaint, where appropriate.
If you have completed a form at the premises or at an SPR event:
We may collect your name, personal contact details (including email address, telephone number and home address), job title and any other information that may have been provided, for the purposes of contacting you regarding SPR projects and/or policies.
By filling in such a form you will have consented to having your data processed in this way.
If you contact us in an emergency
We will collect your name, email address, phone number, and the best time to reach you, the urgency of your enquiry, and your preferred way of being contacted and the nature of your query for the purpose of responding to the query in the most efficient way.
We consider that, in such cases, it is in the legitimate interests of both parties to process your data in a way that ensures the emergency is resolved safely, as quickly and efficiently as possible and, where necessary, may be followed up.
Other uses of Personal Information
On occasion we may collect additional Personal Information for a specific purpose. In such circumstances we will try to provide specific additional notice about that processing and purpose at the time those data are collected and any disclosures made and information given at the point of such collection will also form a part of this Statement.
Who we share your Personal Information with
We use consultants, suppliers, contractors, other professionals and work with government departments, agencies, local authorities and non-departmental public bodies (NDPBs) to help us develop our projects. We may therefore share your personal data with the following third parties, where there is a requirement to do so:
- Legal firms
- Government agencies such as Ofgem
- Insurers
- Information Commissioner
- People whom you have authorised us to share your personal information with
- Joint venture companies
We may give them personally identifiable information but only to the extent they need it to carry out their specific tasks. Where possible and appropriate in the circumstances, we have contracts in place with third parties containing obligations regarding the use and security of Personal Information to ensure that it is protected as much as is reasonably practicable.
How long we hold your Personal Information for
We retain your Personal Information for no longer than is necessary for the purposes for which the Personal Information is processed. The length of time that we retain it is dependent on the purposes for which we use it and/or as required by law.
This means that some of your Personal information will be kept for a short time, for example where you submit a complaint and that complaint is resolved without the requirement for follow-up, whereas other information may be kept for a longer period of time, for example where a specified period is required by law or our relationship requires it. Should you require further information on the retention of your data, then you can contact us via the email addresses provided below.
Providing information to SPR about third parties
You should not give us Personal Information about someone else (such as alternative named contacts, co-owners or next of kin) without first getting their consent for it to be disclosed and used by us. If you provide such third party information we will assume they have consented, although we may still ask for confirmation.
Where SPR stores your personal data and security measures
We have in place what we believe to be appropriate technical and organisational security measures to protect your Personal Information against unauthorised or unlawful use, and against accidental loss, damage or destruction. We put in place strict confidentiality agreements (including data protection obligations) with our third party service providers. We will not pass any Personal Information collected to third parties for marketing purposes unless we tell you specifically.
Where appropriate and relevant your Personal Information may, in limited circumstances, be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may be accessed by ScottishPower Group companies and may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the provision of support services. By submitting your Personal Information, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your Personal Information is treated securely and in accordance with this Statement.
All data transfers that occur within the Iberdrola Group are carried out in accordance with the applicable data protection laws and our Binding Corporate Rules (BCRs). The Iberdrola Group’s BCRs reflect European legislation on data protection (General Data Protection Regulation) and means that all companies in our Group have to comply with the same internal rules. You can download a copy of the Iberdrola’s BCR here.
Unfortunately, the transmission of information via the internet is not completely secure. If you provide Personal Information to us via our websites, we will do our best to protect it, but we cannot guarantee its security and any transmission is at your own risk. Once we have received your Personal Information, we will use strict procedures and security features to try to prevent unauthorised access.
Cookies
If you visit our website we will collect and store your IP address, the browser software that you use and your activity on our website through cookies. More information about how we use cookies can be found via the Cookies section of our website.
Other circumstances in which SPR may disclose your Personal Information
We may disclose your Personal Information to any member of our Group, which means our subsidiaries, our ultimate holding company and its subsidiaries.
We may disclose your Personal Information to third parties:
- In the event that we sell or buy any business or assets, in which case we may disclose your Personal Information to the prospective seller or buyer of such business or assets, but only if such disclosure is reasonably required for the purposes of the sale or purchase;
- If all or substantially all of our assets are acquired by a third party, your Personal Information may be one of the transferred assets;
- If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or terms and conditions of supply and other agreements; or to protect the rights, property, or safety of SPR personnel.
What are your rights?
In accordance with the GDPR, you can contact us at:
to exercise any and all of the following rights that you have in relation to our processing of your personal information:
- Right of access – you have the right to obtain confirmation that your personal information is being processed and access to your personal information
- Right to rectification – you have the right to have your personal information rectified if it is inaccurate or incomplete
- Right to erasure (Right to be forgotten) – you have the right to request the deletion or removal of your personal information where there is no legitimate reason for its continued processing by us
- Right to restrict processing – you have the right to request that (where you have granted us consent) your consent is withdrawn or that we block or suppress processing of your personal information by emailing the relevant email inbox detailed above.
- Right to data portability – you have the right to obtain and reuse your personal information for your own purposes across different services as the processing is based on your consent
Where consent is the legal basis for the processing of your personal data, you have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn. To withdraw your consent please contact dataprotection_corporate@scottishpower.com
Additionally, you have the right to lodge a complaint with our Corporate Data Protection Officer at dataprotection_corporate@scottishpower.com if you believe that your personal information is not being processed in line with this privacy notice. If in the event that you are not completely satisfied with the response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) by contacting:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Changes to the Statement
Any changes we may make to our Statement in the future will be posted on this page.