Privacy policy

1. INTRODUCTION

1.1 Who we are

Welcome to Sunsave Group Ltd’s Privacy and Data Protection Policy (“Privacy Policy”). SunSave Group Ltd is a company registered in England and Wales with registered number 13741813. This policy applies to Sunsave Group Ltd and its affiliates Sunsave UK Limited and Sunsave Energy Limited (“we”, “us”, or “our”) together providing renewable energy installation, monitoring, maintenance, and financing (“Our Services”).

We are committed to protecting and respecting your privacy and Personal Data in compliance with the United Kingdom General Data Protection Regulation (“GDPR”), the Data Protection Act 2018 and all other mandatory laws and regulations of the United Kingdom.

We are your Data Controller and responsible for your Personal Data. This Privacy Policy explains how we collect, process and keep your data safe. The Privacy Policy will tell you about your privacy rights, how the law protects you, and inform our employees and staff members of all their obligations and protocols when processing data.

1.2 How your personal data is collected

We only collect and process data about you where we have a reason for doing so that is permitted under applicable laws.

We may collect and use data gathered from different sources:

Direct interactions with Customers. You may give us your personal data through corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you: Purchase our products and services; Submit a form via our website; Agree that marketing can be sent to you; Interact with us on social media; or Give us feedback or contact us.
Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our Cookie Policy at https://www.sunsave.energy/cookies for further details.
Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below: Technical Data from analytics providers, advertising networks and search information providers. Identity, Contact, Financial and Transaction Data from credit reference and fraud prevention agencies, as well as other sources such as HM Land Registry, electoral roll, court records of debt judgements and bankruptcies and other providers of energy, technical, payment and delivery services. Identity and Contact Data from other affiliates or partners such as price comparison websites as well as publicly available sources.

1.3 Monitoring of communications

Subject to applicable laws, we maymonitor and record your communications with us such as calls, video calls, emails, texts and social media messages. We do this for regulatory compliance, quality control and staff training.

1.4 Types of Data we collect about you

“Personal Data” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together below. Not all of the following types of data will necessarily be collected from you but this is the full scope of data that we may collect for one or more of the purposes stated in this policy.

If you provide any personal data on behalf of other named individuals, you must have their authority to provide such personal data to us and share this Privacy Policy and any related data protection statement with them beforehand.

General data captured:

Profile/Identity Data: This is data relating to your first name, last name, gender, date of birth.
Contact Data: This is data relating to your phone number, addresses, email addresses, phone numbers.
Marketing and Communications Data: This is your preferences in receiving marketing information and other information from us.
Billing Data: This is information relating to your debit or credit card information such as the name attached to your payment details, billing address, account number and sort code.
Transactional Data: This is information of details and records of all payments you have made for our services or products.
Technical Data: Includes internet protocol (IP) address, access times, any websites you linked from, pages you visit, the links you use, the ad banners and other content you view, your login data, browser type and version, information about your device, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
Property Data: This may include unique property reference number (UPRN), property coordinates, postcode, pictures of the property, property ownership status, and mortgage info.
Energy Data: This may include household energy consumption, energy bill, and details of energy suppliers.
Usage Data: Includes information about how you use our website, products, and services.
Vulnerability Data: Includes information on any personal circumstances affecting you or a loved one. This could include things such as age, disabilities or health conditions. We will record them so we can be mindful when we interact with you and provide you extra support.
Biometric Data: Such as face and voice recordings. This may be used for the purposes of identification, fraud prevention and training and monitoring.

If you apply for a finance product with us, we may also capture:

Financial circumstances: This is information on your income, expenditure, financial associations and family / social situation (e.g. the number of dependants you have). It will be used to assess if financial products are suitable for you.
Education, employment and criminal details: For the purposes of credit and fraud prevention.

We also collect, use and share Aggregated Data such as the average energy consumption of our customers. Aggregated Data could be derived from your Personal Data but is not considered Personal Data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Privacy Policy.

We may also aggregate data to enable research or analysis so that we can better understand and serve you and others. For example, we may conduct research on your demographics and usage. Although this aggregated data may be based in part on Personal Data, it does not identify you personally. We may share this type of anonymous data with others, including service providers, our affiliates, agents and current and prospective business partners.

We do not collect details of your: race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions or trade union membership.

1.5 The Legal Basis for Collecting That Data

There are a number of justifiable reasons under the GDPR that allow collection and processing of Personal Data. The main avenues we rely on are:

 “Consent”: Certain situations allow us to collect your Personal Data, such as when you tick a box that confirms you are happy to receive email newsletters from us, or ‘opt in’ to a service. If you provide us with consent, you may withdraw it any time by contacting us.

 “Performance of Contract”: We may require certain information from you in order to fulfil our contractual obligations and provide you with the promised service.

"Legal Obligation”: We’re required by law to collect and process certain types of data, such as fraudulent activity or other illegal actions.

“Legitimate Interest”: We might need to collect certain information from you to be able to meet our legitimate interests - this covers aspects that can be reasonably expected as part of running our business, that will not have a material impact on your rights, freedom or interests. Examples could be your address, so that we know where to deliver something to, or your name, so that we have a record of who to contact moving forwards.

2. HOW WE USE YOUR PERSONAL DATA

2.1 Our Uses

We will only use your Personal Data when the law allows us to. Example purposes provided in the table below are indicative in nature and the purposes for which we use your data may be broader than described but we will never process your data without a legal basis for doing so and it is for a related purpose.

We have indicated in the table which lawful bases we rely on for each purpose; please refer to section 1.5 for definitions.

2.2 Marketing and Content Updates

We may use your Profile/Identity, Contact and Technical Data to form a view on what we may think you may want or need, or what may be of interest to you.

You will receive marketing and new content communications from us unless you specifically request that you would not like to receive these communications. From time to time we may make suggestions and recommendations to you about goods or services that may be of interest to you and you have not opted out of receiving that marketing.

2.3 Change of Purpose

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

3.  HOW YOUR DATA IS PROTECTED BY US AND YOUR RIGHTS

3.1 How Do We Protect Customers' Personal Data?

Keeping your data secure and protecting it from inappropriate disclosure is important to us. Once we receive your data, we apply these security measures in line with good practice and GDPR:

Step One: Protect from cyber threats - we store your data on our secure servers, or those of our third party data storage providers.
Step Two: Define permitted purposes – for which we are able to use that data in accordance with this policy.
Step Three: Limit accessibility - where reasonably possible only to those employees or third parties that need it for those permitted purposes.
Step Four: Protect from physical threats – all our employees’ computers and also our offices have security measures to prevent unauthorized access. Third parties with their limited access, do so in accordance with the security measures we put in to our agreements with them.
Step Five: Secure disposal of data - when it is no longer needed in line with this policy.

3.2 What Control Do I Have Over Sunsave Group Ltd’s Use Of My Personal Data?

Your account information will be protected by a password for your privacy and security. You need to prevent unauthorised access to your account and personal information by selecting and protecting your password appropriately and limiting access to your computer or device and by signing off after you have finished accessing your account.

You may have the following rights:

Access – request a copy of your data and information relating to how it is processed
Rectify – request any inaccuracies in the data we hold about you be corrected
Erasure – request that we erase your data from our records
Restrict – request that your data is no longer processed by us
Object – object to certain ways that we process your data
Transfer – request that your data be shared with a third party
Withdraw your consent – where we are relying on your consent to process your data, then you can withdraw your consent at any time
Lodge a complaint – you may be entitled to lodge a complaint with your local data protection authority.

You will need to contact us to exercise any of your rights. We try to respond to all legitimate requests without undue delay but within no longer than one month. Occasionally it could take longer than a month if your request is particularly complex or you have a number of requests. In this case we will notify you and keep you updated.

3.3 How to Request your Data and the Process for Obtaining it

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, if your request is clearly unfounded, we could refuse to comply with your request.

We may need to request specific information from you to help us confirm your identity and ensure you have the right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

3.4 Opting Out Of Marketing Promotions

You can ask us to stop sending you marketing messages at any time by using the “unsubscribe” option in emails or your customer account on our website, or contacting us via email or telephone.

Where you opt out of receiving these marketing messages, we will continue to retain other Personal Data provided to us as a result of interactions with us not related to your marketing preferences.

4. YOUR DATA AND THIRD PARTIES

4.1 Will We Share Your Data With Third Parties?

We may share your Personal Data with the third parties set out below for the purpose set out in section 2 of this policy. We have agreements in place with these parties to ensure compliance with GDPR and to use your Personal Data only for the purposes for which we disclose it to them and pursuant to our instructions.

Members of the Sunsave group of companies – As needed facilitate our operations business, services and products.
Suppliers – for the purposes of delivering, installing and maintaining products purchased from us
Manufacturers – for the purpose of validating any manufacturer’s warranty and diagnosing or resolving issues.
Your electricity network operator(s) – for the purpose of registering your solar supply to enable you to export electricity to them.
Partners – to help you explore or sign up to products or services provided by them if you indicate to us that you are interested in them. Please note that we will always ask for your consent before sharing your data.
IT Service Providers – including hosting providers, service providers and telecommunications providers to manage our business and support our environment and operations.
Finance Providers – who may enter into a credit agreement with you in connection with your purchase of goods and service from us and who may perform credit checks using credit reference agencies
Marketing service providers – who may, through the course of their professional services to SunSave be required to have access to SunSave services for providing required system services i.e. hosting services, database marketing, customer analytics.
Credit references agencies (CRAs)– when you apply for a finance product, and periodically on an ongoing basis while you remain a customer of ours, we will share your data with CRAs. We will provide them with your personal data, and they will provide us with information about your financial situation and history from a mixture of shared credit information and public sources. We will use this to perform credit and identity checks, assess if we can offer you credit, verify the accuracy of information you provided, prevent criminal activity, fraud and money laundering, manage your account as well as trace and recover debts. We will also send to the CRAs information on your settled accounts and any debts not fully repaid on time. CRAs will share your data with other organisations. If you submit a joint application or tell us that you have a spouse or financial associate, we’ll link your records together. Please make sure you discuss this with them before submission, and ensure they have read this policy. CRAs will also link your records together; these links will remain until either you or they successfully file for a disassociation with the CRAs. The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail on their websites. The three main CRAs have created a joint document called the Credit Reference Agency Information Notice (CRAIN) which is available from each of them – clicking any of these three links will take you to the same CRAIN document: Transunion – transunion.co.uk/crain, Equifax – equifax.co.uk/crain, Experian – experian.co.uk/crain
Third party payment providers – to process payments from you.
Debt Recovery and Tracing agencies – only as a last resort if there are overdue payments that we were unable to resolve directly with you and in accordance with applicable laws.
Professional advisors – including accountants, financial advisors, lawyers and other professional advisors to support auditing, compliance and corporate governance functions.
Prospective purchasers and assignees – if our business, or part of it, is sold or reorganized we may transfer your personal data to the new buyer; but only to the extent that we need to and to be used in accordance with this privacy policy. We do this because we have a legitimate interest to ensure the business can be continued by the buyer.
Industry regulators and enforcement bodies – in circumstances where we have a duty to disclose or share your personal data to comply with a legal obligation or license requirement.
The Department for Energy Security and Net Zero and their appointed contractors – where we have a duty to disclose or share your personal data to comply with an obligation of grant-funded projects that we are participating in. Please note that they may contact you to invite you to participate in a survey.

We may share your Personal Data at any time if required for legal reasons or in order to enforce our terms or this Privacy Policy.

4.2 Third-Party Links

This Site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Site, we encourage you to read the privacy policy of every website you visit.

5. HOW LONG WILL WE RETAIN YOUR DATA FOR?

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period than usual in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

By law we have to keep basic information about our customers relating to purchases (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax and other regulatory purposes. As a legal requirement we retain your transaction data for a period of ten years after your purchase.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

6. AGE LIMIT FOR OUR USERS

You must not use Our Services unless you are aged 18 or older. If you are under 18 and you access Our Services by lying about your age, you must immediately stop using Our Services.

7. INTERNATIONAL TRANSFER OF DATA

Whilst we are based in the UK, we work with third parties based elsewhere. Their processing of your data may involve us needing to transfer it outside of the UK andEuropean Economic Area (EEA). Whenever we do this, we will always ensure appropriate safeguards are in place so there isa similar degree of protection as if it were being processed in the UK. For example, our contracts with third parties stipulate the standards they must always follow. If you wish for more information about these contracts please contact us using the details below. Any transfer of personal data will follow applicable laws and we will treat the information under the guiding principles of this Privacy Policy.

8. NOTIFICATION OF CHANGES AND ACCEPTANCE OF POLICY

We keep our Privacy Policy under review and will place any updates on this webpage.

9. CONTACT DETAILS

We are not obliged by the GDPR to appoint a data protection officer and have not voluntarily appointed one at this time. Therefore, any inquiries about your data should either be sent to us by email at contact@sunsave.energy or sent in a letter to 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. You can access their website for further information and also live chat (www.ico.org.uk), or call them on 0303 123 1113. We would, however, appreciate the chance to deal with your concerns before you approach the ICO.

10. INTERPRETATION

All uses of the word "including" mean "including but not limited to" and the enumerated examples are not intended to in any way limit the term which they serve to illustrate.

Our staff are not authorised to contract on behalf of Sunsave Group Ltd or its affiliates Sunsave UK Limited and Sunsave Energy Limited, waive rights or make representations (whether contractual or otherwise). If anything contained in any communications from us contradicts anything in this policy, our terms or any official public announcement on our website, or is inconsistent with or amounts to a waiver of any of our rights, the communications content will be read down to grant precedence to the latter. The only exception to this is genuine correspondence expressed to be from the legal department of Sunsave Group Ltd or its affiliates:

SUNSAVE GROUP LTD (Company Number 137418) registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
SUNSAVE UK LIMITED (Company Number 13941186) registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
SUNSAVE ENERGY LIMITED (Company Number 13952135) registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Last updated 25th January 2024