Privacy notice
Who are we and what do we do?
Gateshead Energy Company Limited, (registered company number 09720758), is wholly owned and operated by Gateshead Council with a registered address of Civic Centre, Regent Street, Gateshead NE8 1HH. It provides the following services:
- supply heat and power to customers via the Gateshead District Energy Network
- manage, maintain and operate Gateshead District Energy Network
- deliver net zero energy solutions for Gateshead District Energy Network
- develop and deliver other major energy projects to support the aims of the company, and its owner, Gateshead Council
This privacy notice provides specific information about how Gateshead Energy Company Ltd processes your personal data.
The roles and contact details for Gateshead Energy Company in this privacy notice include council employees working on behalf of the company.
What type of information is collected about you
- name
- address
- contact details
- if applicable, whether you are classed as vulnerable and the reasons for the vulnerability
- if applicable, household income information to confirm eligibility for our schemes
- if applicable, proof of property ownership
We collect the following special category data:
Health information, so that we can support you in cases of vulnerability where you are our energy customer. This information may also be collected to confirm your eligibility for one of our schemes.
How we collect information about you
Your information will be collected when:
- you fill out and agree to the terms in your heat and/or power supply agreement when you become a customer
- you complete an application form for an energy scheme
- we communicate with you, either by email, phone, on the doorstep or by written correspondence
- any updated information is shared with us, for example a change in vulnerability status
Why we need your information
Our purpose for collecting your personal data is to:
- provide billing information with regards to your heat and/or electricity usage
- in some cases, to provide extra support to the vulnerable
- provide orders for work to be carried out at your property
- confirm eligibility for an energy efficiency scheme
The lawful basis for our processing is:
- performance of a contract to which the data subject is a party
- legitimate interests
Our lawful basis for processing of sensitive personal data is:
- substantial public interest
Who your information can be shared with
This privacy notice sets out the general types of information sharing that Gateshead Energy Company carries out to fulfil its service delivery. Gateshead Energy Company can share your information with:
- any agreed contractor who will be carrying out the works on behalf of the company, which may involve your property
- the funding provider for the energy efficiency scheme you have applied for, as applicable
Our lawful basis for this sharing is contract and your consent is not required.
If we wish to share your information with third parties for purposes outside of those listed above, we will ask for your permission.
We engage data processors to deliver some services on our behalf.
- Gateshead Council, as the service provider for day-to-day operation and management of Gateshead Energy Company
- The metering and billing provider we employ, relevant to the residential supply agreement with you
We have binding contracts with these processors to control the use of personal data and ensure it is processed securely and only for the agreed purposes.
Where your information is held
Your data is stored on a database and password protected files.
Information is kept on a secure (password) protected drive within Gateshead Council's IT system.
How you can update your information
The accuracy of your information is important to us to be able to provide relevant services more quickly. If you change your address or email address, or if any of your circumstances change or any of the other information we hold is out of date, please contact: energyservices@gateshead.gov.uk
Your information rights
UK GDPR provides the following rights for individuals:
1. The right to be informed
You have the right to be informed about the collection and use of your personal data. This is a key transparency requirement under the UK GDPR. This includes our purposes for processing your personal data, our data retention periods, and who we share it with. We must provide privacy information to you at the time we collect your personal data.
2. The right of access
You have the right to access and receive a copy of your personal data, and other supplementary information. This is commonly referred to as a subject access request or 'SAR'. Individuals can make SARs verbally or in writing.
3. The right to rectification
You have the right to have inaccurate personal data rectified, or completed if incomplete. You can make a request for rectification verbally or in writing. In certain circumstances we can refuse a request for rectification. This right is closely linked to the controller's obligations under the accuracy principle of the UK GDPR (Article (5)(1)(d)).
4. The right to erasure
You have the right to have personal data erased. This is also known as 'the right to be forgotten'. The right is not absolute and only applies in certain circumstances. Individuals can make a request for erasure verbally or in writing.
5. The right to restrict processing
You have the right to request the restriction or suppression of your personal data. This is not an absolute right and only applies in certain circumstances. When processing is restricted, we are permitted to store the personal data, but not use it. An individual can make a request for restriction verbally or in writing.
6. The right to data portability
You have the right to obtain and reuse your personal data for your own purposes. It allows you to move, copy or transfer personal data. Safe and secure transfer from one IT environment to another enables use of other applications and services, for example to find you a better deal or help you understand your spending habits. The right only applies to information an individual has provided to a controller.
7. The right to object
You have the right to refuse the processing of your personal data in certain circumstances. You have an absolute right to stop use of your data for direct marketing. You can make an objection verbally or in writing. You may not be able to object to the holding, using or sharing of your information under certain circumstances. Examples include:
- where we have a duty to safeguard a vulnerable adult or a child
- where data is required for the prevention and detection of crime
- where we are required to fulfil our statutory obligations
8. Rights in relation to automated decision-making and profiling
The UK GDPR also has provisions on:
- automated decision-making - decisions made solely by automated means without any human involvement
- profiling - automated processing of personal data to evaluate certain things about an individual (can be part of an automated decision-making process)
Article 22 of the UK GDPR also has rules protecting you from legal or significant effects of solely automated decision-making.
If you would like to exercise your information rights or need any more information about them, please contact:
Data Protection Officer
Civic Centre
Regent Street
Gateshead
NE8 1HH
0191 433 3000
Marketing and e-newsletters
Gateshead Energy Company always acts upon your choices around what type of communications you want to receive and how you want to receive them. Where you have signed up for one of our newsletters, we use email newsletters to inform you of what we're doing, news and events. We may write to existing customers to tell you about other energy services that we can offer to you.
Business intelligence
We may analyse personal information to improve services and for the following purposes:
- analysing our performance at delivering services to you
- understanding what we can do for you and informing you of other relevant services and benefits
- understanding your needs and planning services accordingly
Gateshead Energy Company commits to use pseudonymised or anonymised information where practical. In most cases this is the default position.
Pseudonymisation replaces fields within personal data with one or more artificial identifiers. There can be a pseudonym for a collection of replaced fields or one per replaced field.
Anonymisation removes details (especially from medical test results) for statistical or other purposes.
Profiling and automated decision-making
Profiling is the processing of personal data to analyse or predict certain characteristics. For example, a person's economic and health situation, reliability, personal preferences or interests.
Automated decision-making is profiling carried out without any element of human review. For example, carrying out credit checks and searches to detect and reduce fraud.
At present, we do not intend to carry out any profiling or automated decision-making.
How long we keep your information
We review our retention periods of the information we hold about you on a regular basis. We must hold some types of personal information to fulfil our statutory obligations.
We will hold your personal information on our systems as long as is necessary for the activity or service provided, or as required by law. We have a Record of Processing Activity (ROPA) document that sets out the retention periods for the personal data that we process. For more information contact energyservices@gateshead.gov.uk
How we protect your personal information
Any information held by Gateshead Energy Company about individuals is held securely and in compliance with the Data Protection Act 2018 and GDPR. Information is held electronically on secure servers and cloud storage solutions. Paper records are stored securely in accordance with council policies and procedures.
Gateshead Energy Company is committed to protecting its service users' personal data. Our data measures ensure best practice for staff, service providers, partners and suppliers. Measures are lawful and follow rules and practices known as Information Governance (IG).
The information security measures we've put in place include:
- encrypting all our electronic devices and sensitive information that is transmitted
- following good IG practice and the law for collecting, handling and giving access to information
- holding information for no longer than required and disposing of it securely
- permitting access to your information only to those who need to know and where it is necessary
- putting processes in place to ensure good IG practices for information we collect, hold or handle in both manual and electronic forms
- training staff in their data protection responsibilities
Data Protection Officer
Data Protection Officer
Civic Centre
Regent Street
Gateshead
NE8 1HH
DPOcouncil@gateshead.gov.uk
0191 433 3000
Information Commissioner's Office
The Information Commissioner is the UK's independent body set up to uphold information rights.
If you would like to know more about your rights under the Data Protection law, and what you should expect from us, visit the Information Commissioner's website (opens new window).
If you have any concerns about our privacy practices or about exercising your Data Protection rights, you may contact the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
0303 123 1113 or 01625 545 745
casework@ico.org.uk
Share this page
