Last Updated: 27 November 2023
1.Introduction
Pozitive Telecom Ltd (we, our, us) is a company registered in England & Wales (registration number 07764492) with our registered office at The Octagon, 27 Middleborough, Colchester, CO1 1TG.
We are the data controller for your personal data. We are responsible for deciding how we process personal information about you and this Privacy Notice sets out we process this information. We are registered with the Information Commissioner’s Office (“ICO”), registration number ZB537181.
We, together with our associated companies, provide services including energy, telecommunication, water, payment and Electric Vehicle charging (and any others that may be added from time to time and updated here) to our customers. The personal data we process is used to manage your relationship with us or an associated company (whether as a consumer or commercial relationship), comply with legal obligations and pursue our legitimate business interests.
Any changes we may make to this Privacy Notice will be updated on our websites and, where appropriate, notified to you in writing. Should you have any queries relating to this notice please contact our Data Protection Manager using the address at the start of this privacy policy, so that they can do their very best to sort out the problem or email us at: datacontroller@pozitive.energy.
2.Data we collect
We will only ask for information that we need. We collect personal data to be able to provide our products and services to you. Where necessary, we may also collect personal data from others associated with you, for example if they are a beneficiary of the service e.g. including but not limited to your employees, contractors, agent or relatives. By giving us information about someone else for the purpose of arranging the service, you confirm that you have their permission to do so and that you have shared this Privacy Notice with them.
We collect, use, store and transfer different kinds of personal data about you, depending on the service(s) we provide to you. We have grouped the data together as follows:
- Identity Data includes first name, last name, title, gender, date of birth, identification numbers including copies of your passport, visa, driving licence, home address, personal telephone number, personal e-mail address, device identifiers.
- Health Data includes type of vulnerability or impairment that may affect how services are accessed.
- Contact Data includes billing address, business e-mail address and business telephone numbers.
- Financial Data includes bank account, payment card details.
- Transaction Data includes details about payments to and from you, other details of services you have purchased from us and usage data including who you make contact with and who contacts you.
- Technical Data includes Internet Protocol (IP) address, your login data, browser type and version. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy [ADD LINK – Cookie Policy] for further details.
The technical data we collect also includes your mobile device time zone setting and location, location history, mobile device telemetry data, mobile device data.
-
Profile Data includes your username and password, your interests, preferences, feedback and survey responses.
-
Usage Data includes information about how you use our website, products and services, for example communications you made and received, websites you visited, performance metrics for example duration, time and cost of the communications, frequency of website access, service quality data.
-
Marketing and Communications Data includes your preferences in receiving marketing from us.
-
Other Personal Data includes personal data you otherwise voluntarily provide, for example when corresponding in writing (including via email or other electronic means), in meetings or during phone conversations or entered into any of our websites.
The personal data collected will depend on whether you are a sole trader or corporate entity.
The majority of the personal data provided by you is mandatory in order for us to administer the client relationship and perform our obligations under our contract(s) with you and/or comply with statutory requirements relating to the services we provide to you. Failure to provide mandatory personal data may affect our ability to perform the service and potentially affect your ongoing client relationship with us.
We take the security of personal data very seriously. We have administrative, physical and technical safeguards in place to protect personal data against unlawful or unauthorised processing, or accidental loss or damage. We will ensure, where personal data are processed that:
- The processing is recorded, and the record sets out, where possible, a suitable time period for the safe and permanent erasure of the different categories of data in accordance with our Data Retention Policy.
- Where we no longer require Personal Data for the purpose for which it was collected, we will delete it or render it permanently anonymous as soon as possible.
- Where records are destroyed, we will ensure that they are safely and permanently disposed of. The list set out above is not exhaustive, and there may be other personal data which we may collect, store and use in the context of the client relationship.
3.How we use your data and the lawful basis
Your data will be anonymised when we use it to test, develop and improve our services.
By law we are required to explain what information we collect from you and how and why we use your personal information (the "processing activity"). We are also required to have a "lawful basis" on which to process your personal information. This is summarised in the table below.
Where we use your data to test, develop and improve our services the data will be anonymised.
Purpose/Activity |
Type of data |
Lawful basis for processing including basis of legitimate interest |
Where is the information collected from? |
How long do we keep the information for? |
To register you as a new customer or renew your contract |
(a) Identity
(b) Contact
(c) Financial
|
Performance of a contract with you
|
From you when you contact us directly by phone or email, or when you use our website, including our customer portal.
|
3 years with exception of call recordings.
3 months for call recordings.
|
To process and deliver your order including:
(a) Manage payments, fees and charges
(b) Collect and recover money owed to us
|
(a) Identity
(b) Contact
(c) Financial
(d) Transaction
(e) Marketing and Communications
|
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to recover debts due to us)
|
From you when you contact us directly by phone or email, or when you use our website, including our customer portal.
|
3 years with exception of call recordings.
3 months for call recordings.
|
To manage our relationship with you which will include:
(a) Notifying you about changes to our terms or privacy policy
(b) Asking you to leave a review or take a survey
(c) Monitor service levels
(e) Run coverage checker
|
(a) Identity
(b) Contact
(c) Profile
(d) Technical
(e) Marketing and Communications
(f) Health
|
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests (to keep our records updated, give you access to services for Vulnerable Customers, and to study how customers use our services)
(e) Necessary for our legitimate interest to ensure we provide you with accurate results of our network
|
From you when you contact us directly by phone or email, or when you use our website, including our customer portal.
|
3 years with exception of call recordings and cookies.
3 months for call recordings.
Please refer to the cookie policy cookie policy for the retention periods.
|
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
|
(a) Identity
(b) Contact
(c) Technical
|
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or restructuring exercise)
(b) Necessary to comply with a legal obligation
|
From third parties – including third parties who provide services to you and us, credit reference, fraud prevention or government agencies and financial institutions (where permitted by law).
|
3 years with exception of call recordings and cookies.
3 months for call recordings.
Please refer to the cookie policy cookie policy for the retention periods.
|
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you
|
(a) Identity
(b) Contact
(c) Profile
(d) Usage
(e) Marketing and Communications
(f) Technical
|
Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
|
From the technology which you use to access our services (for example an IP address or telephone number) and how you use it;
|
3 years.
|
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences
|
(a) Technical
(b) Usage
|
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
|
From the techology which you use to access our services (for example an IP address or telephone number) and how you use it;
|
3 years with exception of cookies.
Please refer to the cookie policy cookie policy for the retention periods.
|
To make suggestions and recommendations to you about goods or services that may be of interest to you
|
(a) Identity
(b) Contact
(c) Technical
(d) Usage
(e) Profile
(f) Marketing and Communications
|
Necessary for our legitimate interests (to develop our products/services and grow our business)
|
From you when you contact us directly by phone or email, or when you use our website, including our customer portal
|
3 years with exception of call recordings and cookies.
3 months for call recordings.
Please refer to the cookie policy cookie policy for the retention periods.
|
To market our products and services (including promotional offers) and those of our associated companies
|
(a) Identity
(b) Contact
(c) Technical
(d) Usage
(e) Profile
(f) Marketing and Communications
|
(a) Consent
(b) Necessary for our legitimate interests (to develop our products/services and grow our business)
|
From you when you contact us directly by phone or email, or when you use our website, including our customer portal
|
3 years with exception of call recordings and cookies.
3 months for call recordings.
Please refer to the cookie policy cookie policy for the retention periods.
|
To undertake checks for the purposes of preventing fraud and money laundering and to verify your identity
|
(a) Identity
(b) Contact
(c) Financial
(d) Employment
(e) Technical
|
Necessary for our legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws and meet the regulatory requirements that apply to us.
|
From you and third parties e.g. credit reference agencies.
|
3 years with exception of cookies.
Please refer to the cookie policy cookie policy for the retention periods.
|
3.1 Credit reference and fraud prevention considerations
Before we provide services to you, we undertake checks for the purposes of preventing fraud and money laundering and to verify your identity. These checks require us to process personal data about you.
We also continue to exchange information about you with Credit Reference Agencies (CRAs) on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at http://www.experian.co.uk/crain/index.html.
3.2 Automated Decisions
As part of the processing of your personal data, decisions may be made by automated means. This means we may use automated processing methods to assess if you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision-making, so if you want to know more please contact us on the details below [ADD LINK TO PARA 10].
3.3 Consequences of Processing
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services you have requested or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details below [ADD LINK TO PARA 10].
4.Who we share your personal data with
Your personal data may be shared with third parties to fulfil part of the contract between us and them to enable us or them to provide the services to you and to comply with legal obligations:
-
Associated companies including Pozitive Payments Ltd, Pozitive Energy Ltd, First Business Water Limited to market their products or services that may be of interest to you. (Your consent may be required for us to do this.)
-
Organisations who provide us with IT and system administration services.
-
CRAs, law enforcement agencies, fraud prevention agencies, judicial bodies or tax authorities;
-
Government entities, authorities, regulatory and industry bodies.
-
Organisations who provide us with administration and processing services in order to provide a service to you, manage your account, maintain our relationships with you and for ongoing customer service, spam detectors.
-
Other communications companies where you switch providers.
-
Financial institutions if you enter into a handset and airtime agreement and organisations providing payment services which manage payments and direct debit instructions on our behalf in order to collect payments from you.
-
Accountants, lawyers, notaries and other professional advisers when considering, structuring, documenting, concluding, terminating, varying, amending or renewing a particular transaction already in place with you.
-
Companies that provide you with benefits or services associated with your good or service.
-
Revenue protection and debt collection services in order to enable debt recovery.
- Organisations that help you with complaints management in order to respond to a complaint you made about us.
- Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
5.Data security
We have policies, rules and technical and organisational measures in place to protect your personal data from unauthorised or unlawful processing and against accidental loss, destruction or damage.
We also have procedures in place to deal with any data security breach. We will notify you and any applicable regulator of a data security breach where we are legally required to do so.
Communications between you and us may route through a number of countries before being delivered, may be intercepted by third parties and may not always reach the intended recipient – this is the nature of the World Wide Web/Internet. We cannot accept responsibility for any such unauthorised access or loss of personal information that is beyond our control.
You are responsible for protecting your username and password and must not share it with, or disclose it, to anyone.
6.International transfers of Personal Data
Your personal data may be shared with organisations based outside of the UK. These countries may not have the same data protection laws as the country in which you initially provided the information and may not provide the same level of protection.
If we transfer personal data outside of the UK, we may rely on a decision from the Secretary of State determining that the recipient country provides an adequate level of protection. Alternatively, we may rely on appropriate safeguards in respect of transfers of personal data to a country outside of the UK, for example, by agreeing standard contractual clauses adopted by the ICO.
7.Your rights
Data protection laws provide you, as an individual, rights to:
-
access – you can request access to your personal information (a data subject access request), so you can check what data we hold about you and are using it in accordance with the law.
-
rectification – you can ask us to correct personal information that we hold about you.
-
erasure – you can ask us to delete your personal data where there is no good reason for us to hold this data. You can also ask us to delete or remove your personal information where you have exercised your right to object to processing.
-
restriction of processing – you can ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
-
data portability – you can ask for a copy of the data we hold about you, in an accessible format and the right to transfer it, or to require us to transfer it directly, to another controller.
-
object to processing – you can object to the processing of your personal information and there is something about your particular situation which makes you want to object to processing on this ground.
-
not to be subject to automated decisions - You have the right to object to any automated decision making, including profiling, where the decision has a legal or significant impact on you.
-
withdraw consent - you have the right to withdraw your consent where we are relying on it to use your personal data; and
-
objection to marketing. – you have the right to withdraw your consent to receive digital marketing material.
No fee is required to claim any of these rights. However, we may charge a reasonable fee or refuse to comply if your request for access is considered to be unfounded or excessive. If you wish to exercise any of your rights, please contact us using the details set out below.
8.Complaints, requests exercise your rights and our contact details
If you have any queries or concerns regarding our processing of your personal data, would like to exercise any of your rights or would otherwise like to make a complaint, please contact our Data Protection Manager in the first instance at datacontoller@pozitive.energy.
You have the right to make a complaint at any time to the Information Commissioner’s Office. Their contact details are:
Telephone: 0303 123 1113
Email: casework@ico.org.uk
Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk
However, please contact us in the first instance if you have any issue that you wish to discuss.