In order to provide our services, we must collect and use some of your personal data. We collect only the data necessary for specific purposes that the law allows. We are a controller of this data, which means that we oversee how your data is processed.

When you use our services, we collect some data automatically. The data we collect will depend on the service you use, but it includes things like:

• Cookies and other online IDs
• Website visit length, clicks, page views, and other actions
• ISP and IP address
• Device and browser data
• Emails from us you have opened and /or clicked

Providing Our Services and Carrying out Your Requests

When providing our Services we may use your data (as applicable):

• To check your identity and eligibility for our servicesTo register and secure your account
• To enable you to obtain your supplier and estimated use, to help make energy switching easier
• To help you find our best pricing and productsTo direct you to the websites of our partners
• To process transactions between you and us, or our partners
• To track sales and get paid by our partners
• To build profiles of your use of our services and personalise your service
• To keep your data updated
• To ask for the cancellation of your products with third parties (where possible), when you have asked us to
• To provide customer service and support
• To enable you to use social sharing tools
• To complete data rights requests you have made

Improving and Promoting Our Services

To help improve and promote our services, and the services of our partners, we may use your data:

• To carry out analysis and market research
• To help present our services clearly and in the most effective way
• To run competitions, incentives, and surveys
• To help us and our partners create better products for you
• To process any rewards that we may offer to you
• To send updates and service messages about your products and services
• (Where you agree) to let you know about our services and promotions by email, social
  media, SMS, and using push notifications.
• To build, train, and augment models which help us understand your likely interests and
  those of others
• To target advertising to you, on this and other websites, based on data we have collected or
  created
• To help us understand if and how our marketing works

Sharing Your Data

We share your data with third parties to provide our services. For example, we may share data with the partners whose products you have selected. We may also share data with third parties whose services we use to run our business. Where we use third party services to run our business, these parties cannot use the personal data we share with them for their own purposes.

Product suppliers: to get quotes and help you get products

We may share your data with product suppliers to help them arrange your quotes, and to help you to get products. To help them work out your quote and decide if their products are right for you, these suppliers may use data from other sources. Examples of these data sources include the electoral roll, county court judgments, the DVLA and credit reference agencies.

Where our suppliers use credit reference agencies to help us provide you with prices, the checks may be logged on your file, but they do not harm your credit score. However, if you apply for a product, the searches they do may be recorded and could affect your credit score. The privacy
notices of suppliers set out their use of your data, and you should read them before you apply for their products.

To help prevent and detect fraud we work with partners, suppliers, other industry companies and fraud prevention agencies to share and receive relevant information.

You must answer all questions honestly, accurately, and to the best of your knowledge. Failure to do so may result in you not being offered a product, incurring additional fees and charges, being left with an invalid policy, or seeing any future insurance claim being affected. You may also be liable for any third-party costs in the event of a claim.

Product suppliers, to help create better products for you:

We may share data with product suppliers to help them carry out market research and create better products for you.

Our service providers, to help us run our business:

We may share your data with the business partners we use to provide our services. This could include using your address to get data about your property and help you find better products. For example, if you use our energy comparison, we share your address with industry partners to obtain your meter number(s) and estimated future energy use. We may also ask our survey partners to contact you, so that we can find out how to make our products better.

Advertising partners, to target our adverts to you and others:

We may share some of your data with our partners who use it to help us target our advertising to you and others. This means we try to show you adverts that we think are relevant to you and we try to stop showing you adverts that are not.

Analytics suppliers, to help us improve our services:

We may share data about your visit with analytics suppliers who help us improve our services for you and our business. This data is usually shared in a way that does not directly identify you.

We may also share your personal data with third parties:

• If we buy or sell any business or assets
  • If we buy or sell any business or assets, we may disclose your data to the prospective seller or buyer of that business or those assets, and its advisers. If we (or most of our assets) are bought, data held by it about its users will be one of the transferred assets.
• For client businesses
  • If we collect data on behalf of our clients, we will share your data with them and you will be informed when we are doing this.
• To obtain advice
  • We may disclose your data to obtain advice from lawyers and other professionals.
• For audience measurement
  • We may share your data with companies who help us to learn about who is using our services, and how they are used.
• To comply with the law
  • We may pass your data on when required to do so by law or in response to a request from law enforcement or another regulatory authority. We may disclose your data to enforce our agreements with you or to protect our rights, property, or safety, or that of our users or others. This includes sharing data for security and fraud prevention purposes.
• In emergencies
  • If we believe someone is in danger, we reserve the right to share data to help protect them.
• Anonymous data
  • We create and share general data about our consumers – you cannot be singled out within this data.

Storage of Your Personal Data

We take the protection of your data very seriously. We follow best practices to secure your data, and we only keep it when the law allows and it is needed for the purposes it was collected. The periods we keep it for vary based on the type of data and the services you have used. However, we normally keep it while you are a customer or for up to 6 years from use of our services (or 7 years where we act as a broker for insurance). If necessary, we may retain data longer where such data is
required for the resolution of a dispute.

We may store or process your data outside of the United Kingdom, where local privacy laws do not provide as much protection. When we do that, we use approved data transfer safeguards and legal frameworks (for example, Standard Contractual Clauses) to help ensure that your data is protected. By sharing your data, you agree to this transfer, storage, or processing.

Sending data over the internet is not completely secure. We will do our best to protect your data, but we cannot guarantee its security, and sharing data with us is done at your own risk.

Use of Cookies

Cookies are small text files that are widely used when you visit websites. They help us identify you from other users of our websites and apps (including when you use other websites). They help us make use of our services to be as user-friendly as possible (for example, saving your login details). We also use cookies to help target our advertising on this and on other websites.

You can adjust the settings in your browser to stop the use of cookies, but some of our services may not work if you do so.

Opting out of Collection of Data by Third-Party Advertisers

Our third-party advertising providers may target you on our websites and apps or in other places. To make those ads more relevant and help measure their effectiveness, they may use cookies and similar tools. They record your use (like the pages you have visited) to try to work out what interests you. They use this data in the ways described in their own privacy notices.

Data Governance

We process our clients’ personal data in accordance with the Data Protection Act 2018, which is governed by General Data Protection Regulations (GDPR). We are accredited in this regard by the Information Commissioners Office (ICO).

GDPR affords you the following rights:

• Right of access
• Right to rectification
• Right to erasure or restriction of processing
• Right not to be subject to automated decision-making
• Right to portability

Right of Access

You have the right to obtain a copy of the information that we hold about you. This is known as a Subject Access Request. You must cooperate with our personnel and answer any questions to ensure that we understand which and how much of your information you require. More extensive Subject Access Requests will take longer to fulfill. In any event, we will provide you with the information requested within one month of when we receive the request. For requests made in writing via post, this period will start from the date we receive your letter, not from the date it was written or posted.

Right to Rectification

If you find that any of the information that we hold about you is inaccurate or incomplete, please notify us as soon as possible. We will make all possible corrections within one month of receiving your request for rectification and notify you of the outcome of your request.

Where you dispute the accuracy of the data we hold on you, but it is not possible to ascertain whether it is accurate or not, we will instead restrict its processing.

Right to Erasure or Restriction of Processing

This is sometimes referred to as “The Right to be Forgotten.” Subject to certain exceptions – as outlined in the Data Protection Act 2018 – you may request that we erase your personal data from our records and systems. We will make all possible deletions within one month of receiving your request for rectification, and notify you of the outcome of your request.

Where we are unable to erase your data for reasons of evidence, we will instead restrict its processing.

You may restrict the processing of your personal data in the following circumstances:

• Where the personal data held is inaccurate
• When processing is unlawful
• If the need to retain your personal data no longer exists

If you wish to make a request to us regarding your right to restrict the processing of your data, please contact us as soon as possible. We will attend to your request and inform you of the outcome within one month of receiving it.

Right not to be subject to automated decision-making

In accordance with GDPR, we may not take a significant decision based solely on automated processing, unless that decision is required or authorised by law.

A “significant decision” is one that:

a. produces an adverse legal effect for you, or
b. significantly affects you

Right to portability

You can ask us to share your data with another party because you have given us consent, or when your data is used for the performance of a contract, and sharing your data does not affect the rights of others.

For further details, you can visit the ICO website at www.ico.org.uk, or consult the Data Protection Act 2018 at Data Protection Act 2018