Privacy Police

Manchester Energy Partnership Limited (MEPL)
Privacy Notice for Octagon Project Energy Network (OPEN)

Last Updated: 16 October 2022

Introduction

MEPL is working with MEPL and its group companies to install a heating and hot water system for specific businesses in Manchester. If your property is to be connected to the new system, we will collect personal data about you and your business (“you” or “your”) when we carry out a pre- installation survey of your premises. This will include asking questions, taking photos and creating a drawing of the property layout.

When we collect personal data from you during the surveys, the data controller is MEPL Limited (“MEPL”, “we”, “our”). This privacy notice explains why and how we’ll collect your personal data, how we’ll use it and what your rights are. MEPL, its affiliates, subsidiaries and related entities are committed to protecting the privacy and security of your personal data.

Personal data we collect

We collect information including personal data when we carry out a pre-installation survey at your business. This will include:

· · · · · · ·

Your name
Telephone number
Number of other residents at the property
Photographs of the door and interior of the property Drawing of the interior layout of your property Language Spoken

Purposes for which we use personal data and the legal basis

When we collect your personal data, we will use it for the following purposes and on the following lawful bases:

also ask if there are any special circumstances, we need to be aware of when working in your

Purpose	Lawful Basis for Processing
Communicating with you. We will use your contact details to confirm the dates and times that we need access to your business to connect it to the new energy system	Our legitimate business interest to communicate with the residents in properties that we have been contracted to connect to the new energy network by Manchester City Council.
Pre-installation planning. We will use the photographs and drawings to make preparations to install radiators, pipework and a heating interface unit in your business.	Our legitimate business interest to plan and prepare to connect your business to the new energy system, install new heating equipment and ensure the work is carried out efficiently and safely.
Ensuring the health and safety of our workers. We will use the information collected during the survey to assess whether there are health or safety risks when working in your business.	Our legitimate business interest to protect our employees and workers and ensure their health and safety when working.
Creating billing information. We will use your name and contact details to create energy billing information for your business.	Our legitimate business interests to set you up on our billing system, so we can send you bills for your energy consumption on behalf of Manchester City Council.
Sharing billing information with the energy service provider. We will share your name and contact details with MEPL and its group companies for billing purposes.	Our legitimate business interests to provide MEPL and its group companies with the information they require for billing purposes, so we can issue bills on their behalf and be paid by them for your energy consumption.
Sharing data with entities in our group. Including sharing customer records with our subsidiaries and affiliates.	Our legitimate business interest to share your personal data with our subsidiaries and affiliates for administration and management purposes.
Purpose	Lawful Basis for Processing
Sharing data with other third parties. Including third parties who process personal data on our behalf.	Our legitimate business interest to share your data with trusted third parties who provide us with services relevant to our provision of services to you.
Contact you for feedback. Including sending you customer satisfaction surveys	Our legitimate business interest to collect your feedback, develop our products and services and improve our business
Internal management, administrative and organisational purposes. This includes maintaining internal records and carrying out other business administration tasks.	Our legitimate business interest to process your personal data in order to manage our business.
Statistics and other data analysis. This includes creating forecasts and business plans, improving our services and developing new services.	Our legitimate business interest to process your personal data to develop and improve our business through aggregated and anonymised reporting and analysis.
Meet our legal obligations. Including any laws or regulations which apply to us.	Necessary to comply with legal obligations to which we are subject.
Detect and prevent crime, fraud or loss. Including stealing energy such as by tampering with a meter.	Our legitimate business interest to detect and prevent crime, fraud and loss.

Sharing your data

We will share your personal data with MEPL and its group companies because they are the energy service provider and will need to the information to issue bills to you (or to have a supplier issue bills to you on their behalf) for your energy consumption. When we transfer your personal data to MEPL and its group companies they will be data controller for the uses they make of it from then on as set out in their privacy notice.

We also share your personal data with trusted third parties who provide us with services. This includes our professional advisers, IT service providers, cloud software providers, engineering sub- contractors and other suppliers and sub-contractors. All such third parties are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We also share your personal data with other MEPL entities in our group for administration and management purposes. We may also share your personal data where we are required to do so by law.

In some circumstances, we or one of our suppliers may host, store or handle your personal data outside the European Economic Area. We will only permit this to happen if the country in which your personal data will be processed benefits from a European Commission adequacy decision or where standard contractual clauses approved by the European Commission have been put in place with the recipient which contractually oblige it to process and protect your personal data to the standard expected within the EU/EEA.

How long we keep your data

We will keep your name and contact details whilst we provide energy to your business and send bills to you on behalf of MEPL and its group companies and for two years after. We will keep all other information collected during the survey, including photographs, for two years after the end of the year in which we connected your business to the district heating network.

At the end of the retention period, your personal data will be securely deleted or anonymised, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning.

How we protect your data

We implement appropriate technical and organisational measures to protect data that we process from unauthorised disclosure, use, alteration, or destruction.

Your rights and options

You have the following rights in respect of your personal data:

· You have the right of access to your personal data and can request copies of it and information about our processing of it.
· If the personal data we hold about you in incorrect or incomplete, you can ask us to rectify or add to it.
· Where we are using your personal data with your consent, you can withdraw your consent at any time.
· Where we are using your personal data because it is in our legitimate interests to do so, you can object to us using it this way.
· Where we are using your personal data for direct marketing, including profiling for direct marketing purposes, you can object to us doing so.
· You can ask us to restrict the use of your personal data if:

o It is not accurate.

o It has been used unlawfully but you do not want us to delete it.

o We do not need it anymore, but you want us to keep it for use in legal claims; or

o If you have already asked us to stop using your data but you are waiting to receive confirmation from us as to whether we can comply with your request.

· In some circumstances you can compel us to erase your personal data or to request a machine- readable copy of your personal data to transfer to another service provider.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, please contact us at bepartofit@octagonproject.co.uk
You can also lodge a complaint with the Information Commissioner’s Office. They can be contacted

using the information provided at: https://ico.org.uk/concerns/.

Contact us

If you have any questions, or wish to exercise any of your rights, then you can contact via 0161 282 4528

Changes to this privacy notice

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify of the changes where required by applicable law to do so.