Privacy Policy

This privacy policy will explain how our organisation uses the personal data we collect from you when you use our website.  The information on this page relates to use of the website and platforms operated by the Guernsey Electricity Retail Shop. 

Topics

• Introduction
• Contact Details
• What Personal Data Do We Collect?
• What Special Category Data Do We Collect?
• The Purposes of Our Processing
• The Lawful Basis for Our Processing
• What Are Your Legal Rights?
• Existence of Automated Decision Making
• Retention Periods
• Data Sharing
• Linking to Third Party Websites
• Transfers to Other Countries or International Organisations
• Security
• Disclaimer

Introduction

Guernsey Electricity Limited (We, Us, Our) takes the privacy of your personal information very seriously.  This Privacy Notice explains how and for what purposes We use and disclose the information We collect about you when you use our Retail website and what your legal rights are.  Please read this Privacy Notice carefully.  By using Our Retail website and any products and services We offer or by participating in any of Our competitions or initiatives, you are agreeing to be bound by this Privacy Notice in respect of the information We collect, use and disclose about you.

The Data Protection (Bailiwick of Guernsey) Law, 2017 (as amended) which incorporates the EU General Data Protection Regulations (together the “2017 Law”) recognises the importance of safeguarding individuals’ personal information and places legal obligations on those who collect, use and disclose such information.  Personal information is “any information relating to an identified or identifiable [living] individual” and is defined as “Personal Data” under the 2017 Law.  In practice, this definition is very broad and includes both factual information about individuals as well as opinions expressed about individuals and anonymised data that could identify individuals if it was combined with other information.

Some Personal Data is treated under the 2017 Law as falling within a special category if it is of a sensitive nature defined under the 2017 Law as “Special Category Data”.  Special Category Data is either “Personal Data revealing an individual’s racial or ethnic origin; political opinion; religious or philosophical belief or trade union membership” and/or “genetic data; biometric data; health data; Personal Data concerning an individual’s sex life or sexual orientation or criminal data”.

The collection, use and disclosure of Personal Data and Special Category Data are included within the definitions of “processing” and “process” under the 2017 Law and for the purposes of this Privacy Notice, the term “processed” shall have the same meaning.

We are regarded as the “Controller” of Personal Data and Special Category Data under the 2017 Law in relation to Our processing of such information and so We are legally required to provide you with this Privacy Notice.  You are regarded under the 2017 Law as the “Data Subject”.

Please note that We will regularly review this Privacy Notice and so its content may vary from time to time.  It is important that you read this Privacy Notice together with any other privacy notice We may provide on specific occasions when We are processing your Personal Data and Special Category Data, so that you are aware of how and why We are processing such information.

Contact Details

If you have any questions about this Privacy Notice, please contact Our Data Protection Officer at:-

   The Data Protection Officer
   Guernsey Electricity Limited
   Electricity House
   Northside
   Vale
   Guernsey
   GY1 3AD

E-mail: data.protection@electricity.gg

Telephone: +44 (0)1481 200700.

PLEASE NOTE:- We cannot give legal advice about your rights and you should seek your own independent legal advice or contact the Guernsey Office of the Data Protection Authority (ODPA) at:-

   The Office of the Data Protection Authority
   St Martin's House
   Le Bordage
   St. Peter Port
   Guernsey
   GY1 1BR

Email: enquiries@odpa.gg

Telephone: +44 (0)1481 742074.

Note that you have the right to lodge a complaint with the ODPA as the supervisory authority appointed under the 2017 Law.

What Personal Data Do We Collect?

We may collect the following types of Personal Data about you when you communicate with Us for any reason or use and/or purchase Our products and Our services or participate in Our competitions or initiatives:-

PLEASE NOTE:- If you are 16 or under, you must ask your parent or guardian’s permission before entering any of Our competitions or participating in any of Our initiatives or providing any Personal Data to Us.

When you use the Retail Shop website, we collect the following information:

• Website Cookies
• IP Address(es) (an IP Address is a number that can uniquely identify a specific computer or other network device on the internet).

Please read our Cookie Policy for further information about how we use and store cookies.

When you register an account with us, place an order using the Retail website, contact us about a product, submit a review, use chat, leave a message, or enter competition we may collect the following information:

• Full Name
• Title
• Address(es) (including of locations to which Our products and services are supplied and:-
  • May include details of how to access the property or
  • May include building layouts)
• Billing Address(es) (if different from delivery address(es))
• Telephone Number(s)
• E-Mail Address(es)
• Date of Birth and Photo ID may be required when signing up to a Third Party Finance agreement.
• Identifiers such as Customer Account Reference Number(s) or Username.

The following financial details will be processed by our payments provider when you place an order:-

• Transaction Details
• Note that we are not permitted to store Credit or Debit Card Details, as required by the PCI-DSS standard. For processing online payments you will be redirected to a third party service provider who processes those details.

Personal Data may also be collected by Us from other people acting on your behalf, with your prior knowledge and approval (and as verified by Us), (e.g. by agents, professional advisers or family members).

Personal Data may also be collected about you from commercial or public third parties, (for example as part of credit control or in marketing surveys).

If you fail to provide certain information when requested, We may not be able to perform the contract We have proposed to enter or entered with you or We may be prevented from complying with Our legal obligations.

What Special Category Data Do We Collect?

We may collect the following relevant Special Category Data about you when you are dealing with our Retail section:-

• Health Data
  Health data will be kept by Us where it is legal, reasonable and necessary to do so in respect of health and safety.
• Biometric Data
  Biometric data is Personal Data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or fingerprint data.
  
  Your biometric data may also be processed by Our CCTV which is in operation on Our premises. This is to ensure the security and safety of Our staff, customers, premises and systems against criminal activity or damage or anti-social behaviour, for example.
  
  We may ask you to provide Photo ID when signing up to a Third Party Finance agreement.  This will only be used in your application and will not be stored by us.

For the purposes of this Privacy Notice, Personal Data and any relevant Special Category Data shall together be regarded below as “Data”.

The Purposes of Our Processing

Provided We are lawfully permitted to, the purposes for which We process your Data will be made clear to you at the point We collect that Data from you.  Provided We are lawfully permitted to, We will not process your Data for purposes that are not made clear by Us when it is collected by Us.

Generally, the Data you provide Us on our Retail website is processed by Us in order to:-

• Respond to any enquiries that you may have
• Provide and pay for the products and services you request
• Provide you with additional services in relation to products you have purchased from Us or services which We provide to you
• Verify your identity
• Administer and manage any account(s) that you may have with Us (or that you manage on another’s behalf)
• Carry out marketing analysis and make general improvements to Our website and any products and services We offer
• Obtain your views or comments on the products and services We provide
• Contact the winners of Our competitions or successful participants or recipients in respect of Our initiatives and to help Us plan other promotional activity or initiatives
• Send you information We think you might find useful or which you have requested from Us, including information about Our products and services or those of carefully selected third parties provided you have indicated that you are happy to be contacted for these purposes.

We will process Data We hold about you to help Us confirm your identity and ensure such information is protected from unlawful disclosure and to also ensure such Data is not changed so far as possible without your prior knowledge and approval.

You may provide your consent for Us to process your Data for direct marketing, to allow Us to keep you informed of products and/or services that We offer, or in promotional activity, (such as competitions and initiatives).  We cannot process your Data for these purposes without your explicit and freely given consent to the processing of such Data for such purposes, which We will request before We process such Data for such purposes.  You have the legal right to withdraw your consent to direct marketing and promotional activity at any time and can do so by contacting Our Retail team at: shop@electricity.gg

The Lawful Basis for Our Processing

The 2017 Law requires that We have a lawful reason for processing your Data.  We will therefore only process your Data where the 2017 Law allows Us to do so.

When you use our Retail services, the lawful basis upon which We may process your Data are as follows:-

• Contract
  We rely upon this lawful basis where We need to process your Data in order to deliver a contractual service to you or because you have made an enquiry before entering into a contract with Us (e.g. in providing a quote), for example.
• Legal Obligation
  In some cases We need to process your Data to comply with a legal or regulatory obligation. As part of Our legal obligations, We may be obliged to disclose your Data to public and regulatory authorities, law enforcement agencies and similar official bodies, for example.
• Legitimate Interests
  This is a wide-ranging lawful basis which covers the processing of your Data which you would reasonably expect to happen, where that processing is necessary for Our legitimate interests, or those of a third party, and your interests do not override those legitimate interests.
• Consent
  When We ask you for consent to process your Data, that consent must be freely given, explicit and with a positive action to opt-in. It must be clear to you as to what purposes your Data will be processed by Us you are consenting to. 
  
  We will keep records of your consent and, as stated above, you have the legal right to withdraw your consent at any time.

Some of the above lawful grounds for processing your Data will overlap and there may be several grounds which justify Our processing of your Data.

You should note that the lawful basis We rely upon will affect the legal rights that are available to you.

What Are Your Legal Rights?

Depending on the lawful basis relied upon by Us to process your Data, the 2017 Law provides that you have or may have the following legal rights in respect of your Data:-

1. The Right to be Informed
   You have the right to be informed about Our processing of your Data, including details of the purpose of the processing, Our Data retention periods and who that Data will be shared with.
   
   
2. If We plan to process any Data for a new and unrelated lawful purpose, We will update Our privacy notice(s) where necessary and if such change directly affects you We will communicate this to you before starting any new processing.
   As part of your right to be informed, if you have any questions about how your Data is processed by Us then please contact Our Data Protection Officer at protection@electricity.gg or using Our other contact details above.
   
   
3. The Right of Access
   You may on request and free of charge, seek confirmation from Us as to whether any Data about you is held by Us and/or ask to receive a copy of your Data held by Us. This is known under the 2017 Law as a “Data Subject Access Request”.
   
   
4. The Right to Rectification
   You have the right to have the details of your Data rectified by Us if it is inaccurate, or completed if it is incomplete.
   
   We will notify any other recipients to whom your rectified Data has been disclosed unless this involves an impossible or disproportionate effort.
   
   PLEASE NOTE:- It is important that the Data We hold about you is always accurate and current. If you would like to review or change the details of your Data you have supplied Us with, you may do so at any time by contacting Us using Our contact details above.  Please keep Us informed if the details of your Data changes during your relationship with Us.
5. The Right to Erasure / “The Right to be Forgotten”
   You may have a right for your Data held by Us to be deleted.
   
   We will notify any other recipients to whom your erased Data has been disclosed unless this involves an impossible or disproportionate effort.
6. The Right to Restrict Processing
   You may have a right to request the restriction or suppression of Our processing of your Data. This means that We are permitted to store your Data but not to use or disclose it or process it in any other way.
   
   We will notify any other recipients to whom your Data has been disclosed of the need to restrict access to your Data unless this involves an impossible or disproportionate effort.

6. The Right to Data Portability
   You may have the right to Data portability. The right to Data portability gives you the right to receive Data you have provided to Us in a structured, commonly used and machine-readable format.  It also gives you the right to request that We transmit this Data directly to another controller.

7. The Right to Object
   You have the right to object where We are processing your Data for direct marketing purposes, where We are processing under the lawful basis of legitimate interests.
   
   Except in the case of direct marketing (where your right to object is absolute), We may still be able to continue processing your Data if We can show you We have a compelling reason for doing so. If We do not have a compelling reason, then We will stop processing your Data.

8. Rights in relation to Automated Decision Making and Profiling
   You have the right to challenge decisions that are made about you by Our automated processes and you have the right to object to Our profiling.
   
   Please see the section below entitled ‘Existence of Automated Decision Making’ which describes what automated decision making We undertake.

There are two other rights you have which have already been mentioned above:-

1. The Right to Withdraw your Consent
   Where you have given your specific consent to Us for your Data to be processed and this is Our lawful basis of processing your Data, you have the right to withdraw such consent. If it is not obvious as to how you can withdraw your consent, please email protection@electricity.gg or use Our other contact details above.

2. The Right to Complain
   As described in the ‘Contact Details’ section above, you have the right to make a complaint to the ODPA if you are unhappy about how your Data is being processed by Us or you think it is not in keeping with the 2017 Law.
   
   The ODPA will consider your complaint and may carry out an investigation should it consider that your complaint has reasonable grounds and is generally appropriate.

Should you wish to exercise any of the above rights then you may do so either verbally or in writing to Us.  Provided We are lawfully permitted to, We will respond to you without undue delay and at the latest within one month (which may be extended if the request is complex) of confirming your identity.

No fee is usually required.  You will not have to pay a fee to access your Data (or to exercise any of the other rights).  However, We may charge a reasonable fee if your Data Subject Access Request is clearly unfounded or excessive.

However, We can also refuse any request (a Data Subject Access Request or otherwise) you make if a lawful exemption or restriction (whether under the 2017 Law or otherwise) applies, or if the request is manifestly unfounded or excessive.

Existence of Automated Decision Making

We may recommend products or services to you based on your previous interests or purchases.

Retention Periods

We will only retain your Data for as long as necessary to fulfil the purpose(s) We processed it for.  Provided We are lawfully permitted to, We will notify you when We no longer retain your Data and the reasons why.

In many cases your Data will be kept for 6 years after the last date of Us processing your Data as this is the general legal limitation/prescription period under Guernsey law in which a legal claim can be brought by you in respect of such processing.  However, in some cases, other laws (legislation or otherwise) may require Us to keep your Data for longer periods depending on what that law provides and what type of Data is processed by Us.

We will retain your name and contact details in association with products that you have purchased from us in order that we may assist manufacturers or suppliers should there be a need to contact you in matters relating to product safety.

We will periodically review the Data We hold about you and, if lawful, delete anything We do not need.

Where possible and lawful We will anonymise your Data so that it can no longer be associated with you.  As you will no longer be identifiable from such Data, We may process such Data without further notice to you.

Data Sharing

We may share your Data with third parties where there is a legal basis upon which to do so.  We require third parties to respect the security of your Data and to treat it in accordance with the 2017 Law subject to any other overriding law (legislation or otherwise).

We will not share or sell your Data with anyone outside of Guernsey Electricity Limited except as set out below:-

• With people acting on your behalf and with your prior knowledge and approval (and as verified by Us), (e.g. your agents, professional advisers or family members).
• With third parties where it is necessary and a legal basis exists for sharing your Data with them. This includes but is not limited to:-
  • Subcontractors, (e.g. for deliveries or installations)
  • Product Manufacturers for warranties, guarantees or other after sales assistance
  • For marketing and public relations purposes, including publishing on media and social media
  • Financial advisers, including credit reference and debt collection agencies
  • Our professional advisers, (e.g. lawyers, auditors and insurers)
  • Law enforcement services, courts and tribunals
  • Government and regulatory authorities

We will not sell your data where it has been provided through this website.

Linking to Third Party Websites

We cannot be held responsible for the privacy policies and practices of other websites even if you access them using links from Our website.  We recommend that you check the policy of each website you visit and contact its owner or operator if you have any concerns or questions.

In addition, if you linked to Our website from a third party website, We cannot be responsible for the privacy policies and practices of the owners or operators of that third party website and recommend that you check the policy of that third party website and contact its owner or operator if you have any concerns or questions.

Transfers to Other Countries or International Organisations

We may transfer and store Data We collect about you with organisations based in the European Union and with other countries which are “authorised jurisdictions” as defined and permitted under the 2017 Law to process your Data and includes the UK.

The Retail website is hosted by Simple Servers in Data Centres located in the UK.

Security

This site is managed by Calculus Software Solutions Ltd, who are responsible for this site’s security.

Payments are processed by Opayo, (formerly Sage Pay).  We never store Card information.  To process payment information, you will be temporarily redirected to this third-party website to collect your payment.

Disclaimer

The details within this Privacy Notice do not nor are intended to be a definitive statement of the law of data protection as applied in Guernsey and should not be taken as legal advice.  Nor are We able to give you any legal advice on any matter referred to in this Privacy Notice.

We do not make any warranties or guarantees in relation to the content of this Privacy Notice and We do not accept any liability for any reliance you may place upon its content for legal advice.

 

This Privacy Policy was updated 10 August 2022.