The General Data Protection Regulation (GDPR) came into effect on 25 May 2018 and forms part of UK data protection law alongside the Data Protection Act 2018 (UK).
We use personal data to provide quotes, arrange and manage business energy contracts, and to communicate as part of delivering our services.
UK Business Energy Broker acts as the Data Controller and determines the purposes and means of processing personal data. As a sole trader, we are not required to appoint a Data Protection Officer under UK GDPR. All client information is stored electronically using secure, access-controlled systems. No paper records are kept. Some of our trusted suppliers and service partners may process or store data outside the UK. Where this occurs, we ensure that appropriate safeguards – such as UK-approved Standard Contractual Clauses (SCCs) – are in place to keep your data protected.
We use a number of trusted service providers to operate and deliver services. These providers may process personal data on our behalf and are listed below.
#1 Microsoft
#2 Google
#3 Zoho
#4 Filen
#5 Authy
#6 WordPress and Hostinger
#7 Signable
#1 Microsoft
Windows 11 and Office documents containing sensitive data are password-protected and backed-up to encrypted cloud storage.
Microsoft’s GDPR statement
#2 Google
We may store contact and communication data within Google services (e.g. Contacts, Gmail, Drive)
Google’s GDPR statement
#3 Zoho
Business data is stored within Zoho applications used for email, CRM, and document management.
Zoho’s GDPR statement
#4 Filen
All files are encrypted and backed-up using Filen.
Filen’s Privacy Policy
#5 Authy
Additional security is provided using two-factor authentication (2FA).
Twilio’s GDPR statement
#6 WordPress and Hostinger
Data is collected through the UK Business Energy Broker website via the contact page, transferring information to our Zoho Mail account. Our website is managed through WordPress and hosted by Hostinger; both of which are protected by passwords and 2FA.
WordPress’ GDPR statement
Hostinger’s Policies
#7 Signable
We utilise Signable for clients to digitally sign documents e.g. LOAs (Letter of Authority)
Signable’s GDPR Policy
We share information with a business energy aggregator (Online Direct) to process energy contracts with various energy suppliers. We may also process contracts directly with D-ENERGi and Opal Gas.
Online Direct’s GDPR Policy
D-ENERGi’s GDPR Policy
Opal Gas Privacy Policy
UK Business Energy Broker may use secure AI-assisted tools to support internal document preparation, data analysis, and correspondence drafting as part of delivering consultancy and brokerage services.
These tools are used solely to assist with internal administrative and analytical functions. They are not used for automated decision-making or profiling in respect of clients.
Where AI-assisted tools are used:
AI tools are used in a manner proportionate to the legitimate interests of delivering professional consultancy services and subject to appropriate technical and organisational safeguards.
UK Business Energy Broker remains the Data Controller and retains full responsibility for compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 in respect of all personal data processed, including ensuring that any third-party tools or service providers used in connection with AI-assisted processing comply with applicable data protection law.
UK Business Energy Broker considers there to be either a contractual or legitimate business interest to maintain contact with current clients, partners and suppliers. We only collect and process personal data we require to provide a specific service, which may include the following personally identifiable information: name, company name, e-mail address, telephone number and address (collectively called Contact Information). In addition, if you contact us directly, we may receive additional information, the contents of any message and/or attachments you send us, and any other information you choose to provide. The personal information you are asked to provide, and the reasons you are asked to provide it, will be made clear to you when we request your personal information.
We process personal data on the lawful bases of contractual necessity (to provide energy brokerage services) and legitimate interests (to communicate with clients, suppliers, and partners about our services).
UK Business Energy Broker uses your data to provide specific services, and makes this data available only to trusted third parties relating to a specific service i.e. energy aggregators/suppliers for energy contracts.
UK Business Energy Broker takes reasonable precautions, utilising encryption (#4) and two-factor authentication (#5) to protect data in our possession from loss, misuse, and unauthorised access.
The personal data we process for any purposes will not be held for a longer period than we have an ongoing legitimate business need to do so. When we have no ongoing legitimate business need to process your personal information, we will either delete or, if not possible, continue to securely store your information and isolate it from any further processing until deletion is possible.
Any clients, suppliers, or partners who wish to receive copies of the personal data UK Business Energy Broker holds about them can request this free of charge. We aim to respond within one month. A reasonable administrative fee may only be applied where a request is manifestly unfounded, excessive, or repetitive, as permitted under UK GDPR.
Right of access: You have the right to obtain from us information concerning you and to request copies of your personal data.
Right to rectification: You have the right to request correction of inaccurate personal data, and provide information to correct mistakes.
Right to erasure (right to be forgotten): You may request deletion of your personal data, and we will comply unless we are required to retain it for legal or regulatory purposes.
Right to restriction of processing: In certain situations, you have the right to obtain from us the restriction of processing.
Right to data portability: You have the right to receive your data in a structured, commonly used & machine-readable format; and to transmit your data to another controller.
Right to object: In certain situations, you have the right to object to the processing of your personal data e.g for marketing purposes.
Right to file complaints: You have the right to file complaints with the ICO regarding our processing of your personal data.
If you have concerns about how UK Business Energy Broker handles your personal data, you have the right to make a complaint directly to us.
Details of how to raise a complaint, including our complaints process & response times, can be found here.
We will investigate all complaints and aim to provide a resolution within the timeframes outlined in our complaints procedure.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
If you wish to make a request regarding your data, related to any of the rights mentioned above, contact us.
UK Business Energy Broker
Created: 19th May 2018
Last updated: 9th April 2026
This notice explains how I collect, use and protect personal data when you contact me or use my services. It's written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
UK Business Energy Broker is run by me, James Burrows, as a sole trader. I'm the data controller for the personal data described here, which means I decide how and why it's used. I'm registered with the Information Commissioner's Office (ICO), registration number ZA074109. As a sole trader, I'm not required to appoint a Data Protection Officer.
I only collect the personal data I need to provide a specific service. This usually includes your name, business name, email address, telephone number and business address. If you contact me, I also receive the contents of your message and any attachments you send, such as energy bills or contract documents.
The personal information I ask for, and why, will always be made clear when I ask for it.
I use personal data to provide quotes, arrange and manage business energy contracts, investigate billing issues, and communicate with you as part of these services.
I only share personal data where it's needed for a specific service.
To arrange energy contracts, I share information with a business energy aggregator, Online Direct, which works with a range of energy suppliers. I may also arrange contracts directly with D-ENERGi and Opal Gas. The energy supplier you contract with will also become a controller of your data, under its own privacy notice.
Some of these providers may store or process data outside the UK. Where this happens, I make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy decision.
I may use secure AI-assisted tools to help with document preparation, data analysis and drafting correspondence. They are not used for automated decision-making or profiling.
I remain responsible for how your data is handled when these tools are used.
All client information is stored electronically in secure, access-controlled systems. No paper records are kept. Files are encrypted, and accounts are protected by strong passwords and two-factor authentication.
I keep personal data only for as long as there's a genuine business or legal need. Contract, billing and invoice records can be needed for many years, as historic records are often essential for resolving disputes, backdated charges and billing investigations, and for meeting tax and legal requirements. I review the records I hold periodically, and delete those that are no longer needed. Where data can't be deleted straight away, it's securely stored and isolated from further use until it can be.
This website doesn't use advertising or tracking cookies, so you won't be asked for cookie consent.
I use Google Analytics to count visits and see which pages are read, so I can improve the site. It's configured so that the data isn't used for advertising or shared for Google's own purposes, and it's kept for no more than two months. I only see anonymous totals. You can opt out at any time with Google's Analytics opt-out browser add-on.
The video on the homepage only loads from YouTube when you choose to play it. At that point, YouTube may set its own cookies, as described in Google's privacy policy.
To make a request, please contact me. Requests are free of charge, and I aim to respond within one month. A reasonable fee may only be charged, or a request refused, where it is manifestly unfounded or excessive, as UK GDPR allows.
If you're unhappy with how I've handled your personal data, please raise it with me first. Details of my complaints process and response times are on the complaints page.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.
Created 19 May 2018. Last updated October 2026.
Pyjam@s0nV0c@tion3A!Z128h102nzrr5gmf3jq
