Published 19 May 2018
This policy explains how I collect, use and protect personal data when you contact me or use my services. It's written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
UK Business Energy Broker is run by me, James Burrows, as a sole trader. I'm the data controller for the personal data described here, which means I decide how and why it's used. I'm registered with the Information Commission (formerly the Information Commissioner's Office, ICO), registration number ZA074109. As a sole trader, I'm not required to appoint a Data Protection Officer.
I only collect the personal data I need to provide a specific service. This usually includes your name, business name, email address, telephone number and business address. If you contact me, I also receive the contents of your message and any files you send, such as energy bills or contract documents, whether you email them or upload them through the website's contact form. I only use these files to prepare quotes, review contracts or investigate billing issues.
When I arrange an energy contract for you, I may also collect your business bank account details for the Direct Debit Mandate (DDM) the supplier needs. I only use these to set up payments with that supplier.
The personal information I ask for, and why, will always be made clear when I ask for it.
Most of the personal data I hold comes directly from you. If I contact your business by post as a prospective client, your business contact details will have come from a lead provider, and I'll say who the provider is in that mailing.
I use personal data to provide quotes, arrange and manage business energy contracts, investigate billing issues, and communicate with you as part of these services.
I only share personal data where it's needed for a specific service.
To arrange energy contracts, I share information with a business energy aggregator, Online Direct, which works with a range of energy suppliers. I may also arrange contracts directly with D-ENERGi and Opal Gas. The energy supplier you contract with will also become a controller of your data, under its own privacy notice.
Some of these providers may store or process data outside the UK. Where this happens, I make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy decision.
I may use secure AI-assisted tools to help with document preparation, data analysis and drafting correspondence. They are not used for automated decision-making or profiling.
I remain responsible for how your data is handled when these tools are used.
All client information is stored electronically in secure, access-controlled systems. No paper records are kept. Files are encrypted, and accounts are protected by strong passwords and two-factor authentication.
I keep personal data only for as long as there's a genuine business or legal need. Contract, billing and invoice records can be needed for many years, as historic records are often essential for resolving disputes, backdated charges and billing investigations, and for meeting tax and legal requirements. I review the records I hold periodically, and delete those that are no longer needed. Where data can't be deleted straight away, it's securely stored and isolated from further use until it can be.
This website doesn't use advertising cookies.
I use Google Analytics to count visits and see which pages are read, so I can improve the site. Google Analytics sets cookies to do this. It's configured so that the data isn't used for advertising or shared for Google's own purposes, and it's kept for no more than two months. I only see anonymous totals. My lawful basis for this is legitimate interests.
Since February 2026, UK law (the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025) allows cookies to be used without consent when they're used only to produce statistics that help improve a website, as long as visitors are told about them and given a simple way to object.
Opinions differ on whether Google Analytics fully qualifies for this exception, because Google is a separate company that processes the data. I've taken the view that, configured as described above, it does. So rather than asking for cookie consent, I'm telling you openly how it works.
If you'd rather not be included, you can object at any time by installing Google's Analytics opt-out browser add-on, or by blocking cookies in your browser settings. The rest of the site will work normally.
The video on the homepage is hosted on this website, so playing it doesn't set any cookies. Other videos on the site are hosted on YouTube. These only load from YouTube when you choose to play them, and at that point YouTube may set its own cookies, as described in Google's privacy policy.
To make a request, please contact me. Requests are free of charge, and I aim to respond within one month. A reasonable fee may only be charged, or a request refused, where it is manifestly unfounded or excessive, as UK GDPR allows.
If you're unhappy with how I've handled your personal data, please raise it with me first through the contact form. You don't need to use any particular wording. Details of how I handle data protection complaints, and the timescales, are on my complaints page.
You also have the right to complain to the Information Commission (formerly the ICO) at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Created 19 May 2018
Last updated November 2026
Pyjam@s0nV0c@tion3A!Z128h102nzrr5gmf3jq
