Privacy Policy

Published 19 May 2018

This policy explains how I collect, use and protect personal data when you contact me or use my services. It's written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who I am

UK Business Energy Broker is run by me, James Burrows, as a sole trader. I'm the data controller for the personal data described here, which means I decide how and why it's used. I'm registered with the Information Commissioner's Office (ICO), registration number ZA074109. As a sole trader, I'm not required to appoint a Data Protection Officer.

What personal data I collect

I only collect the personal data I need to provide a specific service. This usually includes your name, business name, email address, telephone number and business address. If you contact me, I also receive the contents of your message and any files you send, such as energy bills or contract documents, whether you email them or upload them through the website's contact form. I only use these files to prepare quotes, review contracts or investigate billing issues.

The personal information I ask for, and why, will always be made clear when I ask for it.

How I use it, and the lawful basis

I use personal data to provide quotes, arrange and manage business energy contracts, investigate billing issues, and communicate with you as part of these services.

• Contract: where processing is needed to provide a service you've asked for, or to take steps before entering into an agreement.
• Legitimate interests: to keep in touch with clients, suppliers and partners about the services I provide.
• Legal obligation: to keep business and financial records as the law requires.

Who I share it with

I only share personal data where it's needed for a specific service.

Organisations that act as data controllers

To arrange energy contracts, I share information with a business energy aggregator, Online Direct, which works with a range of energy suppliers. I may also arrange contracts directly with D-ENERGi and Opal Gas. The energy supplier you contract with will also become a controller of your data, under its own privacy notice.

Service providers that act on my behalf (processors)

• Microsoft: documents and encrypted cloud backup
• Google: email, contacts and file storage (Gmail, Contacts, Drive)
• Zoho: email, CRM and document management
• Filen: encrypted file storage and backup
• Authy (Twilio): two-factor authentication
• WordPress and Hostinger: website management and hosting. Messages sent through the website's contact form, and any files uploaded with them, are delivered to my Zoho email account. Uploaded files are sent as email attachments and aren't kept on the website.
• Signable: electronic signing of documents, such as Letters of Authority
• Google Analytics: anonymous website visitor statistics (see Cookies and visitor statistics below)

International transfers

Some of these providers may store or process data outside the UK. Where this happens, I make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy decision.

AI-assisted tools

I may use secure AI-assisted tools to help with document preparation, data analysis and drafting correspondence. They are not used for automated decision-making or profiling.

• Personal details such as names, contact details, MPANs, account numbers, meter serial numbers and full site addresses are removed or anonymised, where possible, before use.
• Only the information needed to deliver the service is used.

I remain responsible for how your data is handled when these tools are used.

How I protect your data

All client information is stored electronically in secure, access-controlled systems. No paper records are kept. Files are encrypted, and accounts are protected by strong passwords and two-factor authentication.

How long I keep it

I keep personal data only for as long as there's a genuine business or legal need. Contract, billing and invoice records can be needed for many years, as historic records are often essential for resolving disputes, backdated charges and billing investigations, and for meeting tax and legal requirements. I review the records I hold periodically, and delete those that are no longer needed. Where data can't be deleted straight away, it's securely stored and isolated from further use until it can be.

Cookies and visitor statistics

This website doesn't use advertising or tracking cookies, so you won't be asked for cookie consent.

I use Google Analytics to count visits and see which pages are read, so I can improve the site. It's configured so that the data isn't used for advertising or shared for Google's own purposes, and it's kept for no more than two months. I only see anonymous totals. You can opt out at any time with Google's Analytics opt-out browser add-on.

The video on the homepage only loads from YouTube when you choose to play it. At that point, YouTube may set its own cookies, as described in Google's privacy policy.

Your rights

• Access: to ask for a copy of the personal data I hold about you.
• Rectification: to have inaccurate data corrected.
• Erasure: to ask me to delete your data, unless I need to keep it for legal reasons.
• Restriction: to ask me to limit how I use your data in certain situations.
• Portability: to receive your data in a structured, commonly used, machine-readable format.
• Objection: to object to processing in certain situations, including for marketing.

To make a request, please contact me. Requests are free of charge, and I aim to respond within one month. A reasonable fee may only be charged, or a request refused, where it is manifestly unfounded or excessive, as UK GDPR allows.

Complaints

If you're unhappy with how I've handled your personal data, please raise it with me first. Details of my complaints process and response times are on the complaints page.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

Created 19 May 2018. Last updated October 2026.