Privacy Policy

1. Who we are

Greystones Energy Ltd ("we", "us", "our") is a specialist energy consultancy and independent energy broker registered in England and Wales. We operate the website at greystones.energy.

We are the data controller for personal data collected through this website and in the course of providing our services. Our contact details are:

• Email: [email protected]
• Telephone: 024 7542 6453
• Website: greystones.energy

We are not currently required to register with the Information Commissioner's Office (ICO) as a data controller, but we process personal data in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What personal data we collect

We may collect and process the following categories of personal data:

2.1 Data you provide directly

• Your name and job title
• Your email address and telephone number
• The name, address, and size of your care home or organisation
• Details of your energy enquiry or requirements
• Any other information you choose to include in correspondence with us

2.2 Data collected automatically

• IP address and approximate geographic location
• Browser type and version
• Device type and operating system
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers (where you have consented — see Section 7)

2.3 Data collected in the course of energy brokering

Where you engage us to act as your energy broker, we may also collect:

• Energy consumption data and meter point reference numbers (MPRNs/MPANs)
• Existing energy contract details and supplier information
• Billing and invoice data
• Authorisation letters and letters of authority
• Bank account details where required for direct debit mandates

We do not collect special category data (such as health information) unless you voluntarily provide it in the context of your enquiry.

3. How and why we use your data

We process your personal data only where we have a lawful basis to do so. The table below sets out our purposes and the lawful basis for each:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to processing based on legitimate interests at any time (see Section 8).

4. How long we keep your data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Enquiry data (no engagement): 12 months from the date of last contact
• Client data (where a service was provided): 6 years from the end of the engagement, in line with the Limitation Act 1980
• Energy brokering records (including letters of authority and contract data): 6 years from contract end
• Financial and invoicing records: 7 years, as required by HMRC
• Website analytics data: As set by the relevant analytics provider (typically 14 months for aggregated data)

You may request deletion of your data at any time, subject to any overriding legal obligation to retain it.

5. Who we share your data with

We do not sell your personal data. We may share it with the following categories of recipient, only to the extent necessary:

5.1 Technology and service providers

We use third-party providers to operate our website, manage communications, and deliver our services. These include hosting providers, CRM and inbox tools, and analytics services. All such providers are engaged under data processing agreements and are required to process your data only on our instructions.

5.2 Energy suppliers (brokering only)

Where you engage us to broker energy contracts on your behalf, we will share relevant data (including your consumption data, site details, and letter of authority) with energy suppliers for the purpose of obtaining quotations and managing your contract. We will only do this with your explicit authorisation.

5.3 Professional advisers

We may share data with our solicitors, accountants, or insurers where necessary for the conduct of our business.

5.4 Regulatory and legal authorities

We may disclose data to regulatory bodies (including Ofgem, the ICO, or HMRC) or law enforcement agencies where required by law or where we are under a legal obligation to do so.

6. International transfers

We aim to keep your personal data within the UK and European Economic Area (EEA). Where any of our service providers transfer data outside the UK or EEA, we ensure that appropriate safeguards are in place — such as the UK International Data Transfer Agreement (IDTA) or adequacy decisions — before any transfer takes place.

7. Cookies and tracking technologies

This website uses cookies. We categorise them as follows:

7.1 Strictly necessary cookies

These are required for the website to function and cannot be switched off. They do not store any personally identifiable information. No consent is required for these cookies.

7.2 Analytics cookies

With your consent, we use analytics tools to understand how visitors use our website. This helps us improve our content and user experience. Analytics cookies are only set after you have accepted them via our cookie consent banner.

7.3 Third-party chat and support tools

Our website includes a third-party AI chat widget. This widget is only loaded after you have given your consent via the cookie banner. The widget provider may set its own cookies; please refer to their privacy policy for details.

You can withdraw your cookie consent at any time by clearing your browser cookies and revisiting the site, or by adjusting your browser settings. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal.

8. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification: You may ask us to correct inaccurate or incomplete data.
• Right to erasure: You may ask us to delete your data where there is no compelling reason for us to continue processing it.
• Right to restriction: You may ask us to restrict processing of your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
• Rights related to automated decision-making: We do not make decisions about you solely by automated means that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

9. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include secure transmission protocols (HTTPS), access controls, and regular review of our data handling practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.

10. Children's data

Our services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

11. Links to other websites

Our website may contain links to third-party websites. This Privacy Policy applies only to greystones.energy. We are not responsible for the privacy practices of other sites and encourage you to read their privacy policies.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page shows when it was last revised. Where changes are material, we will take reasonable steps to bring them to your attention. Continued use of our website after changes are published constitutes acceptance of the updated policy.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• Email: [email protected]
• Telephone: 024 7542 6453