Last updated: 14 December 2023
Find what you’re looking for
Introduction: protecting your data
Your data is in safe hands
Our customers are at the centre of everything we do. So, as well as giving you excellent value and the best service around, we’re committed to protecting your privacy.
The boring bit:
The responsible data controllers are: OVO Electricity Limited (No. 06858121); OVO Energy Ltd No (06890795); OVO (S) Gas Limited (No. 02716495); OVO (S) Home Services Limited (No. SC292102); OVO Gas Ltd (No. 06752915); OVO (S) Energy Solutions Limited (No. SC386054) and Corgi Homeplan (No. SC358475).
If you have any questions, comments, or concerns about this policy, we’d love to hear them. Get in touch anytime: our contact details are in section 14.
Thanks for reading! We hope this policy helps.
We (or third parties who act on our behalf) collect your personal data when you use our website, talk to us over the phone, by letter, by email, on social media, or in person, receive our products and/or services, or ask to join schemes which you’re eligible for.
We might collect the following data:
|Types of data we might collect from you
|What this data covers
|Your contact details and the contact details of people associated with your account.
Remember: if you give us someone else’s personal data, make sure you always have their permission.
|Your account data and the account data of other people associated with your account.
Remember: if you give us someone else’s personal data, make sure you always have their permission.
|For some products and services, such as Energy Spotlights and our Carbon Tracker, we might ask you to give us extra data about your home and lifestyle, to make sure you get the most out of whatever you’re using. This includes data like:
|Marketing and communications data
|Energy supply data
|Sensitive types of data
|Other types of data
We need this personal data so we can give you services and/or products. If you don’t give it to us, you might not be able to access certain products and/or services.
It’s really important that the data we hold about you is up to date. Please let us know whenever your personal details change.
We also look at something called ‘aggregated data’, to help make our operations better and give you the best service possible. Here’s one example of what aggregated data is and how we use it: when you visit our website or our app, sometimes we examine data that shows us how you use these platforms, to check for any flaws or problems for us to fix.
All aggregated data is anonymised, so it never reveals your identity.
Here’s some more info about how we actually use your data.
We might use your data for the following reasons (‘we’ includes our agents, and third parties too – but only in certain areas):
|Our reason for using your data
|More details on what we need this for
|To serve your account
|To help us improve
|To keep in contact
|To support our business
Unless you’ve opted out, we might get in touch with you about our products, services, events, and rewards. This could be by email, letter, phone call, or SMS. We might also contact you with info about other companies in OVO Group – and, sometimes, about our carefully chosen partners too. We identify them when we collect your data. When we need your consent to get in touch with you, we’ll always make sure we have this.
Unless you’ve opted out, we might also use your personal data to show you digital advertisements via your social media feed, on search engine results pages, or on other websites.
Finally, If you decide to leave us, we may contact you to allow us to market our products and services to you after you have left for up to one year, unless you opt out. In all circumstances we will respect your marketing preferences which you set when you first created your account with us (or you first dealt with us), or the latest updated preference.
You can say no to us using your data for direct marketing reasons, or you can opt out of getting marketing messages. Just get in touch – anytime. Our contact
details are in section 14.
Sometimes, we’ll remind you that you can update your preferences for how you’d
like us to send marketing info. Or, if you haven’t told us what your preferences are,
we might get in touch to find out.
We’ll use your energy consumption data that we get remotely from your smart meter for all the following reasons:
- To calculate your energy use
- To create bills based on real readings
- For industry reasons, and to predict the demand for energy
- To give you information and feedback about your energy use, as well as how you could manage your energy use better and save money
- To track trends in energy use, analyse your energy data, and to compare it over time with other customers’ energy use. This is so we can create tailored products and services for you.
- To spot faults when they happen and fix these faster, as well as any other issues with your meter
- To give you interactive tools to analyse your energy use through your online account, or through communications we might send you (like when we send you energy-saving advice)
- To give you tailored advice on how to lower the amount of energy you use, based on your energy use specifically
- To carry out internal reporting, modelling, and analysis so we can understand our customers better
You can choose how often your smart meter takes readings. When you join us, change tariff or get a smart meter the default position is that your smart meter will send us half hourly readings. You can opt out of this and change to another frequency at any time by getting in touch with our customer service team (current options are half hourly, daily or monthly).
You don’t have to give us readings frequently, if you don’t want to. But, if that's the case we might not be able to give you some of our products and services. Or at the very least, your use of some products and services could be limited.
Your options are:
- Half hourly – your smart meter will collect data every 30 minutes and send this to us once a day (this will be the default setting that you have consented to when you join us, get a new smart meter or switch tariff unless you opt out)
- Daily – your smart meter will send us a reading once a day
- Monthly – your smart meter will send us a reading once a month. Please note, this is the lowest level of data we’re allowed to take for billing and regulatory reasons. If you choose this option, we’ll also take ad hoc daily meter reads – as and when we need to, so we can make sure we’re serving you properly (for example, to keep billing you accurately, or if we need to use the data to answer a question, or if we think your smart meter isn’t working properly).
We might also get smart meter readings when:
- Your prices change
- You move to another one of our energy plans
- You move home
- You ask us to do so
- You switch to another supplier
You can always change how often we collect energy data from your smart meter. If you do, this will take up to 5 days to carry out, from the date that you contact us.
We treat some of the data we collect about you as extra sensitive. This could be about your needs, or details of criminal offences (see section 1). We’ll only use this data in the following ways:
We collect data about you and other people in your household, to make sure we’re aware of any needs you might have. This could be data on age, health, or disability, for example. With your permission, we could use this helpful data to:\
- Look after you and others in your household. For example, to make sure we don’t turn off your power. And so we can respond in the right way, if there’s an emergency situation.\
- Give you products and/or services in a way that suits you, like if you need large print or braille\
- Assist staff and third-party contractors\
- Make sure you have the best experience when you come to an OVO event – let’s say, if we need to make sure the space is easily accessible for you
With your permission, we might share this data with the following people or
- The electricity distributor (who will also give us this data) via the Priority Services Register
- The relevant gas transporter (who will also give us this data), engineers, or the network operator via the Priority Services Register
- When using an outsourced service company that manages a wide range of energy industry data, for us
- Social services, charities, health care services, and other support organisations
- And/or other relevant organisations – such as emergency responders or local authorities, which might be able to give you support
We use details of any criminal offences you’ve been accused of, together with information about whether the gas or electricity supply to your property has been tampered with or stolen in the past (or if we think it has), for the following reasons:
- To make decisions about which products and services we can offer you, as well as the relevant terms and conditions
- To make decisions about whether to disconnect your energy supply
- To spot and prevent fraud or crime, with the help of any third parties when needed
We also get your personal data from the following third-party sources:
|Types of third-party sources
|The kind of data we get from these
|Other energy suppliers
|National databases(ECOES, Xoserve,and PAF)
|We might get details like your MPAN and other information about your energy supply, to help if you’re going through the process of switching suppliers. And to access this info, we might use a third party.
|Debt of collection agencies
|Credit reference or fraud prevention agencies
|You can find more info about this kind of data in sections 7 and 8
|Third-party data providers
|Councils, local authorities, or housing associations
|We might get your name, address, and contact details from councils, local authorities, or housing associations. This could be when these organisations want to apply for carbon-cutting measures for your property, as part of government-funded schemes.
|Letting agents, landlords, cohabitants, previous tenants, or other third parties
|We might get your name, address, and contact details if you’ve recently moved into, or taken over, a property that we supply. Or if a third party (like your landlord) introduces you to OVO Group, so we can set up your account.
|As a regulated company, we might get your personal data from our regulator, Ofgem, in order to meet our regulatory obligations
|Law enforcement agencies (such as the police)
|We might get data about meter tampering, the bypassing of meters, or the illegal use of energy – so we can spot and prevent fraud or crime
|OVO Group companies
|Third parties who introduce you to us (such as price comparison websites)
|So we can set up an account for you, and to give you the services you’ve asked for
|Department for Work and Pensions
|We might get the following details, to check if you can get the Warm Home Discount scheme: your contact details, account data, financial details, and details of your energy supply
|Department for Business, Energy and Industrial Strategy (BEIS)
|We might give them your contact details, account data, and energy supply data. This could be if they ask for information about Feed-in Tariff (FIT) installations, for example.
We’ve checked the legal bases for us to use your personal data, and they’re as follows:
|How we use them
|For your contract
|We use your data mainly to give you the products and services that you’ve asked for (for example, energy products)
|Our legal obligations
|Our use of your personal data is necessary, so we can comply with our legal obligations
|Our legitimate interests
|It might be in our interests to collect and use your personal data, as we need this info to give you the services you want more effectively. When deciding whether it’s in our interests to use your data, we also consider your interests as a citizen and your rights under data- protection laws. It’s in our interests to:
If you have concerns about the processing activities based on our interests, please take a look at section 13.
|Sometimes, we need your consent if we do want to use your personal data. For example, to send you marketing communications about OVO Group products in certain circumstances.
If you give us your consent but later you change your mind, you can withdraw it anytime, by letting us know. Just get in touch, using the details in section 14 – and we’ll stop using your data for that purpose.
|On very rare occasions, we might use or share data about you to protect either you or someone else.
|Substantial public interest
|We might use data in order to pursue something that’s of key interest to what’s called the ‘substantial public interest’. This would always be in accordance with the Data Protection Act 2018. These interests cover things like the safeguarding of people at risk, and safeguarding the economic wellbeing of certain people.
Your personal data helps us make decisions that are automated (which means they’re carried out by our computer systems, automatically). And we use your data to do this in the following ways:
We use an automated calculation to let us make a fair and responsible decision on what pricing we can offer you, based on the cost of maintaining your boiler. We’ll
- Your boiler make and model
- The length of time you’ve had cover
- Your geographical location
- Your claims history
- Whether non-standard system parts are needed (including thermal store and unvented cylinders)
If we think your boiler is non-standard and/or you’ve made a claim against your product, and/or you live in a place where it costs more for us to serve you, your individual renewal price might go up.
We use automated credit-scoring assessments to check how suitable it is for you to take any product or service on a credit basis, and to manage any debt related to
To do this, we might look at:
- Data that’s included when you apply for a new product or service
- Data we already have about you, your account, or your property – such as payment history for existing products and services. This includes data from accounts where you’re named jointly, with one or more other account holders.
- Information from one or more credit reference agency
- And/or, where it’s appropriate, data from fraud prevention agencies
If we decide that offering unsecured credit is not appropriate, we might need energy customers to pay a security deposit – or to pay using a prepayment meter, or a smart meter in prepayment mode. We might ask you for payment security at any time, if we decide that unsecured credit is no longer right for you. For non-energy products such as telephone or broadband, when we decide that credit isn’t right for you, we might choose not to continue with your application. We’ll write to let you know about this. If your account is in debt or if we think that it will fall into debt in the future, we might look at your risk of debt, and tailor our debt recovery processes to you and your level of risk.
For both online applications and paper applications, we use an automated process to check people are eligible for Warm Home Discount rebates. This means our computer system will check the benefits you’ve ticked on your application, to see whether you meet the criteria needed to get the rebate. The criteria are described in the online journey and on the paper application form.
You can appeal against any automated decision, get an explanation of the decision, or ask for a person to review it. Just get in touch with us. You’ll find our details in section 14.
We’ll share your personal data with the following types of third parties:
|Type of third party
|More details on this
|Our third-party suppliers, partners, and subcontractors
|They offer, review, and/or receive services that are to do with our website, services, and/or products. They include:
|Any company that’s a member of OVO Group
|OVO Group includes any of the companies listed at the top of this document. Plus, our businesses in the wider OVO Group such as CORGI, Kaluza, Field Force, Kantan, and The Renewable Exchange, as well as other subsidiaries of OVO Group Limited from time to time.
|Family members or cohabitants, previous tenants, landlords, letting agents, or other third parties
|Where appropriate, people who could need data about you or your property – or who introduced you to us.
|Government or law enforcement officials
|If we have good reason to think we’ve got a duty to do it, we’ll give out your data to meet any legal obligation – where your data might be needed to meet national security or law enforcement needs, or to stop illegal activity.
|Other energy suppliers
|If you choose to leave us, we’ll share your data with your new supplier to help make the switching process smoother. This includes your energy use and any debts on your account. We might also share your personal data with another energy supplier when they carry out services for us – like if they do meter readings at your property on our behalf.
|Regulators or other legally-appointed bodies
|This includes but isn’t limited to Ofgem, the Information Commissioner’s Office, or the Financial Conduct Authority. We share your data for legal or regulatory reasons – for example, we might send your data to Ofgem to prove that you qualify for a government-funded scheme, if we’re asked to do so.
|Price comparison sites
|These sites might take your details when you ask for a quote, or when you switch to us via a price comparison site.
|Third parties that help us with advertising and marketing
|Here’s one example of how this works. We share some personal data with these third parties, who advertise on their platforms for us: Amazon, Viant, Facebook, and Google AdWords.
|Relevant gas transporters, engineers, or network operators
|We’ll share data with other utility service providers who might be supplying your property – like your distribution network operator.
|Where it will help you, we’ll share data with your local authority, water company, social services, charities, healthcare services, and other support organisations. We might also share it with housing associations that are relevant to your property and/or your use of our services.
|Debt collection and tracing agents
|This might happen if you don’t pay us for the services we give you. We might also sell the right to recover any debts you owe us to a third party, which is part of our general terms and conditions for supplying electricity and/or gas. As well as this, we could pass personal data to possible buyers of this debt, so they can evaluate it before the sale’s complete.
|Authorised third parties or named account holders
|This can be on any account you have with us.
|Anyone who buys our business, any other business we buy or merge with, and/or a new data controller
|If we sell or merge any of our businesses or assets, or if we do any internal reorganisations, your personal data might be one of the assets that goes to the buyer and/or new data controller.
|Insurance underwriter / alternative dispute resolution provider
|If you’re a OVO Home Services customer, we might share your data with an insurance underwriter, who underwrites our insurance products.We could also share your data with a dispute resolution provider, if you’ve got a complaint about your non-insurance product that we can’t settle.
|A third party, such as the police or legal representatives
|We could need to share your data with these third parties as part of enforcing our terms and conditions, or any other agreement. This might also happen when we’re replying to any claims, or protecting the following: our rights, or the rights of a third party, or the safety of any person. We might also do this to stop any illegal activity.
|Credit reference agencies
|When you enter into a contract with us for your energy supply, we’ll give information about you to credit reference agencies, and gather this from them too. When credit reference agencies get a request from us, they’ll place a search footprint on your credit file. This might be seen by other lenders. They give us public data (including info from the electoral register), as well as data on shared credit, your financial situation,information on your financial history, and on fraud prevention.
We might also make checks, like assessing your application for credit and verifying identities – so we can spot and prevent crime. We’ll also keep sharing information about you with credit reference agencies on an ongoing basis. This includes things like your settled accounts and any debts you haven’t fully repaid on time.
Occasionally, we might also do searches via credit reference agencies and fraud prevention agencies to manage your account with us. Who these credit reference agencies are, and the ways in which they use and share personal information, is all explained in more detail here
|These advisers could be lawyers, bankers, auditors, and insurers who offer consultancy, banking, legal, insurance and accounting services.
|Letting agents (where applicable)
|To carry out any ancillary services that you’ve asked for – an example would be for help with council tax and getting water set up at a new address.
|Fraud prevention agencies
|Owners and/ or operators of smart meters (or similar), smart meter contractors, and the Data and Communications Company (DCC)
|This is for your smart meter, so that we can connect to it and get readings from it.
|Department for Business, Energy and Industrial Strategy (BEIS) / Central FIT Register
|For FIT and SEG customers, we’ll share information with the Department for Business, Energy and Industrial Strategy (BEIS) and the Central FIT Register when asked to.
Where third parties are handling data on our behalf, they won’t use your personal data for their own purposes. We only let them use it while following our strict instructions and the law.
We (or a third party who we share personal data with) might host, store, and handle that personal data outside of the European Economic Area (EEA). Some of our customer service work is done outside the EEA, to make sure we operate as easily as possible. This means that we’ll send your personal data to suppliers based outside the EEA.
When we send data outside of the EEA, we make sure that all the right safeguards have been put in place to protect your personal data.
This means that we’ll:
- Make sure the country where your personal data will be handled has been deemed “adequate” by the European Commission, under Article 45 of the General Data Protection Regulation (GDPR).
- Include standard data protection clauses (approved by the European Commission for transferring personal data outside the EEA) in our contracts with those third parties – these are the clauses approved under Article 46.2 of the GDPR.
We keep your personal data for no longer than is necessary. This means that when we don’t need it any more we delete it. The length of time we keep it all depends on why we’re using it and/or what we need to do to comply with applicable laws and to establish, exercise, or defend our legal rights.
In some circumstances, we might anonymise your personal data (so that it can no longer be associated with you) and use this indefinitely, without further notice.
We follow strict security procedures to protect your personal data. This includes following certain guidelines (for example, checking your identity when you
Whilst we take appropriate technical and organisational measures and have in place physical and electronic procedures necessary to safeguard the personal data that you provide to us, no transmission to or from us by post, email, phone, SMS or over the internet can ever be guaranteed as entirely secure. Communications over the web are not secure and as such, we cannot accept any liability or responsibility for any unauthorised access or loss of personal data.
We also have procedures in place to deal with any suspected data security breach. We’ll notify you and any applicable regulator of a suspected data security breach where we’re legally required to do so.
Our contact details are in section 14, and you can always get in touch to ask that we:
- Let you know if your personal data is being processed
- Give you further details about how we process your personal data
- Give you a copy of any personal data we hold about you
- Withdraw your consent for a way that we’re using your data (where we need your consent legally to use your personal information)
- Consider any valid objection you have to us processing your personal data (including the right to object to processing where we’re relying on our interests as a legal basis for processing)
- Update or delete personal data that we have about you
- Restrict the way that we process your personal data
- Consider any valid request to transfer your personal data (that relates to an energy account) to a third-party provider of services (this is called data portability)
- Where we carry out automated decision making that has legal or significant effects on you, make sure we get a person to review that decision, give you an explanation of the decision, and/or consider your appeal of the decision
However, certain personal data may be exempt from the requests above, in certain circumstances. We could need to keep processing your personal data because of our interests, or to meet a legal obligation.
If an exemption applies, we’ll tell you when we reply to your request. We might ask you to give us some data to confirm your identity before we reply.
Two tips to help us get back to you more quickly:
- When you send us your message, let us know if it's a "rights request" as part of your message. This will help us make sure it gets to the right people.
- Include your name, account number, address, and if there's any data you're especially interested in, if you can. This will make it easier for us to respond to you properly.
How to contact us:
- If you’ve got any questions about data protection, or you’re not happy with how we’ve handled your data, email us at:
- For access to your data, use our online form.
- To delete your data, use our online form.
- For all other requests, email us at Dataprotectionoperations@ovo.com
You can email our Data Protection Officer (DPO): email@example.com And you can write to them too: OVO Energy & Boost, 1 Rivergate, Temple Quay, Bristol, BS1 6ED
If you’re not happy with our reply to any complaint or you think our processing of your data doesn’t comply with data protection law, you can make a complaint to the Information Commissioner’s Office (ICO). Just use these details:
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Website: ico.org.uk