The Green Economy is the next industrial revolution — join us and help make it happen

Skip to main content
Ecotricity logotype
Home
/The legal stuff/Privacy Notice

The legal stuff

The legal stuff

Privacy Notice

Last updated: 18 August 2026

This notice explains the basis on which any personal data we collect from you or that you provide to us will be processed, shared and used by us, including personal data you provide through your use of this website, when you enter into a contract for the supply of energy with us, when you take part in a competition, or when you otherwise interact with us. It also explains how you can exercise your privacy rights. Please read the following carefully to understand how we look after your personal data. This website is not intended for children and we do not knowingly collect data relating to children.

Controller

This notice applies to personal information collected by Ecotricity Limited, a company incorporated in England & Wales (registered no. 03043412) and whose registered office is at Lion House, Rowcroft, Stroud, Gloucestershire, GL5 3BY. In these terms and conditions “Ecotricity”, “we”, “our” or “us” means Ecotricity Limited, and “you” or “your” means you, our customer.

Ecotricity Limited is registered with the ICO, registration number Z5614614. Ecotricity Limited is part of Ecotricity Group Limited who are registered with the ICO, registration number ZA021407.

Ecotricity Limited is the controller responsible for the personal data covered by this privacy notice, unless we explain otherwise at the point we collect your information. Where another group company acts as a separate controller or joint controller for a specific activity, we will make this clear and explain which organisation is responsible for that processing.

If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact our Data Protection Officer using the contact details set out in the Contact section below.

What does Ecotricity do?

Ecotricity is a renewable energy company supplying electricity and gas to commercial and domestic customers (the “Services”).

For more information about Ecotricity, please see the “About Us” section of our Website at /our-story/our-mission.

How we collect your information and why

Personal data means any information about a living individual from which that person can be identified. It does not include data which has been anonymised.

We may collect, use, store and transfer different kinds of personal data about you, as follows:

Type of dataData required
Identity DataFirst name
Any previous names
Last name
Username or similar identifier
Marital status
Title
Date of birth
Gender
Contact DataBilling address
Supply address
Email address
Telephone numbers
Financial DataBank account and payment card details
Data relating to your eligibility for credit
Transaction DataDetails about payments to and from you
Other details of products and services you have purchased from us
Technical DataYour internet protocol (IP) address
Your login data, browser type and version
Time zone setting and location
Browser plug-in types and versions
Operating system and platform device ID
Other technology on the device you use to access this website
Profile DataYour username and password
Purchases or orders made by you
Your interests, preferences, feedback and survey responses
Usage DataInformation about how you use our website, products and services (including your consumption of energy supplied by us)
Marketing and Communications DataYour preferences in receiving marketing from us and our third parties
Your communication preferences
Special Category DataDetails about your health including but not limited to mental health, disease or disabilities

The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

Information that you provide directly

We collect your Identity, Contact, Financial and Transaction Data when you:

  • contact us to enquire about our Services

  • register with us to receive the Services

  • use the Services

  • use our website under the domain name www.ecotricity.co.uk (the

    “Website”)

  • request information or assistance from us by post, phone, email or otherwise

  • request marketing to be sent to you

  • give us feedback or contact us

  • enter a competition, promotion or survey

You may be required to provide us with Usage Data directly, in the form of meter readings.

Information that we obtain from third party sources

  • We may collect your personal information from third party sources, particularly Financial Data, Transaction Data and Contact Data, including but not limited to (as applicable) debt collection agencies, social/support workers, credit reference agencies, Citizens Advice, Meter Operators, Distribution Network Operators and other providers of technical, payment and delivery services. We will only collect this information where we have checked that the third party is permitted or required to share it with us and where we have a lawful basis to use it.

  • In limited circumstances, we may obtain contact and identity information from reputable data providers and publicly available sources to support customer tracing, debt recovery activities, fraud prevention, account verification and data accuracy checks. We only obtain such information where we are satisfied that the provider is permitted to share it with us and where we have a lawful basis to use it.

Information that we collect automatically

We use cookies and similar technologies on our website to make it work, keep it secure, remember your preferences, understand how people use our website, and support relevant communications or advertising where applicable. Some cookies are strictly necessary for the website to function and do not require consent. For all other cookies and tracking technologies, we will only use them where you have given your consent, unless another lawful exemption applies.

When you first visit our website, our cookie banner provides more detailed information about the categories of cookies we use and gives you choices about whether to accept or reject non-essential cookies. You can change or withdraw your cookie choices at any time using the cookie settings available through the banner or cookie management tool on our website.

Where cookies or similar technologies collect personal data, we handle that information in accordance with this privacy notice. This includes explaining why we use the information, the lawful basis we rely on, who we may share it with, how long we keep it, and the rights you have in relation to your personal data.

Use of your information

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason, and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with this notice where this is required or permitted by law.

Disclosure of your information

Your Personal Data will be held on our systems and may be accessed by or transferred to any entity in our corporate group, including any entity that acquires us or that we may acquire. This may include staff working outside the UK and third parties, some of whom are located outside the UK or European Economic Area. A list of third parties relevant to your account can be made available on request.

Third parties may process information, fulfil orders and provide support services on our behalf, including payment processors, metering and network operators, debt collection agencies, credit reference agencies, IT hosting and support providers, customer service platforms, regulators and public authorities, professional advisers, group companies, water companies and Priority Service Register partners where relevant. Where a third-party acts as our processor, we require them to process personal data only on our instructions. Where a third-party acts as a separate controller, they will be responsible for their own use of personal data and may provide their own privacy information.

We may transfer your personal data as a part of a corporate reorganisation, business sale, or other merger activity. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice

We may also transfer or disclose your personal information to our service providers, professional advisers and to such other parties as we consider reasonably necessary for the administration of the Services, the Website, any related, ancillary matters (including competitions and prize draws) and related business.

Priority Services Register (PSR) customer data will be shared in accordance with the data sharing project (PSR Project) where the transfer of Personal and Special Category Data is made to water companies and other appropriate service providers for the purpose of safeguarding vulnerable individuals. The PSR is a free UK wide service which provides extra advice and support, including when there is an interruption to customer’s electricity, gas or water supply.

We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Countries outside the UK and European Economic Area (EEA) do not always provide adequate protection to individuals’ personal data. Where we transfer personal data outside the UK or the EEA, we will ensure that an appropriate transfer mechanism or safeguard is in place unless an exemption applies.

This may include transferring personal data to a country that benefits from UK adequacy regulations, using the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, EU Standard Contractual Clauses where applicable, or another approved transfer mechanism.

Sometimes we are required or compelled to disclose your information. We will respond to requests (in each case, limiting disclosure to the extent required) where:

  • our compliance is required by law;

  • we receive a request from a public authority or law enforcement agency,

  • there is a threat to the safety of you or any other person; or

  • we suspect you of committing a criminal offence, including fraud.

We will only otherwise disclose any of the information you provide to us when permitted to do so by applicable law or with your consent.

Legal basis for processing personal information

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

  • Performance of a contract with you: Where we need to perform the contract, we are about to enter into or have entered into with you.

  • Legitimate interests: We may contact you to provide any assistance when you start but do not finish our sign-up journey or when you have asked for a quote. We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

  • Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

  • Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

We will normally collect personal information from you only where we need the personal information to perform a contract with you, where we have your consent to do so, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms.

In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person (for example, if we are asked to provide your telephone number or location data to the emergency services in an emergency situation).

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

Similarly, if we collect and use your personal information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate:

Processing ActivityLawful BasisPurpose
Supplying electricity and/or gasContractNecessary to perform the contract.
Account setup and administrationContractNecessary to provide the service.
Taking and administering paymentsContractCore contractual activity.
Customer account communicationsContractNecessary for service delivery and account management.
Tracing customers where contact details are invalidContract / Legitimate InterestsOngoing service provision and wider debt recovery purposes.
Customer helplinesLegal Obligation /Legitimate InterestsComplying with our auditing obligations and Ofgem requirements.
Call recordingLegal Obligation/ Legitimate InterestsFor auditing, training, quality monitoring purposes; this is also an Ofgem requirement.
Complaints handlingLegal Obligation/ Legitimate Interests/ ContractOfgem and consumer protection obligations depending on the nature of the complaint.
Competitions and prize drawsLegitimate Interests / ConsentMarketing our services of our group companies and partners.
Identity verificationLegitimate InterestsTo verify your identity so we can set your account up.
Marketing to existing customersLegitimate Interests / ConsentMarketing Ecotricity services.
Marketing other group company productsConsentPECR requirement.
Quotations for servicesContract (pre-contract steps)Necessary to administrate your account set up.
Reporting unpaid balances to Credit Reference AgenciesLegitimate InterestsInforming credit reference agencies about unpaid charges and debt, this may impact on ability to obtain credit in the future.
Legal recovery proceedingsLegitimate Interests / ContractRecovering overdue debts.
Service analytics and statistical analysisLegitimate Interests / ConsentUsually anonymised, where it is not, consent will apply.
Publishing winner details for CAP complianceLegal Obligation / Legitimate InterestsRequirements around the CAP Code.
Responding to law enforcement requestsLegal ObligationResponding to requests by law enforcement authorities for access to your personal information. Protecting our businesses and other customers from criminal or fraudulent activities. The detection and prevention of theft, fraud, and money laundering offences.
Court orders and judgmentsLegal ObligationEnforcing a judgment of a court of law
Credit checking before contract awardContract (pre-contract steps) / Legitimate InterestsTo assess affordability, creditworthiness and manage financial risk before entering into a contract.
ProcessingArticle 6 BasisArticle 9 Condition
Priority Services Register health dataLegal Obligation / Legitimate InterestsSubstantial Public Interest - safeguarding of individuals at risk and equality of opportunity/treatment (where applicable).
Vulnerability information sharingLegal Obligation / Vital Interests / Legitimate InterestsSubstantial Public Interest - As above
Emergency welfare situationsVital InterestsVital Interests, to protect individuals at risk.
Sharing vulnerability information with water providersLegitimate InterestsSubstantial Public Interest – safeguarding individuals at risk and equality of opportunity/treatment (where applicable)

If you have questions about or need further information concerning the lawful basis on which we collect and use your personal information, or your right to object please contact our Data Protection Officer at dataprotectionofficer@ecotricity.co.uk.

Direct Marketing

During the registration process on our website when your personal data is collected, you will be asked if you want to opt in to marketing communications from us.

We may send you service communications where these are necessary to administer your account or provide the Services. Service communications are not marketing.

We may also send you marketing communications about our own similar products and services where you have purchased similar services from us, requested information from us and have opted in to receiving such communications, as permitted by applicable electronic marketing laws. Where consent is required, we will only send marketing communications where you have provided that consent.

We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

Credit Checks and Credit Reference Agencies

Where relevant, we may carry out credit checks before entering into a contract with you, when assessing affordability or eligibility, or as part of the ongoing management of your account, we may share your personal information with credit reference agencies (CRAs) and they may provide us with information about you, such as your financial history. We do this to check your identity, manage your account, trace and recover debts and prevent fraud and other criminal activity.

We may also inform the CRAs about your settled accounts and any debts that are not fully repaid on time. CRAs may share your information with other organisations, which may also use it to assess creditworthiness and product suitability, check identity, trace and recover debts. Your information may also be linked to the information of your spouse, any joint applicants or other financial associates. You should make sure you discuss and share this information with them.

The identities of the CRAs, their role as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, their data retention periods and your data protection rights in relation to information held by the CRAs are explained in more detail in the Credit Reference Agency Information Notice (CRAIN). The CRAIN is accessible from each of the three CRAs and each of the links below will take you to the same CRAIN document.

Third- Party Marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of Marketing

You can ask us to stop sending you marketing communications at any time by opting out via the footer of one of our marketing emails.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes, for example appointment reminders, updates to our terms and conditions, account information, safety or regulatory updates, and checks that your contact details are correct. If you are on a green tariff, you may also receive occasional communications about our green generation projects.

Security

  • We employ security measures to protect your information from access by unauthorised persons and against unlawful processing, accidental loss, destruction and damage. Protection of the registration details and any debit or credit card information you give to us is a major priority. We have implemented a security policy that guards against unauthorised access. Data on our secure pages is encrypted using SSL technology.

  • Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website, you are responsible for keeping this password confidential, and for letting us know if you think that your password has been compromised.

  • All your private data will be encrypted at all times whilst in transit over the Internet. SSL is special software that automatically encrypts any data sent by you on our secure pages. Our server then reads the data using a private key. This means that your data, be it debit or credit card information or any other personal details, is turned into code that can only be decoded with the private key or password. All pages on the site that require you to enter personal or sensitive information are secure. Your browser will indicate that the page is secure by displaying a padlock or key in the status bar at the bottom of the window. If your browser is suitably configured, you will receive a warning message when you first access any secure page on the site. This is simply information to advise you that the site is protecting your data.

  • Although Ecotricity will do its best to protect your personal data, it cannot guarantee the security of any personal data that you disclose online. You must accept the inherent security implications of using the Internet and we will not be responsible for any breach of security unless we have been in breach of applicable laws and then only to the limits set out in the terms and conditions for the Website.

  • Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers, affiliates and members of our corporate group. If you follow a link to any of these websites, please note that these websites have their own privacy policies/web site terms of use and we do not accept any responsibility or liability for these policies. Please check such policies before you submit any personal data to them.

Data Retention

  • If you are a Customer, we will retain your information for as long as you continue to use the Services and for a period of 7 years after your account has closed, unless a longer period is required or permitted by law. We may decide it is necessary to retain your information for longer for the purpose of resolving disputes or payment issues, or because it is still useful (in an anonymised form) to us to analyse your use of the Services. We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

  • Calls may be recorded and retained for up to five years to comply with Ofgem regulatory requirements, support auditing and quality assurance activities, investigate complaints, and evidence communications where required.

  • To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

  • By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.

  • In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

  • If you have requested information about the Services we provide, for example a quotation, we will retain your information for a period of up to 24 months from the provision of the information requested, after which your personal data will be deleted, providing that there is no ongoing legitimate reason for us to retain it.

Access to information

You have the right to:

Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Update your personal information. You can do so at any time by contacting us using the contact details provided under the “Contact” heading below.

Object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Not be subject to a solely automated decision, including profiling, that produces legal effects concerning you or similarly significantly affects you, unless this is permitted by law and appropriate safeguards apply.

Withdraw consent at any time where we are relying on consent to process your personal data (see the table above for details of when we rely on your consent as the legal basis for using your data). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

  • If you want us to establish the data's accuracy;

  • Where our use of the data is unlawful but you do not want us to erase it;

  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you.

If we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on other lawful grounds.

To exercise any of your data protection rights, including requesting access to your personal data, requesting rectification or erasure, restricting or objecting to processing, or requesting data portability, please email dataprotectionofficer@ecotricity.co.uk. We may ask for additional information to verify your identity before responding to your request.

Your rights may be subject to legal exemptions or limitations. If we cannot comply with a request in full, we will explain why where we are permitted to do so.

Complaints

  • You have the right to complain about our collection and use of your personal information. In the first instance you should contact our Data Protection Team by emailing dataprotectionofficer@ecotricity.co.uk

  • In the event that you are unhappy with the Data Protection Team’s response, you may raise your concerns with the Information Commissioner’s Office at https://ico.org.uk/concerns/. You are not required to contact us before raising a concern with the ICO, although we would welcome the opportunity to resolve your concern first.

  • We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

TIME LIMIT TO RESPOND

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

WHAT WE MAY NEED FROM YOU

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

NO FEE USUALLY REQUIRED

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

Changes to our privacy notice

We may update this privacy notice from time to time and will post any changes on our website. Where we make significant changes, we will take appropriate steps to bring them to your attention. If a change involves a new use of your personal data that requires consent under applicable data protection law, we will ask for your consent before carrying out that processing. You can see when this privacy notice was last updated by checking the “last updated” date displayed at the top of this privacy notice.

Contact

All comments, queries and requests relating to our use of your information are welcomed, using the following details: 

The Data Protection Officer
Ecotricity Group Limited
Lion House
Rowcroft
Stroud
GL5 3BY

Customer Services hotline

Within the UK:
0333 800 5500

Outside the UK:
+44 3338 005 500

Company Name: Instant EU GDPR Representative Ltd

Company Number: 665191

Contact Name: Adam Brogden

Contact Email: contact@gdprlocal.com

Contact Tel: +353 (0) 15549700

EU Dublin Address: INSTANT EU GDPR REPRESENTATIVE LTD, Office 2, 12A Lower Main Street, Lucan Co. Dublin, K78 X5P8 Ireland

Privacy Notice FAQs