This privacy notice explains what personal data (information) we hold about you, how we collect it,
and how we use and may share data about you during your employment and after it ends. We are
required to notify you of this in accordance with the General Data Protection Regulation (GDPR). It
applies to all employees, workers and contractors. Please ensure that you read this notice (sometimes
referred to as a ‘privacy notice’) and any other similar notice we may provide to you from time to time
when we collect or process personal data about you.

Who collects the data
Energyline Limited (‘Company’) is a ‘controller’ of personal data and gathers and uses certain data
about you.

Data protection principles
We will comply with the data protection principles when gathering and using personal data.

About the data we collect and hold
The table set out in Error! Reference source not found. summarises the data we collect and hold, how
and why we do so, how we use it and with whom it may be shared.

We may also need to share some of the categories of personal data set out in the Schedule with other
parties, such as external contractors and our professional advisers (including IT support, accountants,
payroll, marketing, banking, benefit providers and legal advisers). We may also need to share some
data with potential purchasers of some or all of our business or on a re-structuring and this data would
usually be anonymised but this may not always be possible. In all cases, the recipient of the data will
be bound by confidentiality obligations. We may also be required to share some personal data with
our regulators or as required to comply with the law.

We seek to ensure that our data collection and processing is always proportionate. We will notify you
of any changes to data we collect or to the purposes for which we collect and process it.

Special categories
There are “special categories” of more sensitive personal data which require a higher level of
protection.

We may also collect, store and use the following “special categories” of more sensitive personal
information:
• Information about your race or ethnicity, religious beliefs, sexual orientation and political
opinions.
• Information about your health, including any medical condition, health and sickness records.
• Genetic information and biometric data.
• Information about criminal convictions and offences.

How we use particularly sensitive personal information
"Special categories” of particularly sensitive personal information require higher levels of protection.
We need to have further justification for collecting, storing and using this type of personal information.
We may process special categories of personal information in the following circumstances:

1. In limited circumstances, with your explicit written consent.
2. Where we need to carry out our legal obligations and in line with our data protection policy.
3. Where it is needed in the public interest, such as for equal opportunities monitoring and in
line with our data protection policy.
4. Where it is needed to assess your working capacity on health grounds, subject to
appropriate confidentiality safeguards.

Less commonly, we may process this type of information where it is needed in relation to legal claims
or where it is needed to protect your interests (or someone else’s interests) and you are not capable
of giving your consent, or where you have already made the information public.

Our obligations as an employer
We will use your particularly sensitive personal information in the following ways:

• We will use information relating to leaves of absence, which may include sickness absence or
family related leaves, to comply with employment and other laws.
• We will use information about your physical or mental health, or disability status, to ensure
your health and safety in the workplace and to assess your fitness to work, to provide
appropriate workplace adjustments, to monitor and manage sickness absence and to
administer benefits.
• We will use information about your race or national or ethnic origin, religious, philosophical
or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal
opportunity monitoring and reporting.

Do we need your consent?
We do not need your consent if we use special categories of your personal information in accordance
with our written policy to carry out our legal obligations or exercise specific rights in the field of
employment law. In limited circumstances, we may approach you for your written consent to allow us
to process certain particularly sensitive data. If we do so, we will provide you with full details of the
information that we would like and the reason we need it, so that you can carefully consider whether
you wish to consent. You should be aware that it is not a condition of your contract with us that you
agree to any request for consent from us.

Where data may be held
Data may be held securely at our offices and third-party agencies, service providers, representatives
and agents as described above. We do not transfer any data outside of the UK.

How secure is my information with third-party service providers and other entities?

All our third-party service providers and other entities are required to take appropriate security
measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to
process your personal data for specified purposes and in accordance with our instructions.

How long we keep your data
We keep your data during and after your employment for no longer than is necessary for the purposes
for which the personal data is processed. Further details on this are available in our employee records
data retention and erasure policy.

Your right to object to us processing your data
Where our processing of your data is based solely on our legitimate interests (or those of a third party),
you have the right to object to that processing if you give us specific reasons why you are objecting,
which are based on your particular situation. If you object, we can no longer process your data unless
we can demonstrate legitimate grounds for the processing, which override your interests, rights and
freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Please contact us (see details below) if you wish to object in this way.

Your rights to correct and access your data and to ask for it to be erased

Please contact us (details below) if (in accordance with applicable law) you would like to correct or
request access to data that we hold relating to you or if you have any questions about this notice. You
also have the right to ask us for some but not all of the data we hold and process to be erased (the
‘right to be forgotten’) in certain circumstances. We will provide you with further information about
the right to be forgotten, if you ask for it.

Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing
and transfer of your personal information for a specific purpose, you have the right to withdraw your
consent for that specific processing at any time. To withdraw your consent, please contact us (see
details below). Once we have received notification that you have withdrawn your consent, we will no
longer process your information for the purpose or purposes you originally agreed to, unless we have
another legitimate basis for doing so in law.

Keeping your personal data secure
We have appropriate security measures in place to prevent personal data from being accidentally lost
or used or accessed in an unauthorised way. We limit access to your personal data to those who have
a genuine business need to know it. Those processing your data will do so only in an authorised
manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you
and any applicable regulator of a suspected data security breach where we are legally required to do
so.

Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. Please keep
us informed, in writing, if your personal information changes during your working relationship with
us.

How to contact us
If you have any questions regarding this notice or require any assistance, please contact our Data
Protection Officer, Michele Dawson.

How to complain
We hope that we can resolve any query or concern you raise about our use of your data. If not, contact
the Information Commissioner at https://ico.org.uk/make-a-complaint/or telephone: 0303 123 1113
for further information about your rights and how to make a formal complaint.