Privacy Policy

Trust Alliance Group takes your privacy seriously. We know that there is a lot of information so use the quick links to read different sections of our policy.

This privacy notice tells you what to expect when we collect personal information from you. It also explains how we will store and handle that information and keep it safe.

We know that there is a lot of information, but we want you to be fully informed about your rights and be aware of how we collect and process your personal data.

Our privacy notice applies to the personal information we collect about:

• Visitors to our website.
• Complainants, third parties, and other individuals in relation to the complaint have been asked to investigate.
• People who call us with telephone enquiries.
• Job applicants, current and former employees.
• Marketing and Communications data (your preferences in receiving marketing from us and your communication preferences)

We will only use the personal information you provide to administer your complaint and to provide the services you have requested from us. The information you provide will also help us direct your enquiries.

The types of personal information that we collect are only those necessary for the consideration of your complaint about a Participating Company. We also collect data that helps our understanding of our customers and providing the highest levels of service.

To ensure that the personal information we hold is accurate and up-to-date, please ensure that we are promptly informed of any relevant change to your contact details.

We sometimes share your personal information with a third party, for example the named Participating Company to which your complaint relates, one of our regulators such as Ofcom or Ofgem, or where the transfer is to a secure data processor who carries out data processing operations on our behalf.

The Energy Ombudsman is registered on the "public register of data controllers" which can be seen online on the Information Commissioner Officer’s website.

Trust Alliance Group has the registered address of 3300 Daresbury Park, Daresbury, WA4 4HS.

The Data Protection Officer as assigned by Trust Alliance Group is also based at 3300 Daresbury Park, Daresbury, WA4 4HS.

We hope the following sections will answer any questions you have but if not, please do get in touch with us.

All your personal Information will be held and used in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 and any other legislation relating to the protection of personal data.

These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal information must be collected lawfully and used fairly, stored safely and not disclosed unlawfully.

Checking your identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Website

When someone visits our website, we automatically collect and store the following information about your visit:

• the Internet domain (for example, 'domain.com' or 'isp.com' if you use a private Internet access account) and IP address (an IP address is a number, ‘xxx.xxx.xxx.xxx', that is automatically assigned to your computer whenever you are surfing the web) from which you access our website.
• The type of browser software and operating system used to access our site.
• The date and time you access our site.
• The pages you enter, visit and exit our site from.
• If you linked to the server's domain from another website, the address of that website.

We use this information to help us identify click stream patterns, to improve our website, to learn about the number of visitors to our website and the types of technology our visitors use. This is statistical data about browsing actions and patterns and does not identify you as an individual.

We also use a third party services, Google Analytics and Hotjar, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site.

We may collect information about your computer, including where available your IP address, operating system and browser type, this is for system administration, to filter traffic, to look up use domains and to report statistics. This is statistical data about our users' browsing actions and patterns and does not identify any individual.

Please note: We are not responsible for any use of your personal information you provide to third-party websites that may be accessed via our website or websites. We recommend that you review the privacy policy of any third-party applications or websites that you use.

Cookies

A cookie is a piece of data stored locally on your computer containing information about your activities on the Internet. Each website can send its own cookie to your web browser if your browser's preferences allow it. Many websites do this whenever a user visits their website in order to track online traffic flows.

For further information about what a cookie is and how The Energy Ombudsman uses them, please see the cookie settings page of this website.

Reasons and purposes for processing information

When you ask us to consider a complaint about a Participating Company, we will only request you provide the personal information that is needed to process your complaint details. We require your data to pursue our legitimate interests in a way that might reasonably be expected as part of the complaint investigation work we undertake.

When you ask us to review a complaint about a Participating Company, you will need to provide us with personal details, including your name, address, email address, contact number and any relevant account numbers. The Energy Ombudsman will also request you provide authority for us to approach the Participating Company to obtain the details of your account.

It is necessary to share your personal information with the company that is the subject of your complaint. This company will be asked to provide us with its response to your complaint, this will include any data from any accounts and/or complaint files that the company has opened about you or the complaint.

We may also ask you to provide further information that would be relevant to your complaint, for example, the relevant contract, timeline of events, or relevant bank statements.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

Trust Alliance Group only uses the information you provide to:

• Respond to your enquiry or enquiries.
• Investigate your complaint or complaints.
• Comply with regulator reporting requirements.
• Help us to improve the quality of our services including IT improvements.
• Compile aggregated data.

In some specific circumstances, you have the right to request that we stop processing your personal data. For example; when you withdraw consent, or object and we have no legitimate overriding interest, or once the purpose for which we hold the data has come to an end.

Please note that if your complaint is active when you ask us to stop processing your personal data or object to the processing of your personal data, we will not be able to continue to process your complaint.

Monitoring and recording of telephone calls

We record and monitor incoming and outgoing telephone calls (if it's not withheld). Recordings are used to protect the interests of those participating in the call and provide us with useful information or evidence that supports your complaint. Recordings may also be used for staff training exercises, to improve the quality of our services.

The telephone calls that we record will be kept secure and subsequently deleted in a structured and organised manner. Recorded calls are kept for a period of 12 months. If a call recording provides useful information or evidence that supports your complaint we may keep this as part of your case for a period of six years.

Trust Alliance Group also collects Calling Line Identification (“CLI”, also known as “caller ID”) when you contact us by telephone. This means that we will be provided with, and will record, the telephone number that you have used to contact us unless you have taken steps to withhold the number.

Monitoring and recording of emails

Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.

Monitoring and recording of contacts via social media.

You are able to contact us via Twitter or Facebook. Please note that we have no influence on the scope of data that is collected by these social networks through their sites. The data use policies of the social networks provide information on the purpose and extent of the data that they collect, how this data is processed and used, the rights available to you and the settings that you can use to protect your privacy.

We may retain some information provided via social networks if it is relevant to your complaint.

Your rights include:

The right to be informed. Trust Alliance Group aims to be transparent within our privacy policy over how we use your personal data. The privacy policy will also confirm how long we will retain your data for.

Right of access

You have the right to request a copy of any information that Trust Alliance Group holds about you. For those requesting a ‘subject access request’, it will be provided free of charge in most cases and within one month. Please see the section ‘Right of access to personal information’, for further information.

The right to rectification

You have the right to request the correction of your personal data when it is incorrect, out of date or incomplete. Some corrections can be completed via your access to the portal. You can also contact us by emailing DPO@trustalliancegroup.org and we can amend inaccurate personal data, however please note that in some circumstances we may ask for the documentary proof that the amendment is necessary. Any changes to personal data will have to be communicated to each recipient to whom the personal data has been disclosed (likely to be the Participating Company of your complaint), unless it is impossible or disproportionate.

The right to erasure

You can request the erasure of your personal data when it is no longer necessary, you withdraw consent, or you object to its processing. Some information held by Trust Alliance Group is required by law to be held for a period of time. You can contact us by emailing DPO@trustalliancegroup.org if you wish to make a request.

The right to restrict data

You can request that we restrict the processing of your personal data. This can be done in circumstances where we need to verify the accuracy of personal data, if you do not wish to have personal data erased or you object to the processing and we are considering this request.

The right to data portability

Under some circumstances you can request a copy of the personal data you provided to us in a machine readable format or ask that this data be transferred another third party.

The right to object

In some circumstances you can stop the processing of your personal data for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data. Where your details are used for marketing you can opt out at any time. You are able to adjust these settings within the portal, or you can contact us via DPO@trustalliancegroup.org

Automated decision making and profiling

You can request that a member of the Ombudsman team review any decision made solely on automated processing of your data. (i.e. where the decision has been made by a solely automated process). You will be notified if Trust Alliance Group makes a solely automated decision which produces a legal effect or significantly affects you.

Right of access to personal information

Trust Alliance Group tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a subject access request.

You have a right to obtain confirmation that your personal data is being processed by Trust Alliance Group and have access to your personal data.

Should you wish to obtain a copy of the personal data that we hold on you, please send an email to DPO@trustalliancegroup.org

It will assist us to process your request efficiently if you include:

• Any reference numbers contained in correspondence we have sent to you.
• The names of any staff who you have been in contact with.
• A summary of the information you would like us to provide.
• Verification of identity.

There will be no fee for the first copy of information provided in response to a subject access request, and we will usually send a copy of all the personal data that we hold concerning you within 30 days.

Please note that a subject access request does not entitle you to be provided with specific documents or an entire file, but rather, it entitles you to be provided with your personal data in a clear and permanent form.

Trust Alliance Group will provide the requested information via email unless you request another means, we may extend the timescale by a further two months if your request is particularly complex.

Explaining the legal basis we rely on

The law on data protection sets out a number of different reasons for which a company may collect and process your personal data.

Consent

In specific situations, we can collect and process your data with your consent, for example, when you tick a box to receive email newsletters.

When collecting your personal data, we will always make clear to you which data is necessary in connection with the particular activity.

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you have given your consent to receive marketing emails you can withdraw this at any time, or if we are relying on our legitimate interests to send you marketing you can object. In either case, just let us know. If you have received a direct marketing emails from us and no longer wish to do so, the easiest way to let us know is to click on the unsubscribe link at the bottom of our marketing emails or email unsubscribe@trustalliancegroup.org and put “unsubscribe” in the subject line.

Contractual obligations

In certain circumstances, we need your personal data to comply with our contractual obligations.

Legal compliance

If the law requires us to, we may need to collect and process your personal information. We also have regulatory requirements, which means we may share details of complaints with Ofgem and Ofcom.

Legitimate interest

In order to consider your complaint we require your personal information to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.

Retention of information

We will only retain your Information for as long as is necessary for the purpose or purposes for which we have collected it. If you send us paper documents, disks or USB’s containing information about your complaint, we will uploaded these securely to a digital format. The originals will then be destroyed within one month of receipt.

We will exercise discretion when necessary in destroying original documents, and may keep them longer if they are not readable in a digital format.

In all cases, we will retain your complaint file for a period of up to six years after the case has been closed. The retention period is set at six years for the following reasons:

• To ensure we have dealt with all aspects of your enquiry or complaint.
• To assist us should you or the Participating Company contact us again about the matter in the future.

You have a right to contact Trust Alliance Group at any time during this period to correct or amend any information you have provided to us.

We may record and/or retain anonymised information about your complaint in order to document and/or measure our own performance or the performance of our Participating Companies. We may also pass anonymised information about your complaint to regulatory bodies who oversee us or our Participating Companies. Any such reports will contain no personal data about you or any information from which you or your third parties could be identified.

All personal information that we hold will be deleted at the end of a six year period, or earlier if requested, in a structured and organised manner.

If someone opens a case to tell us about a complaint but we do not investigate it, we will keep the information for three years after the case has been closed.

If someone contacts us as part of an initial enquiry and does not open a case, we will keep the information for a period of six months.

Information	Retention period
Website information Internal domain IP address Browser software Date and time accessed site Further website info	6 months
Telephone recordings	12 months
Social media contacts	6 months (unless forms part of the complaint details)
Paper documents, disks or USB's	Originals kept for a period of one month unless explicitly request that they are returned during this time. Please note that we may keep them longer if they are not readable in a digital format.
Complaint file	6 years
Survey	All our survey results are anonymised.
Unsuccessful candidates for job applications	12 months

Security measures in place.

We have a number of protections in place to ensure that your personal data is kept secure. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

All of our employees understand the content of this privacy policy and are appropriately trained in data protection legal requirements.

We have been independently tested to verify our security systems and Trust Alliance Group meets the requirement standards of Cyber Essentials and Cyber Essentials plus.

This is the standard set by the Government, having worked together with the industry, to improve standards for cyber security. Cyber Essentials Plus offers a higher level of assurance through the external testing of our cyber security approach.

We would recommend that if you are sending us USBs or disks containing information, you consider encryption and/or passwords that you can provide to us separately to enable us to access the information.

Disclosure of your personal information to third parties

In order to process your complaint, we will ordinarily need to disclose the personal information you provide us with to the company you have complained about. We may also share your personal information with another Participating Company if it becomes necessary when considering your complaint. For example, a different Participating Company previously provided services and information they hold would be useful in the consideration of your complaint.

We may also need to share your personal information with it to a third party. For example; an independent expert if that help us with our investigation.

We are obliged by law to disclose some information to the regulatory bodies and will sometimes need to pass details of complaints to industry regulators. For example; Ofcom and Ofgem.

If we receive a request from a regulatory body or law enforcement agency, and if permitted under GDPR and other laws, we may disclose certain personal information to such bodies or agencies.

To help us process our work, we have contracts with companies who provide us with services such as IT support or translation services (if English is not your first language).

We only provide third parties with the information they need to know to perform their specific services. We work closely with all the third parties to ensure that your personal data is secure and protected at all times. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Our contracts with third parties make it clear that they must hold information securely, abide by the principles and provisions of data protection, and only use information as we instruct them to.

If we stop using their services, any of your personal information data held by them will either be deleted or rendered anonymous.

Where your personal information may be processed

Sometimes we will need to share your personal information with third parties and suppliers outside the UK such as Europe and the USA.

If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the UK. For example, our contracts with third parties stipulate the standards they must follow at all times. If you wish for more information about these contracts, please contact our Data Protection Officer.

Any transfer of your personal information will follow applicable laws and we will follow the guiding principles of this Privacy Notice.

Profiling and automated decision making

When complaints are accepted by Trust Alliance Group, the investigation will be undertaken by a designated Investigation Officer. However, the complaint can be progressed via an automated procedure. For example; the acceptance of a complaint when registered via the website or web form, and reminder emails at significant points within the investigation process.

If your case is progressed using an automated process, it is only done so using an appropriate mathematical and statistical procedure, for the purposes of considering your complaint and progressing it through our process.

Trust Alliance Group will advise you if your complaint is to be dealt with wholly by automated means. In instances where your complaint is wholly undertaken by automated means, you have the right to ask that an employee reviews any decisions made.

Job applicants

When individuals apply to work at Trust Alliance Group, the information they supply is used to process their application and to monitor recruitment statistics. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Criminal Records Bureau, we will not do so without informing the candidate beforehand unless the disclosure is required by law.

Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed. It will then be destroyed or deleted. We do retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data. Read our candidate privacy notice.

Once a person has taken up employment with Trust Alliance Group, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with Trust Alliance Group has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it after a period of seven years.

Reviews and updates to this notice

We endeavour to keep the privacy notice up-to-date by reviewing it at intervals of no more than six months. We additionally seek to ensure it is updated promptly if we make a materially relevant alteration to our processes or practices. Trust Alliance Group encourages visitors to frequently check this page for any changes to its Privacy Policy.

We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it.

If you have any questions that haven’t been covered, please contact our Data Protection Officer who will be pleased to help you:

• Email us at DPO@trustalliancegroup.org
• Or, write to us at Data Protection Officer, 3300 Daresbury Park, Daresbury, WA4 4HS.

For further information on the Data Protection please visit the Information Commissioner Office (ICO) website.

The Information Commissioner Office regulates data protection. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

You can contact them by calling 0303 123 1113 or visit the website

The Freedom of Information Act 2000.

The Freedom of Information Act 2000 places additional obligations, over and above those set out within the Data Protection Legislation, upon organisations and entities that are typified as being public authorities.

Trust Alliance Group is not defined as a public authority within the meaning of the Freedom of Information Act 2000 and is therefore not subject to the obligations set out within it.