Privacy statement

1. The Purpose of this Privacy Statement

ReFLEX Orkney Limited (Company Number SC648457) with its registered office at Block 3 Old Academy Business Centre, Stromness, Orkney, United Kingdom, KW16 3AW is a Data Controller of your personal data. This Privacy Statement is provided by ReFLEX Orkney Limited for members of the ReFLEX Orkney (Responsive Flexibility) Project (‘the Project’) and those individuals who make enquiries about the Project, to let you know how and why we use and process the personal data you entrust us with, how we keep it safe, who we share it with and to explain the legal rights you have in relation to your personal data.

Please note that when you view www.reflexorkney.co.uk your visit and any dispute over privacy is subject to this Privacy Statement and the Website Terms of Use.

2. The Project

The ReFLEX Orkney (Responsive Flexibility) Project (‘the Project’) aims to create a ‘smart energy island’ - developing a ground-breaking integrated energy system in Orkney which will monitor generation, grid constraint and energy demand and then use smart control of energy technologies to manage and improve the supply-demand balance. This will maximise use of locally generated green energy and pave the way towards a carbon neutral future.

Technologies which are intended to be rolled-out as part of the project include smart meters, energy monitors, domestic batteries for homes, larger batteries for businesses and public buildings, smart electric vehicle chargers, vehicle to grid chargers, electric vehicles, hydrogen fuel cells and smart heating systems.

We are committed to providing our members with truly excellent customer service. We recognise that our members and customers value their personal data and privacy, and so we treat your personal data with great care. This Privacy Statement sets out how and when we collect, use and share your personal information that you, or others, provide to us.

The Project Partners

Led by the European Marine Energy Centre (‘EMEC’), the Project will bring together a number of locally based partners – Orkney Islands Council, Aquatera, Solo Energy Limited, Community Energy Scotland and Heriot Watt University (the ‘Project Partners’). ReFLEX Orkney Limited is responsible for administering the Project.

When administering the Project, ReFLEX Orkney Limited may share your personal information with other Project Partners in connection with the Project. In some circumstances, the Project Partners may provide services to each other and act as Data Processors, meaning that one Project Partner may process your personal data under the instruction of another. In circumstances where the Project Partners jointly determine how your personal data is used for an agreed purpose, they may act as Joint Data Controllers. However, the majority of the time, the Project Partners will act as separate data controllers. This means that they will separately determine the way your personal data is used and, as such, are each responsible for your personal data and for compliance with all applicable data protection laws applicable in the United Kingdom form time to time including but not limited to the Data Protection Act 2018, the UK General Data Protection Regulation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (‘Data Protection Laws’).  Each Project Partner’s own privacy notice can be found in the link in the table below:

3. Membership and participation in any of our products and services

If you are 18 or over, are a resident of Orkney and would like to apply to join as a member of the Project to sign up to exclusive membership offers and benefits you can do so here. You will be asked to download a membership pack and to enter into a Membership Agreement and your personal data will be processed in accordance with our Privacy Statement. As a member you can choose to sign up to any of products and services and you may be asked to enter into supplemental terms and conditions that relate to a particular product or service.

You may also sign up to our newsletter. You can unsubscribe at any time (see below).

By providing us with your personal information you confirm that you are over 18 years of age. If you have any queries, please get in touch with us. 

4. How do we process information about you?

The law requires Data Controllers to provide individuals with information about how their personal data is processed. This section explains the purposes for which your personal data may be used when you sign up to be a member of the Project or make an enquiry about the Project and the lawful basis under which your personal data is processed. These purposes include:

When you join as a member

When you apply for membership, we will use your personal information to evaluate and process your application. You will be asked to download a membership pack and to enter into a Membership Agreement and your personal data will be processed in accordance with our Privacy Statement. The details we collect from you may include your name, address, date of birth, email address and phone number.

As a member you can choose to sign up to any of our products and services and you may be asked to enter into supplemental terms and conditions that relate to a particular product or service. We need to process your personal information in this way for any relevant Project Partner or third party supplier to enter and perform the contract for the product or service you agree to purchase.

When you become a member its necessary for us to process your personal data on the basis that there is a contract between you and us, or that you have requested we use the information before we enter into a legal contract. 

We may use your personal data in order to: 

• verify your identity for security purposes
• confirm your eligibility to join our membership programme or your eligibility to purchase any of our products or services
• provide you with our services
• provide you with service related communications

It’s important that you keep your personal information up to date, so please let us know if anything changes.

Marketing communications

If you have opted in to receive marketing communications from us or have previously expressed an interest in our products and services and have not opted out, we will process your personal information (your name, address, contact details and other personal information you’ve given us) to provide you with marketing communications in line with any preferences you have told us about. We rely on your consent to contact you for marketing purposes.

Every email we send to you for marketing purposes will also contain instructions on how to unsubscribe from receiving them, or you can contact us anytime at info@reflexorkney.co.uk.

Energy Usage Data

We may use information about your energy consumption and product usage to evaluate your energy usage, preferences and habits to ensure we provide the best products and services to you but also so that we can better monitor generation, grid constraint and energy demand and then use smart control of energy technologies to manage and improve the supply-demand balance. We will use this data where we have your consent to do so.

Additionally, we may aggregate and anonymise this information in a general way and use it to provide information to monitor our performance with respect to a particular product or service we provide. Where we do so, you as an individual will not be personally identifiable by such data. 

Where we process your personal data on the basis of consent you may withdraw your consent at any time by instructing us, or by choosing to unsubscribe from emails that we send you.

Website Data

When you access www.reflexorkney.co.uk personal data including your IP Address, web browser type and operating system may be processed on the basis that we have a legitimate interest to do so. We consider that the processing of this information does not present a privacy risk to you because we do not use the information in any way that would identify you personally. We may aggregate it in a general way and use it to provide information, for example to monitor the performance of a particular page on our website. 

We will also use your personal information for the purposes of administering our website and making it more secure, including troubleshooting, data analysis, testing, research, statistical and survey purposes. We process your data for this reason because we have a legitimate interest to provide you with an effective browsing experience, and to ensure that our website is kept secure.

With your consent, we may use cookies to provide you with a more effective user website experience. More information about how cookies and how you to consent to the use of non-essential cookies be used can be found in section 6 of this Privacy Statement.

When you phone, email or contact us on social media

When you phone or email us with general queries, we may process your personal information (your name, address, contact details and other personal information you’ve given us) in order to provide the customer services you have asked us to. We process your information on the basis of our legitimate interest.

To fulfil a legal obligation

Data Controllers are subject to the law like everyone else. Sometimes, your personal data will be processed to comply with a statutory obligation, such as HMRC tax or insurance obligations or provided to legal authorities if they request it or if they have the proper authorisation such as a search warrant or court order.

Information we receive from third parties

As well as the information you provide us with directly, we also receive information from some third parties. We work with various subcontractors, affiliates and partners, such as energy suppliers, electric vehicle leasing companies, and if you sign up to our services through one of our affiliates or partners, they may send us your personal information.

For more information about what all Project Partners may do with your data and their legal bases for doing so, please see the links to their privacy notices in the table at section 2 above.

5. Sharing your information

Where we share your information among the Project Partners or with any third parties, we always do so in line with this Privacy Statement and in compliance with Data Protection Laws. Where we engage third party processors we ensure that these third parties only use your data in line with our instructions. Some of the organisations we may share your information with include:

• The Project Partners, including ReFLEX Orkney Limited, Aquatera, Community Energy Scotland, Solo Energy Limited, Heriot-Watt University, Orkney Islands Council and the European Marine Energy Centre.

• The subcontractors we use to help us with installations and to attend emergencies.

• Our affiliates, suppliers and partners, including our white label partners, to the extent necessary to enable us to deliver our services to you. (For more specific information about who we may share data with as part of your participation in any of our schemes, please contact dpo@reflexorkney.co.uk).

• Payment providers, to help us process your payments to us.

• Drive Electric as our preferred third party supplier of electric vehicles as part of the Project.

• MailChimp (The Rocket Science Group LLC) in order to manage email subscriber lists and send emails to our subscribers.

• HubSpot (HubSpot, Inc.) in order to manage our relationship with our customers.

• Debt collectors where we have a legitimate interest to recover sums owed to us for our services.

• Our professional advisors, including our solicitors, accountants and data protection compliance advisers.

• Our telesales and field sales partners, but only where necessary to perform our services.

• To comply with a legal obligation

6. Cookies

Our website uses “cookies”. A cookie is a small file of letters and numbers that we store on your device. Cookies are a widely used tool that they enables our website to function properly and efficiently, as well as providing us with helpful information about how people use our website. Some cookies may last for a defined period of time, such as one day or until you close your browser. Others last indefinitely. We process data in accordance with our Cookie Policy.

7. Personal identifiers from your browsing activity

Requests by your web browser to our servers for web pages and other content on our website are recorded. We also record information about the software you are using to browse our website, such as the type of computer or device and the screen resolution. 

With your consent, we record information, via Google Analytics, such as your geographical location, your Internet service provider and your IP address. We use this information in aggregate to assess webpage popularity and server performance. If combined with other information we know about you from previous visits, the data possibly could be used to identify you personally, even if you are not signed into our website. 

8. Where is my data stored?

This website is hosted in the UK, however some of the third parties we work with as part of the Project may be based outside of the United Kingdom, so the processing of your personal information may involve a transfer of data outside of the United Kingdom and also the EEA. We may use third-party service providers who will process your data including:

Whenever we transfer your personal information outside of the UK and/or EEA, we will always ensure it is protected by making sure we have safeguards in place. This might mean only transferring your personal information to a country that has been deemed by the applicable UK authorities or the European Commission to provide an adequate level of protection, or by using specific contractual protections, or other specific mechanisms in any applicable Data Protection laws. You can contact us at dpo@reflexorkney.co.uk for details of how we protect specific transfers of your data.

All information that you provide us with is stored securely.

9. How long do we retain your data for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or administrative requirements. We typically will hold your data for the duration of the Project and up to 5 years following the completion of the Project.

In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical analysis, such as looking at your energy usage, preferences and habits, email open rates, or to improve our website and develop new products, services and schemes. In these cases, we may use this information indefinitely without further notice to you.

10. What are my rights under applicable Data Protection Laws?

You have various rights under the Data Protection Laws, which you can exercise by contacting us. The easiest way to do this is by email to dpo@reflexorkney.co.uk. If you wish to exercise your rights in relation to Solo Energy Limited, you may contact their DPO direct at dpo@sms-plc.com

• right to request access to your personal information - you can request a copy of the personal information we hold on you;

• right to request correction of your personal information - if any personal information we hold on you is incorrect, you can request to have it corrected;

• right to request erasure of your personal information - you can ask us to delete your personal information in certain circumstances;

• right to object to processing or restrict processing of your personal information - you may object to our processing of your personal data in certain circumstances;

• right to request the transfer of your personal information - to provide you, or a third party you have chosen, with your personal information; and

• right to withdraw consent – where we process your data on the basis of consent, you can notify us that you want to withdraw consent any time.

• right to complain – if you have any data protection complaints, you may contact the Information Commissioner's Office (ICO) by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Email: casework@ico.org.uk Telephone: 0303 123 1113.

11. What about websites we link to?

Our website may contain links to other websites. If you click on a link to any of these websites, you will leave our website and this may allow the operators of those websites to collect or share your data. We do not control the contents of those websites and so will not accept any responsibility or liability for any materials on there. We encourage you to check their privacy policies before you submit any personal information to these websites.

12. Use of site by children

Membership of the Project, and the opportunity to sign up to our schemes is not available to persons under the age of 18. In addition our website is not aimed at, nor do we knowingly market or sell products or provide services to children. If you are under 18, you may use our website only with consent from and under the supervision of a parent or guardian. 

13. Encryption of data sent between us

We use Secure Sockets Layer (SSL) certificates to verify our identity to your browser and to encrypt any data you give us. Whenever information is transferred between you and us, you can check that it is done using SSL by looking for a closed padlock symbol or other trust mark in your browser's URL bar or toolbar. 

14. Changes to our privacy statement

We keep our Privacy Statement under regular review. This Privacy Statement was last updated on the date shown below. It is likely that as the Project proceeds that we may change this Privacy Statement from time to time, for example to include details of how we will process your personal data as part of any new scheme that we may offer to our members from time to time, so you are advised to check this statement from time to time. If you sign up to receive email updates from the project, we will inform you whenever we update our Privacy Statement.

Contact us

Any questions, comments or requests regarding this privacy statement are welcomed and should be addressed to dpo@reflexorkney.co.uk.

ReFLEX Project Privacy Statement – Version 1.2 August 2021