See our Towy Usk project cross

PRIVACY POLICY

We are Green GEN Cymru.

Green Generation Energy Networks Cymru Limited (‘Green GEN Cymru’)  is responsible for your personal data. Green GEN Cymru (a company incorporated in England and Wales, registration number 13060815) is part of the Bute Energy Group but, on becoming a licensed business, will perform its own functions, will be legally separate from other companies within the Group, and will be managed and operated independently.

For the purposes of applicable data protection law (in particular, the General Data Protection Regulation (EU) 2016/679 (the “GDPR”)), your data will be controlled by Green GEN Cymru.

Green GEN Cymru respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

Our contact details are set out at the end of this privacy policy.

What does this privacy policy cover?

This Privacy Policy explains our use of personal data through our website and with individuals we interact with including those we correspond with, suppliers, candidates and landlords. It covers processing by Green GEN Cymru Limited and any other entity within the Bute group.

What personal data do we collect and why do we use it?

The table below explains who we collect personal data about, what that personal data is and the purpose. The last column sets out the ‘lawful basis’ we rely on for processing that personal data which is a requirement of data protection law. Companies may only process personal data if they can identify a lawful basis from a list set out in legislation.

INDIVIDUALS WHO CONTACT US

Personal data

Contact details provided and correspondence.

Source and purpose

This information is given to us by you. It is used to respond to your query and keep a record of it.

Lawful basis for processing

Our legitimate interests as a business in responding to and keeping a record of correspondence.

CLIENTS AND POTENTIAL CLIENTS

Personal data

Contact details provided, correspondence and contracts.

Source and purpose

This information is given to us by you or from publicly available information (for example on your website). It is used for us to fulfil contracts and engage in business discussions, such as the development of new sites.

Lawful basis for processing

Our legitimate interests as a business in responding to and keeping a record of correspondence. Some information is also necessary for us to perform our contract – for example certain contact details – and because we have a legal obligation to process that data.

SUPPLIERS AND CONTRACTORS

Personal data

Contact details provided, correspondence and contracts.

Source and purpose

This information is given to us by you or from publicly available information (for example on your website). It is used for us to fulfil contracts and engage in business discussions, such as in relation to the supply of services.

Lawful basis for processing

Our legitimate interests as a business in responding to and keeping a record of correspondence. Some information is also necessary for us to perform our contract – for example certain contact details.

LANDOWNERS

Personal data

Contact details provided, correspondence, contracts and property and land registration details.

Source and purpose

This information is given to us by you or from publicly available information (for example on land registries). It is used for us to fulfil contracts and engage in business discussions, such as in relation to tenancies and developments.

Lawful basis for processing

Our legitimate interests as a business in responding to and keeping a record of correspondence and assessing opportunities. Necessity for us to perform our contract – for example certain contact details and to comply with legal requirements.

CANDIDATES

Personal data

CV, contact details, reference information and correspondence.

Source and purpose

This information is given to us by you from third party referees. It is used to assess the suitability of candidates applying for a position with us.

Lawful basis for processing

Our legitimate interests in assessing the suitability of candidates applying for a position with us. Any health or other sensitive information is only collected if you have chosen to give it to us/consented to us processing it.

How long do we keep your personal data for?

We keep your information only for as long as is necessary for the relevant purpose. For example, if we have a contract with you, this will be for 6.5 years after expiry in order to assist us with any contractual claims. We use a number of criteria for determining the retention period including obligations under law, our need to defend or bring contractual claims within the statutory limitation period and consideration of the original purpose we collected it for.

Who do we share your personal data with?

Data may be shared in the following circumstances:

  • With professional advisors including consultants;
  • In order to conduct checks on you to verify the information you have provided us with where you are being considered for a position or contract with us;
  • In the event of a sale of the company or its assets;
  • With suppliers but only subject to robust contractual protections;
  • With clients on a need to know basis; and
  • With group companies.
  • With our legal advisors
  • With Ofgem and other regulatory bodies
  • With the Welsh Ministers
  • With the Planning Inspectorate

Do we make automated decisions concerning you?

Automated decisions are those made without human intervention that have a legal effect on you or other similarly significant effect (for example determining whether you are eligible for a job). We do not carry out this type of processing activity.

Do we transfer your data outside the UK and/or the EEA?

We may sometimes transfer your personal data to countries outside the UK/or European Economic Area (or between the two), for example if we are using a supplier based elsewhere. You can find the list of member states by clicking on the following link: https://ec.europa.eu/eurostat/statistics-explained/index.php/Glossary:European_Economic_Area_(EEA). The privacy laws in countries outside the European Economic Area and UK may be different from those in your home country.

Where we transfer data to a country that has not been deemed to provide adequate data protection standards, we always have security measures and approved model clauses or other adequate safeguards in place to protect your personal data. Please contact us if you would like more details about our safeguards for data transfers.

What rights do you have in relation to the data we hold on you?

By law, you have a number of rights when it comes to your personal data. Further information and advice about your rights can be obtained from the data protection regulator in your country. In the UK this is the Information Commissioner’s Office.

We usually act on requests and provide information free of charge, but may charge a reasonable fee to cover our administrative costs of providing the information for:

  • Baseless or excessive/repeated requests; or
  • Further copies of the same information.

Alternatively, we may be entitled to refuse to act on the request in some circumstances.

Please consider your request responsibly before submitting it. We’ll respond as soon as we can. Generally, this will be within one month from when we receive your request but, if the request is going to take longer to deal with, we’ll come back to you and let you know.

1. The right to be informed

What does this mean?

You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this Privacy Policy. If you have any additional questions, for example regarding transfers and locations of data or our legitimate interests basis, do please get in touch.

2. The right of access

What does this mean?

You have the right to obtain access to your information (if we are processing it), and certain other information (similar to that provided in this Privacy Policy). This is so you’re aware and can check that we’re using your information in accordance with data protection law.

3. The right to rectification

What does this mean?

You are entitled to have your information corrected if its inaccurate or incomplete.

4. The right to erasure

What does this mean?

This is also known as the ‘right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there is no compelling reason for us to keep using it. This is not a general right, there are exceptions.

5. The right to restrict processing

What does this mean?

You have rights to ‘block’ or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future.

6. The right to data portability

What does this mean?

You have rights to obtain and reuse your personal data for your own purposes across different services. This is not a normal scenario for companies of our nature but if you have any questions, you can contact us.

7. The right to object to processing

What does this mean?

You have the right to object to certain types of processing, including processing for direct marketing or where we are relying on our legitimate interests for processing.

8. The right to lodge a complaint

What does this mean?

You have the right to lodge a complaint about the way we handle or process your personal data with your national data protection regulator.

9. The right to withdraw consent

What does this mean?

If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for marketing purposes.

How can you contact us?

If you are unhappy with how we’ve handled your information or have further questions on the processing of your personal data, contact the DPO at dpo@bute.energy or by post:

DPO
Hodge House
Guildhall Place
Cardiff CF10 1DY
United Kingdom

Your right to make a complaint

You have the right to make a complaint about how Green GEN Cymru processes personal data to the Information Commissioner:

Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
www.ico.org.uk

Do we make changes to our Privacy Policy?

We may change this Privacy Policy at any time. If we make any changes, we’ll post them on this page. If they’re substantive changes, we’ll also have a more prominent notice letting you know.

Last updated: This privacy policy was last updated on 09 August 2023.