Privacy Notice

1. Introduction

This Website (the “Service”) is operated by The Marketing Lounge Partnership Limited (MLP) registered in England and Wales with Company Registration Number 06467245 and having its registered office address at The Cow Shed, Walnut Tree Farm, Lower Stretton, Warrington, Cheshire WA4 4PG ("MLP") on behalf of Octopus Energy (“client“) and is committed to protecting and respecting your privacy. To view Octopus Energy’s full Privacy Notice click here(Link opens in a new tab)

Octopus Energy Limited is registered in England and Wales at UK House, 5th Floor, 164-182 Oxford Street, London W1D 1NN (Reg. No. 09263424).

In respect of the personal data collected and processed from you when you use the Website and the Services, the Data Controller is Octopus Energy Limited and MLP acts as the Data Processor.

The personal information you input on this website (e.g. first name, last name, e-mail address, telephone,) will be used by MLP to submit your rewards claim and to help manage any queries about this website or the Reward you are entitled to.

MLP is committed to protecting your right to privacy as a user of their online documents. It is their policy to respect the privacy of private communication.

The information you provide to MLP will be held by MLP on servers based in the UK, and, except as explained below, MLP will not transfer it, or authorise its transfer, outside the UK. Excluding where contact is made via the Telephone, the voice Data is held primarily in the UK with a fall over within the EEA.

MLP will always adhere to UK Data Protection Legislation, including but not limited to, the Data Protection Act 2018 and EU Regulation 2016/679 General Data Protection Regulation (“GDPR”).

Other than as stated below and the Controller, MLP do not hold or use any information that you provide, or which MLP collect, outside the UK nor do MLP transfer it to, or share it with, others within or outside the UK (except when MLP believe in good faith that the law requires it).

2. Collection of personal data

MLP collect personal data for one or more of the following purposes:

  • To provide you with information that you have requested.
  • To fulfil the provision of services with you or with the entity that you represent.
  • To ensure the security and safe operation of their websites and underlying business infrastructure.

MLP’s Cookie Policy describes in detail how Cookies are used.

In section 8 below, MLP identifies your rights in respect of the personal data that MLP collects and describes how you can exercise those rights.

3. Lawful basis for the processing of personal data

In order for MLP to fulfil their contractual and customer obligations, there is a requirement to collect specific personally identifiable information.

There are legal bases for the processing of such personally identifiable information; primarily personal information is processed on the basis of consent. MLP retains evidence of consent which has been collected by MLP or provided by Octopus Energy. Where consent cannot be obtained for whatever reason, MLP may legally process the information you provide because they have a legitimate interest in doing so.

Legitimate interests
MLP have a legitimate interest in further processing the information which is provided by you or Octopus Energy. MLP may also use your information for other specific legitimate purposes such as:

  • To ensure that content from the Website is presented in the most effective manner for you.
  • To provide you with information, products or services that you request from MLP.
  • To carry out their obligations arising from any contracts entered into between you and MLP.
  • To notify you about changes to the service.

Information collection and use:

Making a claim for a reward:
In order for you to make a claim Octopus Energy will share your Customer ID only to MLP.

Raising a query with MLP, MLP will ask you for:

  • First name
  • Last name
  • Email address
  • There may be other identifiers MLP need but these will be about the Reward you have claimed such as your code, date of claim

When you submit your query, if you volunteer any additional data this is at your own discretion.

MLP may also collect information on how the Website is accessed and used (“Usage Data”). This Usage Data may include information such as your computer’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of the Website that you visit, the time and date of your visit or an email opened, the time spent on those pages, unique device identifiers and other diagnostic data. From time to time, MLP may use technologies, such as tracking pixels (also called 1x1 pixels or pixel tags)

4. Does MLP share your Personal Data?

MLP may share your personal data with our Reward partners to help solve any queries relating to the use of your Reward.

5. Storage of personal data

MLP is a UK-domiciled organisation whose offices are in the UK.

  • Their websites and web applications are hosted in the UK and are accessed only by their UK staff.
  • Their Customer Services team are UK-based, however may use system’s that reside within the EEA. As stated in Section 1 of this Privacy Notice.
  • MLP may use 3rd party services, where data leaves the EEA. These are Tracking (Google analytics). Data transfers are made in accordance with the requirements of Regulation (EU) 2016/679 (the General Data Protection Regulation or “EU GDPR”) and may be based on the use of the European Commission’s Standard Contract Clauses for transfers of personal data outside the EEA.
  • MLP uses a range of CSPs (Cloud service providers) as part of their processing environment. Unless MLP specifically states otherwise, MLP are, in respect of all these CSPs, the data processor for Octopus Energy.
  • Unless specifically stated otherwise, all the CSPs that are utilised are UK processing facilities.
  • All backups of MLP’s systems and data reside within the UK.

6. Removal of your data

MLP will store your personal data and other non-personal data relating to your submitted rewards claim or submitted query on the Website, insofar as is necessary to service your Rewards claim.

MLP will delete and remove all your personal data gathered during the campaign period, relating to your submitted rewards claim and/or any queries submitted, from MLP hosted systems after 6 months of last customer contact or the date of your last reward claimed.

7. Security measures

To manage any communication between you and MLP.

MLPs ISMS (Information Security Management System) is certified to ISO/IEC 27001.

MLP have what they believe are appropriate security controls in place to protect personal data. Risk assessment, including assessing risks to the rights and freedoms of data subjects, is at the heart of their ISMS. They do not, however, have any control over what happens between your device and the boundary of their information infrastructure. You should be aware of the many information security risks that exist and take appropriate steps to safeguard your own information. They accept no liability in respect of breaches that occur beyond their sphere of control.

8. Your rights as a data subject

As a data subject whose personal information MLP hold, you have certain rights. If you wish to exercise any of these rights, please email [email protected] or use the information supplied in the ‘Contact us’. To process your request, MLP will ask you to provide two valid forms of identification for verification purposes. Your rights are as follows:

The right to be informed
As a Data Processor, MLP are obliged to provide clear and transparent information about their data processing activities. This is provided by this Privacy Notice and any related communications MLP may send you.

The right of access
You may request a copy of the personal data MLP hold about you free of charge. Once MLP have verified your identity and, if relevant, the authority of any third-party requestor, MLP will provide access to the personal data they hold about you as well as the following information:

  • The purposes of the processing.
  • The categories of personal data concerned.
  • The recipients to whom the personal data has been disclosed.
  • The retention period or envisioned retention period for that personal data.
  • When personal data has been collected from a third party, the source of the personal data.

If there are exceptional circumstances that mean MLP can refuse to provide the information, MLP will explain them. If requests are frivolous or vexatious, MLP reserve the right to refuse them.

The right to rectification
When you believe MLP hold inaccurate or incomplete personal information about you, you may exercise your right to correct or complete this data.

This may be used with the right to restrict processing to make sure that incorrect/incomplete information is not processed until it is corrected.

The right to erasure (the ‘right to be forgotten’)
Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that MLP delete the personal data. This includes personal data that may have been unlawfully processed. MLP will take all reasonable steps to ensure erasure.

The right to restrict processing
You may ask MLP to stop processing your personal data. MLP will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies, you may exercise the right to restrict processing:

  • The accuracy of the personal data is contested.
  • Processing of the personal data is unlawful.
  • MLP no longer need the personal data for processing but the personal data is required for part of a legal process.
  • The right to object has been exercised and processing is restricted pending a decision on the status of the processing.

The right to data portability
You may request your set of personal data be transferred to another Controller or Processor, provided in a commonly used and machine-readable format. This right is only available if the original processing was on the basis of consent, the processing is by automated means and if the processing is based on the fulfilment of a contractual obligation.

The right to object
You have the right to object to MLP processing of your data where:

  • Processing is based on legitimate interest;
  • Processing is for the purpose of direct marketing;
  • Processing is for the purposes of scientific or historic research; or
  • Processing involves automated decision-making and profiling.

9. Contact MLP

Questions, comments and requests regarding this Privacy Notice are welcome and should either be emailed to [email protected] or addressed to Data Compliance officer, The Marketing Lounge Partnership Limited, The Cow Shed, Walnut Tree Farm, Lower Stretton, Cheshire, WA4 4PG.

10. Changes to this Privacy Notice

MLP may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if MLP change their business in a way that affects personal data protection.

This Privacy Notice was last updated on 17th January 2024.