Privacy notice
This notice explains how Nationwide Energy Consultants, trading as Nationwide Energy ("Nationwide Energy", "we"), handles personal data in the Nationwide Portal at portal.nationwide-energy.co.uk and its iPhone app.
Nationwide Energy is the controller of the personal data described here. Our registered office, company number and ICO registration number are [legal to confirm].
1. What we collect
About people who sign in:
- name, work email address and the business they sign in for
- what they can see and do in the portal, and when they last signed in
- sign-in records: one-time codes and sign-in links (kept for minutes, not stored after use), session records, IP address and device or browser details, and for anyone who adds a passkey, its public key and a name for the device (the passkey itself, and any fingerprint or face, never leave the person's device)
- what they do in the portal where it matters as a record: bills flagged, readings submitted, files uploaded, agreements accepted (with the name and job title they typed)
- messages they send us through the portal.
About the businesses we work for:
- sites, meters, consumption, bills, contracts, budgets and purchasing.
This is usually business information, not personal data. But if you are a sole trader or a partnership, the meter and consumption data for your premises is personal data under the UK GDPR, because it relates to you as an individual. The Information Commissioner's Office takes this view of consumption data linked to a sole trader's meter point. We treat it as personal data and apply this notice to it in full.
2. Where it comes from
- from you and your colleagues, in the portal or through your account manager
- from your energy suppliers, meter operators, data collectors and data services, smart meter data providers and industry data services, under the letter of authority you give us
- from Enable, Nationwide Energy's own customer records system.
3. What we use it for, and our lawful basis
| Use | Lawful basis |
|---|---|
| Signing people in and keeping the portal secure | Legitimate interests: protecting your data and ours |
| Providing the energy management service: showing consumption, checking bills, managing contracts, budgets and purchasing | Contract with your business; for sole traders, contract with you |
| Collecting smart meter data | Your explicit consent, given in the letter of authority, as the Smart Energy Code requires. You can withdraw it at any time [legal to confirm the lawful basis alongside SEC consent] |
| Keeping records of who accepted agreements, and of changes to who can see what | Legitimate interests: being able to show what was agreed and by whom |
| Meeting legal and regulatory duties | Legal obligation |
We don't use the portal's data for marketing, and we don't sell it.
4. Who processes it for us
We use these service providers, under contracts that require them to protect the data and use it only on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Microsoft Azure | Hosts the portal and its database, and stores uploaded files | UK South (London) |
| Cloudflare | Sits in front of the portal: protects it from attacks and passes traffic through securely | Worldwide network; traffic may pass through data centres outside the UK [legal to confirm transfer safeguards] |
| Resend | Sends emails from the portal, such as sign-in codes and invitations | United States [legal to confirm transfer safeguards] |
| Sentry | Records errors in the portal so we can fix them: what went wrong and where, with your user id but not your name, email address or what you typed | European Union [legal to confirm transfer safeguards] |
| Apple | Will deliver push notifications to the iPhone app, once the app has them | United States [legal to confirm transfer safeguards] |
We also share data, as the letter of authority describes, with your suppliers, meter operators and data services when we ask them for information or act for you.
5. How long we keep it
- Sign-in records: a session ends 30 days after it was last used, and at most 180 days after sign-in; sign-in codes and links expire within minutes; a passkey is kept until its owner removes it or their account is closed.
- Your account and users: while your account is open.
- Consumption, bills and contracts: while your account is open, and then for [legal to confirm, for example 6 years] after it closes, for tax, contract and dispute purposes.
- Records of agreements accepted: for as long as the agreement is in force, and then for [legal to confirm] after it ends.
- Access logs: [legal to confirm] months.
6. Your rights
You have the right to ask for a copy of your personal data, to have it corrected, to have it deleted or its use restricted, to object to how we use it, and to have it moved to another provider. Where we rely on consent, you can withdraw it at any time; this doesn't affect what we did before.
To use any of these rights, contact your account manager or [legal to confirm the data protection contact]. We reply within one month.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
7. Security
- The portal is served only over an encrypted connection.
- Each business's data is kept apart by the database itself, so one business can never see another's.
- Sign-in is by one-time code sent to a work email address; there are no passwords to steal.
- Our staff's access to a business's data is logged.
8. Changes
We publish any change to this notice here, with a new version date.