Sphere Energy Connect Privacy Notice

This privacy notice describes how Sphere Energy Connect Limited (SC814857) having its registered office at 320 St Vincent Street, Glasgow, G2 5AD (“we” or “us”), will process personal data in connection with our business activities.

Sphere Energy Connect Limited (“Sphere”) are part of the Scottish Power Limited Group (“ScottishPower”) and ScottishPower are part of the Iberdrola Group.

In this Policy, references to ""you" and "your" (and other similar terms) mean our contacts, stakeholders and website visitors.

Please note, if you are a supplier or representative of a supplier, please refer to our Supplier and Prospective Supplier Privacy Notice.

This privacy notice contains important information about what personal details we collect; what we do with that information and the lawful bases; who we may share it with and why; and your data protection rights.

Introduction

In order for Sphere to comply with our obligations as an Independent Distribution Network Operator, we are required to collect and process your personal data. The personal data we collect may come from a number of different sources, including:

• Directly from you through communication with us (email);
• Through your presence on ScottishPower sites e.g CCTV footage.
• When accessing our website (cookies)

Sphere may process your personal data for different purposes depending on the nature of the relationship you have with us.

General Enquiries

Sphere will process your personal data in order to provide a response when you raise an enquiry to us via email or webform.

We may collect and process the following categories of personal data;

• Identification and contact information i.e. Name, Address, Email, Telephone;
• Commercial information if you are a business; and
• Any relevant details or personal data you provide to us as part of the enquiry

Our lawful bases for processing personal data for this purpose are;

• Legitimate Interest – where we have a legitimate interest to communicate with individuals in relation to our services.
• Legal Obligation – in some cases, we have a legal obligation in relation to our regulatory obligations set by Ofgem licence conditions (Guaranteed Standards of Performance)

Complaints

Sphere will collect and process personal data to assist with investigation, response and resolution of complaints raised.

We may collect and process the following categories of personal data;

• Identification and contact information i.e. Name, Title, Address, Email and Telephone Number;
• Commercial information if you are a business; and
• Any other relevant details or personal data you provide to us as part of the complaint

Our lawful bases for processing personal data for this purpose are;

• Legitimate Interest – where we have a legitimate interest to investigate complaints and communicate with individuals in regards any complaints.

• Legal Obligation – depending on the topic of the complaint, we may have a legal obligation to investigate and respond to complaints. This would include our regulatory obligations set by Ofgem licence conditions (Guaranteed Standards of Performance) and complaints related to Data Protection under Data (Use and Access) Act 2025 (Part 5, paragraph 103).

Closed-Circuit Television (CCTV)

ScottishPower group operates CCTV at our facilities for the purposes of maintaining the security of property and premises, site safety and the detection and prevention of crime. To find out more information on the processing please see the full CCTV privacy notice by clicking here.

Cookies

When accessing our website, for example if you submit a query, cookies may collect some data e.g. IP location. Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies enable us to:

• Ensure our websites are working correctly
• Offer you a customised web service
• Continually improve our websites for you

If you would like more information and to manage your cookie preferences, please see our cookies policy.

Find out how to manage or remove the cookies already set from your browser by going to the help menu in your browser.

Security of Data

We have in place appropriate technical and organisational security measures to protect your personal data against unauthorised or unlawful use, and against accidental loss, damage or destruction. We have put in place strict confidentiality agreements (including data protection obligations) with our third-party service providers and processors.

Who do we share your personal data with?

Sphere are part of the Iberdrola Group and in order to fulfil the purposes listed in this privacy notice, we may share your personal data with other companies within IBERDROLA S.A. Group.

Sphere engage with data processors who are third parties e.g suppliers, contractors etc, that may collect or otherwise process personal data in the course of providing services to us or on our behalf. We have agreements in place with our data processors that restrict the purposes for which they can process the personal data, and we will only share personal data that is required to enable them to perform these services.  We will not pass any personal data collected to third parties for marketing purposes.

How long do we keep your personal data?

We have in place data retention processes so that personal data is not stored or processed for any longer than necessary. How long we keep personal data will depend on the purpose(s) for which it was originally collected.

International Transfer of Personal Data

Your personal data will be processed and stored within the UK or the European Economic Area (EEA). In any instances where this data is to be transferred outside of these areas, we will implement appropriate safeguards and security measures to ensure the protection of your personal data.

Sphere are part of the Iberdrola Group and as such any data transfers that occur within the group are carried out in accordance with the applicable data protection laws and our Binding Corporate Rules (BCRs). The Iberdrola Group’s BCRs reflect European legislation on data protection (General Data Protection Regulation) which means that all companies in our Group have to comply with the same internal rules. You can view a copy of the Iberdrola BCR’s here.

Your Rights

In accordance with Data Protection Legislation, you can exercise any of the following rights by contacting: dataprotection_corporate@scottishpower.com

• Right of access – you have the right to obtain confirmation of what personal data is being processed and to receive a copy of this personal data.
• Right to rectification – you have the right to have your personal data rectified if it is inaccurate or incomplete.
• Right to erasure (Right to be forgotten) – you have the right to request the deletion or removal of your personal data where there is no lawful basis for its continued processing.
• Right to restrict processing – you have the right to request that we block or suppress processing of your personal data.
• Right to object to processing – you have the right to object to the processing of your personal data, under certain circumstances.
• Right to data portability – you have the right to obtain and reuse your personal data for your own purposes across different services.
• Right to withdraw consent - where consent is the lawful basis for the processing of your personal data, you have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn

How to contact us

If you believe that your personal data is not being processed in line with this privacy notice you have the right to lodge a complaint with our Data Protection Officer, in the first instance, by contacting: dataprotection_corporate@scottishpower.com or Data Protection Officer, Corporate Security, Scottish Power UK, 320 St Vincent Street, Glasgow, G2 5AD.

If you are not satisfied with the response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) by contacting:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Or Tel: 0303 123 111.