We are committed to protecting your privacy and to complying with applicable data protection and privacy laws. This privacy notice (together with our terms of service) tells you how we collect, use, and protect your information when you visit our website or use our energy management services (“services”), and your rights to your information. We will only use information we collect about you in accordance with this privacy notice.

This notice is effective from 20th October 2023 and may be updated from time to time. This privacy policy supplements other privacy notices we might provide to you.

Who we are

By “we”, “us”, “our” or “Levelise” we mean Levelise Limited, a company registered in England No. 10653159 at Synergy House Woolpit Business Park, Woolpit, Bury St. Edmunds, Suffolk IP30 9UP. Our ICO registration number is ZA530773.

What data we collect and how

We may collect personal information about you that includes:
• Locational data: Your geolocation as transmitted by our equipment if installed in your property. Your Metering Point Administration Number (MPAN) which is a unique identifier of the electricity supply for your property.
• Energy usage and market data: Energy use in your home, including when and how much energy is consumed by your household appliances, or produced by your solar installation, or other microgeneration equipment. Your electricity supplier, tariff information, and distribution network operator (DNO). Your solar feed-in tariff.
• Technical data: IP address, browser type and version, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website. We track some technical data by using cookies (see ‘Cookies’ section below for more details).
• Auditing data: Use of some website or app functions are logged to identify and isolate usage patterns and system problems (e.g. successful logins are logged, but the log only uses a user ID number and does not store details of passwords used to login).
• Personal details: Your full name, date of birth, contact address, property address, email address, telephone number and username.
• Correspondence: Any emails, letters or other forms of contact you have sent us or we have sent you, and any communications we have received from parties dealing directly with you, referencing you or your data.
• Financial data: Your bank account details to enable us to make payment to you.

We typically collect information in three ways:

• If and when you provide information to us (e.g. through use of our website, app or product registration).
• Through a device installed in your home which is connected to one of our services. This device will monitor and manage electrical equipment in your home (e.g. your solar and battery installation, heat pump or other energy consuming/producing appliances).
• From outside sources (e.g. your electricity supply details, including your MPAN, from industry sources, or third parties (e.g. your energy supplier or renewable energy installer).

External data processors

N3rgy data service
With your explicit consent, we use n3rgy data service (https://data.n3rgy.com) to interface with the national smart meter systems in order to collect, store, manage and share with us your Smart Meter data. This service uses the Smart Energy Code (https://smartenergycodecompany.co.uk/) Party credentials and Party ID of its parent, N3RGY LIMITED, incorporated and registered in England and Wales with the company number 11203504 whose registered office is at 4 Ovington Drive, Fleet, GU51 1DF. You can withdraw consent at any time by contacting us at support@levelise.com.

FlatPeak
With your explicit consent, we use FlatPeak (https://www.flatpeak.energy/) incorporated and registered in England and Wales with the company number 13581791 whose registered office is at FlatPeak Technology Ltd, 24 Greville Street, London, EC1N 8SS to obtain your tariffs from your electricity supplier. Depending on the relationship held between FlatPeak and your electricity supplier, FlatPeak may retain your account login credentials securely which will only be used for the purpose of accessing your tariff information. We use your tariff information to accurately calculate your savings and earnings; and to suggest if you could save money by switching to a different tariff or supplier. You can withdraw consent at any time by contacting us at support@levelise.com.

SolaX
With your explicit consent (verbal or written), we may register your SolaX inverter (where applicable) with SolaX Power Network Technology Zhejiang Co Ltd (https://www.solaxpower.com/) via their online portal. This allows us to perform remote firmware updates on your behalf. You can withdraw your consent for this at any time by contacting us at support@levelise.com.

How we protect your information

The security of your information matters to us. In order to protect your information, we have put in place physical, electronic and procedural safeguards. For example, these include:

Storing your data in highly secure cloud environments hosted by Amazon, IBM, Microsoft and Google.
• Ensuring that data sent between you and Levelise is secured using industry standard TLS (Transport Layer Security) encryption.
• A strict user access policy that only allows access to your data to relevant personnel.

What we do with your data

We will only use personal information where we are allowed to by law. This will be under one or more of the following circumstances:
• To perform our contract we have or will have with you, either directly or via a third party.
• To operate our website and to deliver the services that you have requested.
• Where it is necessary for us to run our business and to give you the best possible service.
• To comply with a legal or regulatory obligation.
• Where you have consented, or where you are a direct customer of ours, we may send you information about our other products and services which we think will be of interest to you.

For further detail on how we use your personal information please refer to this list:

Sharing your information

We sometimes need to allow our service providers to process personal information we hold about you on our behalf for the reasons set out in this Policy or as otherwise required by law. We make sure that these third parties won’t use your personal data for their own purposes and we only permit them to use it in accordance with our instructions and the law. This includes the following types of organisations:
• Trusted businesses or persons; processing your information for us for the purposes set out above, based on our instructions and as set out in our Privacy Notice and any other appropriate confidentiality and security measures. For example, we use service providers to help us with payment processing and analytics services.
• Energy industry partners; including other suppliers, National Grid, network operators and energy market administrators/regulators.
• Marketing agencies, search engines and social media networks; to advertise and to gather feedback on us such as through customer surveys.
• People you have authorised us to share data with so we can fulfil your requirements.
• Aggregated (non-personalised) data; with agencies that help us with advertising.

Transfer of your information out of the UK or the EEA

Sometimes our affiliates and service providers may be based outside the European Economic Area, so when working with them, we may pass your information outside of the European Economic Area to countries that do not have the same data protection standards as the UK. If we do this, we will ensure that any information is protected in line with this Privacy Policy. Some of the third parties with whom we share Personal Data are also located outside the EEA. Certain third countries, such as Canada and Switzerland, have been officially recognised by the European Commission as providing an adequate level of protection. Transfers to third parties located in other third countries outside the EEA take place using an acceptable data transfer mechanism such as, the EU standard contractual clauses for data transfers, Binding Corporate Rules, approved Codes of Conduct and certifications, or in exceptional circumstances on the basis of permissible statutory exceptions.

Automated decision making

We do not use automated decision-making processes for procedures that have legal implications or a similarly significant impact on you.

How long we keep your information

We will only retain your personal information for as long as necessary for the reason we have collected it, including for any contractual, legal or regulatory requirements we have to comply with. Generally, for the services we provide, this means that we will have to store the information for at least 12 months.

In some circumstances, especially if there have been financial transactions between us and you, we will retain your data for longer than 12 months. When determining how long to retain your personal data, we consider amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorised use or disclosure of your personal information; the purposes for which we process your personal information and whether we can achieve those purposes through other means; and any applicable legal and regulatory requirements.

We may anonymise your personal information, so that it can no longer be associated with you, and use this indefinitely without further notice.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

Your rights

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data information:
• The right to request a copy of your personal data which we hold about you.

• The right to request that we correct any personal data if it is found to be inaccurate or out of date.
• The right to request your personal data is erased where it is no longer necessary for us to retain such data.
• The right to withdraw your consent to the processing at any time, if consent is relied upon as a processing condition.
• The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller (known as the right to data portability).
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.
• The right to object to or restrict the processing of personal data in certain circumstances.
• The right to lodge a complaint with the Information Commissioners Office.

To exercise your rights in relation to your personal information, please email support@levelise.com.

You are able to exercise your rights free of charge, but if you make unfounded, repetitive or excessive requests, we may charge you to carry these out or refuse to act on such requests.

We will try to respond to all requests within one month. If your request is complex or if you make lots of requests, we may extend our time to respond. If this is the case, we will let you know.

If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated. If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law, you can complain to the Information Commissioner’s Office at https://ico.org.uk

How we use cookies on our website

Please see our Cookie Policy for information on the cookies we use when you visit our website.

Contact details

To exercise all relevant rights, for queries or if you have concerns or complaints, please contact us in the first instance at support@levelise.com or by post to:

Levelise Ltd
Synergy House
Woolpit Business Park
Woolpit
Bury St Edmunds
Suffolk
IP30 9UP
United Kingdom