Privacy Policy

Business to Business Associates Limited, trading as BBA Energy, company number 03198320, is committed to protecting personal data and handling it lawfully, fairly, and transparently in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) where applicable.

This Privacy Policy explains what personal data is collected, how it is used, the lawful bases relied on, how long it is kept, who it may be shared with, and the rights available to individuals under UK data protection law.

1. Who this policy applies to

This policy applies to personal data collected through the BBA Energy website, contact forms, telephone, email, post, business enquiries, customer relationships, complaints handling, and related business communications.

2. Who controls your personal data

Data controller: Business to Business Associates Limited, trading as BBA Energy
Company number: 03198320
Registered office: 66 Paul Street, London, EC2A 4NA, UK
ICO registration reference: Z3124697

For privacy-related questions or to exercise rights under UK data protection law, contact BBA Energy using the website contact form, by phone on 01767 824024, or by post at the address above.

3. What personal data may be collected

Depending on the interaction with BBA Energy, the following categories of personal data may be collected:

• Identity data — name and job title.
• Contact data — business email address, telephone number, company name, and postal address.
• Enquiry and correspondence data — information submitted in webforms, emails, call notes, and records of discussions about services, quotations, complaints, and support.
• Customer and contract data — service requirements, supply and utilities-related information, account history, billing administration details, and records needed to provide energy procurement and related business services.
• Technical data — IP address, browser type, device information, and website usage information collected through server logs, cookies, or similar technologies.
• Marketing preference data — records of consent, opt-outs, and communication preferences.

Sensitive personal information is not intended to be collected through the website, and sensitive personal information is not stored within cookies.

4. How personal data is collected

Personal data may be collected directly when an individual:

• completes a contact form or complaint form on the website;
• contacts BBA Energy by phone, email, or post;
• requests information about services or asks for support;
• becomes a customer or representative of a customer, supplier, or partner in connection with energy procurement, utilities management, or related business services;
• uses the website, where limited technical information may be collected through cookies and server logs.

Information may also be received from customers, suppliers, business partners, publicly available sources, or other third parties where that is lawful and relevant to providing services or managing a business relationship.

5. Why personal data is used

Personal data may be used for the following purposes:

• to respond to enquiries and provide requested information about services;
• to provide business energy procurement, utilities contract management, account support, and related customer services;
• to prepare quotations, manage contracts, maintain customer records, and administer accounts and billing;
• to communicate important service, operational, or administrative updates;
• to process and respond to complaints, feedback, and customer service issues;
• to maintain website functionality, security, fraud prevention, and service improvement;
• to send marketing communications where permitted by law and where the relevant lawful basis applies;
• to comply with legal, regulatory, tax, accounting, and record-keeping obligations.

6. Lawful bases for processing

Under UK GDPR, BBA Energy must have a lawful basis for processing personal data. Depending on the context, the lawful bases relied on may include:

• Contract — where processing is necessary to take steps before entering into a contract or to perform a contract for services.
• Legitimate interests — where processing is necessary for legitimate business interests, such as responding to business enquiries, managing customer and supplier relationships, improving services, or preventing fraud, provided those interests are not overridden by individual rights and freedoms.
• Legal obligation — where processing is necessary to comply with applicable legal or regulatory requirements.
• Consent — where consent is required, for example for certain non-essential cookies or certain direct marketing activities.

Where consent is relied on, it can be withdrawn at any time, but that does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Marketing communications

BBA Energy may send business-related updates or marketing communications about services that may be relevant to existing or prospective customers, but only where there is a lawful basis to do so and, where required, in compliance with PECR and UK GDPR.

Where marketing is sent by email or similar electronic means, recipients can opt out at any time by using the unsubscribe option in the message or by contacting BBA Energy directly. Marketing preferences and suppression records may be kept so that opt-out requests can be respected.

8. Cookies and similar technologies

Cookies and similar technologies may be used to make the website work properly, remember preferences, help analyse website traffic, and support website security and performance. Sensitive personal information is not stored within cookies.

Cookies generally fall into the following categories:

• Strictly necessary cookies — essential for core website functions and security; these do not usually require consent.
• Analytics or performance cookies — used to understand how visitors use the website and improve functionality; these should only be used where the required consent has been obtained.
• Functionality cookies — used to remember settings or preferences; these may require consent depending on how they operate.
• Advertising or targeting cookies — used to track browsing activity and deliver relevant advertising; these require consent before being placed.

Users can manage cookies through browser settings. Blocking some cookies may affect how the website functions.

9. Who personal data may be shared with

Personal data may be shared where necessary with:

• service providers that support website hosting, IT systems, communications, customer relationship management, or other operational functions;
• professional advisers, auditors, insurers, payment providers, and administrators;
• suppliers, partners, or third parties involved in delivering requested services or managing business energy and utilities arrangements;
• regulators, public authorities, law enforcement bodies, courts, or other parties where disclosure is required or permitted by law.

Where third parties process personal data on behalf of BBA Energy, they should only do so on documented instructions and with appropriate security measures in place.

10. International transfers

If personal data is transferred outside the UK, appropriate safeguards must be used, such as an adequacy regulation or approved transfer mechanism, where required under UK data protection law.

11. How long personal data is kept

Personal data is kept only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, tax, accounting, contractual, and complaint-handling requirements. Once personal data is no longer needed, it will be securely deleted, anonymised, or otherwise disposed of in accordance with applicable retention procedures.

12. How personal data is protected

Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Access to personal data is limited to those who need it for legitimate business purposes.

13. Your rights

Individuals may have the following rights under UK data protection law, depending on the circumstances:

• the right to be informed about how personal data is used;
• the right of access to personal data;
• the right to have inaccurate personal data corrected;
• the right to request erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to processing, including certain direct marketing;
• the right to data portability where applicable;
• the right to withdraw consent where consent is relied on.

Requests can be made using the contact details set out in this policy. Proof of identity may be required before a request is fulfilled.

14. Complaints

Concerns about how personal data is handled should first be raised with BBA Energy so the matter can be investigated and, where possible, resolved.

There is also the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters. ICO contact details are available at ico.org.uk.

15. Changes to this policy

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, business operations, website technologies, or data handling practices. The latest version will always be published on the website with the current effective date and last updated date.

16. Contact information

For privacy questions, data rights requests, marketing opt-outs, or complaints about personal data, contact: