Protecting your data matters. Your privacy is hugely important to us. This Privacy Notice explains how CNG uses your data to give you the best and safest service around.
CNG is made up of different legal entities: CNG (Group) Ltd, CNG Energy Ltd, CNG Electricity Ltd, CNG Software Ltd, Contract Natural Gas 2 Ltd, CNG Trustees Ltd, CNG Central Services Co Ltd, CNG Retail Holdco, CNG Retail UK Ltd, CNG Merchant Services, CNG Switch Ltd and CNG Marketing Ltd. This notice is issued on behalf CNG Group Ltd, so when we mention ‘CNG Group Ltd’, ‘we’, ‘us’ or ‘our’, we are referring to the relevant company in CNG Group responsible for processing your data. This will be made known to you once you buy a product or service from us. CNG Group Ltd is the controller and responsible for this website.
Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to the Data Protection Officer at CNG Energy Limited, 2 Victoria Avenue, Harrogate, North Yorkshire, HG1 1EL, DPO@cngltd.co.uk or at 01423 502 554.
Collection and processing of personal data
Personal data is information that can identify you, such as your name, e-mail address or postal address. This data will only be stored by us if you make it available to us in the places identified in this notice.
We may collect, use, store and transfer different kind of personal data about you which we have grouped together:
- Identity Data includes first names, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender
- Contact Data includes billing address, other site address, email address and telephone numbers
- Consumption Data includes meter readings, invoices and site data. If you have a Smart or AMR meter, we’ll collect consumption data remotely at least once a month to ensure we can accurately bill you. You can opt out of more frequent data collection at any time by contacting us at email@example.com or on 01423 502 554. If you don’t opt out, we’ll collect daily or half hourly usage data from your business smart meter and may use this for commercial purposes, for example to develop new products and services. If you do opt out, we’ll still take a monthly reading to give you accurate bills.
- Financial Data includes bank account and payment card details
- Transaction Data includes details about payment to and from you
- Technical Data includes IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions,
operating system and platform and other technology on the devices you use to access this website
- Usage Data includes information about how you use our website
- Marketing and Communications Data includes preferences in receiving marketing from us and our third parties and your communication preferences.
Freedom of choice
Any information that you provide to us is always under your full control. Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to fulfil the contract we have or are trying to enter into with you (i.e. to provide you with a good or service. In these instances, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
Information you can provide to us
We may collect and process information you provide in the following forms found on the CNG website:
Allows you to receive a quote for a gas and/or electricity contract when you provide the following data:
- Address selection from a drop-down menu
- MPRN (gas meter) and/MPAN (electric meter) detail
Meter Readings (https://www.cngltd.co.uk/customers/submit-reading)
Customers can submit current and actual meter readings to CNG through a secure website. The following mandatory data must be provided when submitting a meter reading:
- Account Reference
- Meter Reading (gas or electric)
- Email address
- Telephone number
You can chat live with a member of the team on the CNG website. These conversations are automatically emailed to you as a full transcript from the following email address: Info@cngltd.co.uk.
Information provided here may be processed for the sole purpose it was provided, and not for any other purpose.
You can leave feedback for CNG at any time. The following personal data can be submitted:
- Telephone number
- Email address
- Any information provided in a free-form message
AMR and Partner Login (https://partners.cngltd.co.uk/agentportal/)
We operate a portal for our agents, brokers and Third Party Intermediaries (“TPIs”) to access data and reports applicable to them. Your credentials for gaining access to this secure site are not saved by us and are private to you. There is no facility to submit data within the secure website.
And the following ways outside of the website:
You may give us Identity, Contact and Financial Data by completing forms or speaking with us via post, phone, email or otherwise. This includes
- Sign a contract to receive services from us
- Request marketing to be sent to you
- Give us feedback
- Call us
Third parties or publicly available sources
We may receive personal data about you from various third parties and public sources, as set out below:
- Identification, Contact and Marketing and Communications Data from Brokers, agents and third-party intermediaries. We operate a broker model, so in all likelihood your first contact with CNG will be via one of these channels.
- Identification, Financial and Transaction Data from providers of payment providers
- Technical and Usage Data from analytics providers such as Google as set out below
- Identity and Contact Data from publicly available sources – such as Companies House, social media platforms and the Electoral Register based inside the EU
Where we store your personal data
All information you provide to us is stored on our secure servers.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the absolute security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Use and transmission of personal data
Generally, CNG will only use your personal data to answer your queries, process your quotes, and provide meter readings or store feedback and communications from you. We will NEVER use your personal data other than as permitted via data protection law, or in a way that doesn’t fit in with our values.
We will make every effort to ensure data is not sent outside of the EEA, where this is deemed necessary, we will ensure the country has equivalent protections as the UK. We will also ensure any third parties have specific protections in place and are aligned to our values.
Generally, we do not rely on consent as a legal basis for processing your personal data. From time to time, we may send you information about our own products and services, as well as those of selected third parties, by post, telephone and email. If you have not consented to receiving direct marketing communications, we will only send these communications to you when permitted to do so by law. You have the right to withdraw consent to marketing at any time by contacting us at firstname.lastname@example.org or on 01423 502 554.
Purposes for which we’ll process your personal data
Below you’ll find a description of the ways in which CNG plans to use your personal data, and what legal basis we rely on to do this. We have also identified what our legitimate interests are, where appropriate. To find out what a legitimate interest is further, please see the Glossary.
Please be aware that CNG may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact DPO@cngltd.co.uk if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table found in this PDF.
Disclosure of your information
We may have to share your personal data with the parties set out below for the purposes set out in the table directly above.
- Internal Third Parties as set out in the Glossary
- External Third Parties as set out in the Glossary
- Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this notice.
- In order to process a contract we will supply personal information to rating agencies, and they will provide information to us (such as financial history). We do this so we can assess creditworthiness and suitability, check identity, manage your account, trace and recover debts and prevent criminal activity. We will also provide credit rating agencies with personal data on an ongoing basis, including settled debts accounts and outstanding debts. Credit rating agencies will also share this data with other organisations. The credit rating agencies we use, alongside the ways they use and share personal data, are explained in detail at http://www.experian.co.uk/crain/index.html.
We require all third parties to respect the security of your personal data, treat it in accordance with data protection law and to live to the same values as us. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Information on web analysis
This website uses Google Analytics, a service provided by Google, Inc. This service allows CNG to analyse how users use the site. The tool uses “cookies,” which are text files placed on your computer, to collect anonymised Internet log information and visitor behaviour information. The information generated by the cookie about your use of the website (including your IP address) is transmitted to Google. This information is then used to evaluate visitors’ use of the website and to compile statistical reports on website activity for CNG Energy Limited.
We will never (and will not allow any third party to) use the statistical analytics tool to track or to collect any Personally Identifiable Information of visitors to our site. Google will not associate your IP address with any other data held by Google. Neither we nor Google will link, or seek to link, an IP address with the identity of a computer user. We will not associate any data gathered from this site with any Personally Identifiable Information from any source, unless you explicitly submit that information via a fill-in form on our website.
Cookies set by Google Analytics
For more information about Google Analytics, view their terms of service here: https://www.google.com/analytics/terms/gb.html
Cookies & Retargeting
Cookies allow us to collect and store anonymous information such as: device type, operating system, browser version and geographic location. Cookies do not collect personal data, or any data which could identify you. Cookies disappear after 60 days of no interactions, unless deleted by you on your personal computer settings. If you revisit the site then the cookie’s lifespan is reset to a further 60 days. Under http://site.adform.com/privacy-policy-opt-out/ you can find further information about deactivating cookies.
How long will we store your data for?
We will only store personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
Right to withdraw consent
We make sure that you can withdraw consent as easily as providing it. Simply contact the Data Protection team on DPO@cngltd.co.uk should you wish to withdraw consent for data that we process on your behalf.
The ability to withdraw your consent is subject to us no longer requiring this for a lawful basis as listed above. For example, if you are a customer and you withdraw your consent from us contacting you, we may still contact you (by telephone, email or SMS text message) to maintain your account, for example to request an accurate meter reading.
Right to object or restrict our processing
You have the right to ask us not to process your personal data for marketing purposes. We will request consent from you if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You also have the right to restrict our processing for certain third parties that we use to assist us in providing you with an amazing level of service. For further information, or to exercise these rights at any time, you can contact us at CNG Energy Limited, 2 Victoria Avenue, Harrogate, North Yorkshire, HG1 1EL or the Data Protection team at DPO@cngltd.co.uk.
Right to Access
You can request access to the personal data we hold about you, at any time. To submit a request for access to your data, we offer an easy-to-use (non-obligatory) form to make sure you get exactly the data require. To receive this form, or submit a request for access without using the form, please email us at DPO@cngltd.co.uk.
You will not have to pay a fee to access your personal data, or to exercise any of your other rights. However, we have the right to charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may also refuse to comply with your request in these circumstances.
Right to rectify
If any data we hold about you is incorrect, or your personal details change for whatever reason, please contact CNG at email@example.com or call on 01423 502 554.
Right to erase
Under certain conditions, our customers can request any personal data we hold on them be erased. Such requests are considered alongside our overarching right to keep data for retention purposes.
To request further information, or to submit a request to delete your data, please call on 01423 502 554 or email the CNG Data Protection team at DPO@cngltd.co.uk.
Right to data portability
We will always offer your data, where requested, in a format that is easily accessible by you. The formats offered are:
- • Large request – a minimum of recorded delivery or an encrypted USB Drive
- • Small request – an encrypted email or secure file sharing provider
Automated decision-making and profiling
Automated decision-making is a decision made automatically without any involvement from a human – typical examples here would be for when you apply for a loan, or a credit card.
We do not use automated decision making internally, but our external partners may use it for when we request a credit check for you. You will have the right to request human intervention and challenge any automated decision. We do not make any decisions based solely on automated decision-making.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. It may, on occasion, take us longer than a month if your request is particularly complex or you have made a number of concurrent requests. In this case, we will notify you and keep you updated.
External internet sites
CNG is not responsible for the content of external internet sites.
Legitimate interest means the interest of our business in conducting and managing our business to enable us to give you the best service and the most secure experience. We make sure we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you unless we have your consent or are otherwise permitted by law).
You can obtain further information about we assess our legitimate interests against any potential impact on you by contacting DPO@cngltd.co.uk.
Performance of a Contract means processing your data where it is necessary for the performance of a contract which you have signed, or to take steps at your request before entering into such a contract.
Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.
Internal Third Parties:
Other companies in the CNG Group (who act as joint controllers or processors) and who are based in the United Kingdom and provide IT and system administration services, leadership reporting and Ofgem licensed activities).
External Third Parties:
- Service providers acting as processors based in the United Kingdom who provide IT and system administration and operational administration services
- Third party service providers who may provide our customers with information on additional products and services
- Professional advisors acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the United Kingdom who provide consultancy, banking, legal, insurance and accounting services.
- HM Revenue and Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.